Abstract: An information processing apparatus includes processing circuitry configured to acquire a security log including information regarding unauthorized communication stored in an upper network device being a device constituting an overlay network, an authentication log stored in a cloud server, and a communication log stored in a lower network device being a device constituting an underlay network, specify information such that, when the authentication log includes a connection source IP address that does not exist in the communication log acquired and the security log includes information regarding an access not permitted to be used from the connection source IP address, the processing circuitry specifies the information regarding the access as unauthorized communication, and give an instruction to block the unauthorized communication specified.

Abstract: A method and system for mitigating a threat associated with network data packets are provided. The method commences with receiving, by an authentication server, a request for access to a server from a client. The method further includes authenticating the client by the authentication server. The authentication includes providing an authentication token to the client. The method continues with receiving, by a mitigation device, from the client, at least one network packet directed to the server. The at least one network packet embeds the authentication token. The method further includes validating, by the mitigation device, authenticity of the authentication token and selectively forwarding, based on the validation, the at least one network packet to the server. The authentication token is independently generated by the authentication server and the mitigation device, and is unique for each packet.

Abstract: The implementations provide a method including: encrypting records on one or more computing devices using a key of the one or more computing devices to generate a first set of encrypted records; preparing a matrix indicating that each of the first set of encrypted records is present on the one or more computing devices; responsive to receiving, from a remote device, a second set of encrypted records encrypted by the second device using a key of the remote device, encrypting the second set of encrypted records using the key of the one or more computing devices; and transmitting the second set of doubly encrypted records, along with the matrix, to the remote device for the remote device to determine, using the matrix, whether at least one of the second set of encrypted records of the second device is included in the first set of encrypted records on the first device.

Abstract: Methods and systems for securely deploying an artificial intelligence (AI) model. The system can identify one or more deficiencies of the AI model, and protect the AI model from being attacked by external data based upon the identifying. The system can be used for fraud detection based on tabular data, voice authentication, facial recognition, object detection, or a combination thereof.

Abstract: A trust store management system for a network communication ecosystem is provided. The system is programmed to a) receive a DNSSEC entry address of a DNSSEC entry stored at a DNSSEC server; b) transmit a request to a DNSSEC server to access information stored in the DNSSEC entry associated with the DNSSEC entry address; c) receive, from the DNSSEC server, the information stored in the DNSSEC entry; d) receive a trust store; and e) validate the trust store based on the information stored in the DNSSEC entry.

Abstract: A system for performing a multi-party computation (MPC) operation may include an MPC node executed in a secure enclave. The MPC node includes executable instructions injected into the secure enclave to create an execution environment. The secure enclave performs an attestation check on the execution environment, generates a result of the attestation check, and cause the secure enclave to create a cryptographic signature on the result of the attestation check. The system may also include an attestation node in communication with the secure enclave. The attestation node verifies the cryptographic signature on the result of the attestation check and cause a decryption of an encrypted private cryptographic key shard to generate a decrypted private cryptographic key shard. The decrypted cryptographic key shard is used by the MPC node to perform part of the MPC operation.

Abstract: A device, system and method for providing services between a communication device and an application server is provided. A trust session is established between a gateway device and an application server. The gateway device provides, to the application server, on behalf of a communication device served by the gateway device: a service request that requests a service from the application server; an indication of successful authentication of the gateway device by the application server, the indication associated with the trust session; and a payload including an indicator of the communication device. The gateway device receives, from the application server, a verification of the service request determined using at least the indication associated with the trust session. The service is provided between the communication device and the application server via one or more of the gateway device and a network.

Abstract: A method may include obtaining a manifest file that includes various software definitions for various peripheral device functions. The method may further include determining whether the manifest file is signed by a predetermined cryptographic key. The method may further include obtaining, in response to determining that the manifest file is signed by the predetermined cryptographic key, a selection of a peripheral device function among the peripheral device functions in the manifest file. The method may further include performing the peripheral device function using a peripheral device in response to obtaining the selection of the peripheral device function.

Abstract: A computer-implemented method, according to one approach, includes: generating lookup tables for signatures during compile time, the lookup tables having cryptographic information. A secret key is used to encrypt the lookup tables, and the secret key is stored in a secure storage which is accessible only to a secure engine. Moreover, in response to experiencing an initial boot: the lookup tables are decrypted using the secret key, and the decrypted lookup tables are stored in the secure storage. Other systems, methods, and computer program products are described in additional approaches.

Abstract: The techniques herein are directed generally to a “zero-knowledge” data management network. Users are able to share verifiable proof of data and/or identity information, and businesses are able to request, consume, and act on the data—all without a data storage server or those businesses ever seeing or having access to the raw sensitive information (where server-stored data is viewable only by the intended recipients, which may even be selected after storage). In one embodiment, source data is encrypted with a source encryption key (e.g., source public key), with a rekeying key being an encrypting combination of a source decryption key (e.g., source private key) and a recipient's public key. Without being able to decrypt the data, the storage server can use the rekeying key to re-encrypt the source data with the recipient's public key, to then be decrypted only by the corresponding recipient using its private key, accordingly.

Abstract: The present disclosure generally relates to methods and user interfaces for authentication, including providing and controlling authentication at a computer system using an external device in accordance with some embodiments.

Abstract: A method for controlling access to a resource in an electronic device including a secure element with a permanent memory having an OTP area. The method includes the following steps performed first when the secure element or the electronic device boots: checking presence of at least one of a secret data and an initialization value in the permanent memory and, in a negative event, generating an initialization value and storing it into the OTP area, in a positive event, if the permanent memory includes secret data, decrypting, within the secure element, the secret data by using an algorithm using a cryptographic key and, if the permanent memory further includes an initialization value, the initialization value, and checking the integrity of the secret data by using a signature stored in the permanent memory and, on successful completion, providing access to the resource.

Abstract: A system is provided for intelligent automated simulation of penetration testing and isolation of vulnerable distributed electronic data registers. In particular, the system may extract metadata regarding one or more nodes or sections of a distributed register. Based on the metadata, the system may generate a knowledge graph that may indicate the vulnerabilities associated with particular nodes, blocks, and/or sections of the distributed register. Based on the knowledge graph, the system may compute vulnerability scores for the various nodes, blocks, and/or sections, and generate a vulnerability heatmap based on the scores. The system may further be configured to allow a user to perform automatic simulated penetration tests on the vulnerable portions of the distributed register and/or execute one or more remediation process on such vulnerable portions. In this way, the system provides an efficient way to identify and remediate vulnerabilities within a distributed register.

Abstract: Methods, systems, and apparatuses are described for identifying unauthorized (e.g., rogue) access points. Authorized access points can detect the presence of rogue access points by determining signal strengths associated with other access points. A detected variance from an expected signal strength can indicate a presence of a rogue access point.

Abstract: Techniques are provided for email protection using email signatures based on signing tokens. One method comprises obtaining a signed email from an email sender. The signed email comprises a second hash value generated using a source version of the signed email embedded with a signing token of the email sender. A data record stores a first hash value, based on the source version, and the second hash value. The second hash value is obtained from the signed email and compared to: (i) a copy of the second hash value obtained from the data record and/or (ii) a comparison value generated using a regenerated version of the source version embedded with the signing token of the email sender. A delivery of the signed email to an email recipient may be based on a result of the comparison.

Abstract: Systems and methods provide a password reset for a management controller, which is not exposed to the Internet. Upon receiving a request to reset the password, the management controller generates computer-readable information such as a barcode, where the computer-readable information indicates attributes of an information handling system associated with the management controller as well as a timestamp. A user can transmit the computer-readable information to a vendor application service via for example a mobile device that reads the computer-readable information. The vendor application service verifies the request and generates a temporary password from the timestamp and the attributes. Independently of the vendor application service, the management controller also generates the temporary password from the timestamp in the attributes. The vendor application service may then cause the temporary password to be sent to verified contact information.

Abstract: A method of operating a secure programming system is provided. The method can use the first authentication module as the root authentication module to authorize the second authentication module of the program burning system when the first authentication module fails to provide the private key. In this way, the second authentication module obtains the second certificate composed of the second digital signature and becomes the first relay authentication module authorized by the first authentication module to issue certificates on behalf of the first authentication module, so that the program burning system can perform burning operations and process operations. Therefore, the method of the present disclosure can not only achieve the purpose of signing the same certificate in a more secure manner, but also help the first authentication module to be more flexible in classifying the second authentication module according to different product application categories or methods.

Abstract: The present disclosure relates to an image sensor device (100). The image sensor device (100) has a data communication interface (110) configured to receive a hash value (112), a cryptographically secure storage (120) storing a cryptographic key (122) of the image sensor device, and a processor (140) configured to sign captured image data (132) or a processed version thereof and the received hash value (112) using the cryptographic key (122) to generate a signature (142) of the image data. The data communication interface (110) is configured to transmit the generated signature (142), the captured image data (132), and an identifier (150) of the image sensor.

Abstract: A non-transitory computer-readable recording medium storing an information management program for causing a computer to execute processing including: receiving distribution information obtained by attaching, to distribution content to be distributed by a user, attribute information on the user that includes signature information that is signed by an issuing authority that issues information regarding an attribute of the user and that proves that the issuing authority has issued the attribute information; verifying whether the attribute information on the user included in the distribution information is the attribute information issued by the issuing authority, by using the signature information; and outputting the distribution content, based on a verification result.

Abstract: The present invention relates to a personal awareness system that provides users physical health/wellness/welfare safety as well as online digital safety by blocking inappropriate digital content. The personal awareness system comprises a network protection appliance for use on a local area network (LAN), a software application that is used on a mobile computing device, a cloud-based remote data processing resource to administer the system, artificial intelligence (AI) information systems, and a monitor computing device that an observer can use to monitor, track, and receive alerts related to the user. The system can support many users individually as well as groups of users. In operation, sensors associated with the mobile computing device monitor the health, wellness, and location of users and digital filter rules suppress inappropriate digital content from user access providing digital safety. The mobile computing device seamlessly transitions between LAN environments and wireless mobile environments.