Abstract: Techniques for preserving privacy while still allowing secure access to private resources. Among other things, the techniques may include receiving a request to provide a remote device with access to a private resource. In some instances, the request may be redirected to an identity provider service to authenticate the user of the remote device to maintain anonymity of an identity of the user. The techniques may also include receiving an indication of an entitlement-set provided by the identity provider service, the indication of the entitlement-set indicative of whether the user is entitled to access the resource without revealing the identity of the user. The techniques may also include at least one of authorizing the remote device to access the resource or refraining from authorizing the remote device to access the resource based at least in part on the indication of the entitlement-set.

Abstract: A processing system may obtain a request from a user device to activate an access credential locker for use in accessing at least one enterprise system of an enterprise via the processing system, the request comprising a token that identifies the access credential locker, obtain a first key from the user device, transmit, to the enterprise, a request for a second key, obtain the second key from the enterprise in response to the request, apply the first key and the second key to the access credential locker, the access credential locker being encrypted in accordance with the first and second keys and being decrypted via the applying of the first and second keys, and establish a communication session between the user device and the at least one enterprise system via the processing system using at least one access credential that is stored in the decrypted access credential locker.

Abstract: A pipeline has been created that leverages artificial intelligence and machine learning to efficiently extract information from CTI reports obtained from various sources and yielding information that assists security analysts/threat teams (e.g., security operations centers (SoCs)) and improving the quality of CTI. The “CTI analysis pipeline” employs generative artificial intelligence (“genAI”) to summarize a collection of CTI threat reports and extract threat-related information including TTPs from the CTI reports. Relationships among the threat reports are determined based on the extracted threat-related information and encoded in a graph structure. Graph embeddings based on the relationships encoded in the graph structure and semantic embeddings from the report summaries are combined and the combined embeddings are clustered.

Abstract: Described is a framework for associating and distributing public keys linked to email identifiers. In this system, an Internet domain specifies a Domain Key Authority (DKA) via a DNS record. The DKA collects, stores, and serves public keys for email IDs under that domain, verifying the binding between each email ID and its public key without relying on certificates or webs of trust. Multiple DKAs collectively form a logical infrastructure for distributing and retrieving public keys across the email namespace. Because email IDs are widely used to sign into various applications, this framework enables authentication without shared secrets or third-party authenticators. Other applications include email encryption, crypto wallets, and cryptographically secure services.

Abstract: The invention belongs to the field of computer security and discloses a blockchain-based anonymous authentication method for the Internet of Vehicles across trusted authorities, including registering the vehicle (with onboard unit) and roadside unit in their respective trusted authorities. When the vehicle enters different trusted authority domains, both the onboard unit and roadside unit generate corresponding authentication parameters and transmit them to the consortium blockchain of the Internet of Vehicles for verification and signature, obtaining authenticated data signed by the consortium blockchain. The onboard unit and roadside unit receive and verify the authenticated data, and upon successful verification, the onboard unit calculates a session key. The onboard unit uses the session key to sequentially transmit data with the roadside unit and the consortium blockchain.

Abstract: A method and system for configuring a data change filter in a virtualized environment are provided. A data change filter is installed in a hypervisor of a virtualization host, where the hypervisor executes a virtual machine. The data change filter intercepts data change operations from the virtual machine. The hypervisor includes a certificate management service that stores a private certificate for the data change filter and a public certificate for a replication processing service. The data change filter retrieves the certificates from the certificate management service, establishes an authenticated network connection with the replication processing service using the certificates, and sends the intercepted data change operations to the replication processing service over the authenticated connection. The system enables secure replication of data changes in virtualized environments.

Abstract: In accordance with some embodiments, various examples of systems, methods, and media for detecting falsified Wi-Fi signals. A system detects a group of nearby access points (APs) broadcasting Wi-Fi signals. A determination is made whether the group of nearby APs contains at least one falsified Wi-Fi signal. Whenever it is determined that the group of nearby APs does contains at least one falsified Wi-Fi signal, an analysis is performed of each AP of the group of nearby APs. The analysis uses at least one of: a pair-wise comparison of AP locations, or an analysis of physical layer attributes of the signals broadcasted by the APs. APs of the group of nearby APs are identified that are falsified. A mitigation action is initiated relative to the falsified APs that are identified.

Abstract: A network node for a field device data network, which receives first field device data, store, the first field device data in data blocks, receives a data block request including a public key and digital monetary data, checks the digital monetary data, and if the check is successful, answers the data block request by encrypting the requested data block using the public key and transmitting the data block encrypted using the public key.

Abstract: Various aspects of the present disclosure relate to attribute-based credentials for resource access. An apparatus, such as a UE, communicates a registration request message for registration of the apparatus to a wireless communication network, the registration request message including a credentials indication associated with a credential. The apparatus receives a response message including a presentation policy for registration to the wireless communication network, and communicates a presentation token generated based at least in part on the presentation policy, the presentation token including proof information for a private key. The apparatus receives an authentication challenge, and generates, based at least in part on the authentication challenge, an authentication result using a root key and a subscription identity from the credential.

Abstract: A method is provided for temporarily enabling functionality of a secure device. The method includes storing public keys for respective trusted devices of at least one trusted device, storing device-unique data that is unique for the secure device, generating a unique hashed-based message authentication code (HMAC) key, computing, based on the HMAC key and the device-unique data, a unique HMAC, transmitting the HMAC to a trusted device of the at least one trusted device, receiving a signed HMAC from the trusted device, wherein the signed HMAC is the HMAC as signed by the trusted device using a private key of the trusted device, decrypting the signed HMAC using the public key for the trusted device, comparing the decrypted signed HMAC to the HMAC, and enabling functionality of the secure device based on a result of the comparison.

Abstract: Computer systems and methods are provided for storing a first path profile. A computing device receives a first request to access a first location of a website, transmits the first request to a server, and receives a first cookie that includes identifying information for the first location. In response to receiving the first cookie, the device stores the identifying information. The device receives a second request to access a second location of the website that is distinct from the first location. The second request includes the identifying information for the first location. The device transmits the second request to the server and receives a second cookie that includes the identifying information for the first location and for the second location. In response to receiving the second cookie, the device stores the first path profile that includes the identifying information for the first location and the second location.

Abstract: A method for access control to a wireless local area communication network, including a gateway for accessing the local area network and a plurality of user terminals capable of being connected to the local area network via the access gateway. The access control of one of the user terminals to the network includes: authenticating the user terminal on the basis of an item of information derived from a biometric print of a user of the user terminal, and applying, to the user terminal, a network access profile personalized for the user to whom the biometric print belongs.

Abstract: An information processing apparatus includes processing circuitry configured to acquire a security log including information regarding unauthorized communication stored in an upper network device being a device constituting an overlay network, an authentication log stored in a cloud server, and a communication log stored in a lower network device being a device constituting an underlay network, specify information such that, when the authentication log includes a connection source IP address that does not exist in the communication log acquired and the security log includes information regarding an access not permitted to be used from the connection source IP address, the processing circuitry specifies the information regarding the access as unauthorized communication, and give an instruction to block the unauthorized communication specified.

Abstract: A method and system for mitigating a threat associated with network data packets are provided. The method commences with receiving, by an authentication server, a request for access to a server from a client. The method further includes authenticating the client by the authentication server. The authentication includes providing an authentication token to the client. The method continues with receiving, by a mitigation device, from the client, at least one network packet directed to the server. The at least one network packet embeds the authentication token. The method further includes validating, by the mitigation device, authenticity of the authentication token and selectively forwarding, based on the validation, the at least one network packet to the server. The authentication token is independently generated by the authentication server and the mitigation device, and is unique for each packet.

Abstract: The implementations provide a method including: encrypting records on one or more computing devices using a key of the one or more computing devices to generate a first set of encrypted records; preparing a matrix indicating that each of the first set of encrypted records is present on the one or more computing devices; responsive to receiving, from a remote device, a second set of encrypted records encrypted by the second device using a key of the remote device, encrypting the second set of encrypted records using the key of the one or more computing devices; and transmitting the second set of doubly encrypted records, along with the matrix, to the remote device for the remote device to determine, using the matrix, whether at least one of the second set of encrypted records of the second device is included in the first set of encrypted records on the first device.

Abstract: Methods and systems for securely deploying an artificial intelligence (AI) model. The system can identify one or more deficiencies of the AI model, and protect the AI model from being attacked by external data based upon the identifying. The system can be used for fraud detection based on tabular data, voice authentication, facial recognition, object detection, or a combination thereof.

Abstract: A trust store management system for a network communication ecosystem is provided. The system is programmed to a) receive a DNSSEC entry address of a DNSSEC entry stored at a DNSSEC server; b) transmit a request to a DNSSEC server to access information stored in the DNSSEC entry associated with the DNSSEC entry address; c) receive, from the DNSSEC server, the information stored in the DNSSEC entry; d) receive a trust store; and e) validate the trust store based on the information stored in the DNSSEC entry.

Abstract: A system for performing a multi-party computation (MPC) operation may include an MPC node executed in a secure enclave. The MPC node includes executable instructions injected into the secure enclave to create an execution environment. The secure enclave performs an attestation check on the execution environment, generates a result of the attestation check, and cause the secure enclave to create a cryptographic signature on the result of the attestation check. The system may also include an attestation node in communication with the secure enclave. The attestation node verifies the cryptographic signature on the result of the attestation check and cause a decryption of an encrypted private cryptographic key shard to generate a decrypted private cryptographic key shard. The decrypted cryptographic key shard is used by the MPC node to perform part of the MPC operation.

Abstract: A device, system and method for providing services between a communication device and an application server is provided. A trust session is established between a gateway device and an application server. The gateway device provides, to the application server, on behalf of a communication device served by the gateway device: a service request that requests a service from the application server; an indication of successful authentication of the gateway device by the application server, the indication associated with the trust session; and a payload including an indicator of the communication device. The gateway device receives, from the application server, a verification of the service request determined using at least the indication associated with the trust session. The service is provided between the communication device and the application server via one or more of the gateway device and a network.

Abstract: A method may include obtaining a manifest file that includes various software definitions for various peripheral device functions. The method may further include determining whether the manifest file is signed by a predetermined cryptographic key. The method may further include obtaining, in response to determining that the manifest file is signed by the predetermined cryptographic key, a selection of a peripheral device function among the peripheral device functions in the manifest file. The method may further include performing the peripheral device function using a peripheral device in response to obtaining the selection of the peripheral device function.