Abstract: A method and system include receiving, by a processor of a server, from a computing device associated with a user, real-time user activity data identifying at least one activity performed on the computing device. User-inputted data elements from a plurality of elements of a graphical user interface displayed on the computing device are received, which identify user-specific data attributes. Potential user-specific knowledge information is identified from databases based on at least one user-specific data attribute. User-specific challenge questions based on the potential user-specific knowledge information are generated and displayed on the user's computing device. Answers to the user-specific challenge questions by the user are received. An answer score based on correct answers and a behavioral score based the real-time user activity data of the user are determined. The processor determines whether the user is or is not a fraudster based on the answer score and the behavioral score.

Abstract: Provided is a method for blockchain-based recordkeeping and implementable by a terminal device. The method comprises: obtaining target data; computing a data digest of the target data, and extracting a key segment from the target data; signing, in a secure operation environment included in the terminal device, the data digest and/or the key segment based on a private key associated with the terminal device to generate a signature; and submitting to a blockchain the data digest, the key segment, and the signature, for one or more nodes in the blockchain to verify the signature based on a public key corresponding to the private key, and to record the data digest and the key segment in the blockchain in response to the signature being verified to be valid.

Abstract: Systems and methods are described for modifying input and output (I/O) to an object storage service by implementing one or more owner-specified functions to I/O requests. Such functions can include data access control functions, data manipulation functions, and the like. The owner of an object collection maintained by the object storage service can specify code execution environment rules that can give privileges to the execution of such functions such as by allowing the functions to access external services or the requesting user's private resources. In this manner, owners of the object collection are provided with greater control over how the object collection is accessed.

Abstract: A processor of a remote crypto cluster (RCC) may receive a public key from a client device through at least one network. The processor of the RCC may obtain an encrypted specific key and a blinded project key from at least one data source through the at least one network. The processor of the RCC may derive a derived key in blind based on the encrypted specific key and the blinded project key. The processor of the RCC may send the derived key in blind to the client device.

Abstract: Methods and systems are disclosed for anti-replay protection for network packet communications. A scorecard is stored that includes packet sequence numbers for received packets associated with a network packet flow. For each received packet, an anti-replay unit accesses the scorecard for an initial check to determine if the current packet represents a late packet and/or a replay packet. After further processing, the anti-replay unit accesses the scorecard for a final check to determine if the current packet represents a replay packet. For one embodiment, the initial check uses a first window of packet sequence numbers, and the final check uses a second window of packet sequence numbers that is larger than the first window. For further embodiments, multiple processing units operate in parallel to process received packets and to share the anti-replay unit, and each processing unit requests initial and final checks for received packets it processes.

Abstract: An example operation may include one or more of receiving, from a blockchain peer node, a sequence of blocks stored in a hash-linked chain of blocks on a distributed ledger, where each block in the sequence of blocks includes a reduced-step hash of block content from a previous block in the sequence, performing an approximate hash verification on the reduced-step hashes stored among the sequence of blocks, and determining whether the sequence of blocks has been tampered with based on the approximate hash verification on the reduced-step hashes.

Abstract: A virtual private network connection method and a memory card device using the virtual private network connection method are provided. Firstly, a virtual private network connection application program is provided. Then, the virtual private network connection application program is loaded in a memory card device. Then, the memory card device is installed in a medical device. After the virtual private network connection application program is executed and the memory card device is connected to a virtual private network server according to a connection request, the data from the medical device is transmitted to the virtual private network server through the memory card device. In such way, the data will not be attacked by malware and stolen by a third-party manufacturer during the transmission process.

Abstract: Systems and techniques for data creation limits are described herein. In an example, a data creation limits system is adapted to receive data and split the data into a plurality of portions based on entity interests in each of the plurality of portions. The data creation limits system may be further adapted to generate respective tokens for each portion of the plurality of portions. The data creation limits system may be further adapted to assign an owner to a token of the respective tokens, the token corresponding to a portion of the plurality of portions and assigning the owner based on the owner having an entity interest in creation of the portion. The data creation limits system may be further adapted to generate a script, using the token, for access to the portion. The data creation limits system may be further adapted to save the portion including the token.

Abstract: Applications on a device are assigned scores based on their attributes, update status, and source. A device is a assigned a score based on its attributes and the scores of applications installed thereon. the device score may be combined with an evaluation of user behavior to obtain a user score. The scores may be used to invoke security actions with respect to data and services of an enterprise. Security reports for a network environment may be modified such that the severity of threats accounts for policies and attributes of the environment. Security of a device may be evaluated locally, including the training of a model to identify anomalous authentication or usage behavior. Security of a device may be reduced to a score lacking personal information that may be used by a server to select access controls for a device.

Abstract: An example operation includes one or more of encrypting, by a transport, received data based on a first biometric associated with an occupant, unencrypting, by the transport, the encrypted data, based on a verification of a second biometric, wherein the second biometric is a continuum of the first biometric, and providing, by the transport, the unencrypted data to the occupant.

Abstract: Disclosed are examples for providing functions to receive a media file to be stored in a media repository. In the examples, a location in the media repository may be assigned to the media file. A media file address in a blockchain platform may be assigned to the media file. Metadata including the assigned location in the media repository and the assigned media file address in the blockchain platform may be added to the media file. A media file hash value may be generated by applying a hash function to the media file including the metadata. The media file hash value may be included in a message and uploaded to the assigned media file address in the blockchain platform as a transaction in the blockchain. An indication that the media file is uploaded to the media repository may be delivered to a subscriber device from which the media file was received.

Abstract: Some embodiments provide a method for defining an adaptable monitoring profile for a network. The defined network monitoring profile is independent of the security policy defined for the network and includes one or more log generation rules, each of which defines a logging policy for a set of data compute nodes (DCNs) that share a common attribute. A log generation rule specifies whether the network activities of a set of DCNs that share a common attribute should be logged or not. A log generation rule can also specify other logging parameters such as priority level of the logs and the required logging protocol for transmission of the logs. The logging policy of a log generation rule is associated with a set of service rules (e.g., firewall rules) through a dynamic service group, and is applied to the service rules when any of these rules is triggered.

Abstract: A computer implemented system and method for providing general data protection regulation (GDPR) compliant hashing in blockchain ledgers. The invention guarantees a user's right to be forgotten, in compliance with the GDPR regulations, utilizing blockchain technologies.

Abstract: Systems and methods for container orchestration security employ one or more processors that separate a lifecycle of one or more containers into a plurality of predefined container image lifecycle phases; segregates control of the plurality of predefined container image lifecycle phases into a plurality of control environments separately controlled by different enterprise control components isolated from one another. In addition, one or more external processors may generate one or more certificates that are based on the platform, state attributes and meta data for interaction of the container with one or more external nodes. The one or more processors may also control the promotion, update and deletion of container images between the plurality of lifecycle phases and registries in different control environments as well as between the enterprise registries and the plurality of other registries that are part of multiple external clouds.

Abstract: Techniques for detecting instances of external fraud by monitoring digital activities that are performed with accounts associated with an enterprise are disclosed. In one example, a threat detection platform determines the likelihood that an incoming email is indicative of external fraud based on the context and content of the incoming email. To understand the risk posed by an incoming email, the threat detection platform may seek to determine not only whether the sender normally communicates with the recipient, but also whether the topic is one normally discussed by the sender and recipient. In this way, the threat detection platform can establish whether the incoming email deviates from past emails exchanged between the sender and recipient.

Abstract: Methods, systems, and apparatuses are provided for inferring security incidents from observational data. For example, alerts generated with respect to a set of entities by a first alert generator are received, association scores are calculated for pairs of alerts, the alerts are formed into clusters based on the association scores, and a security incident model is formed based on the clusters. The security incident model may define sequences of alerts corresponding to security incidents. Furthermore, the security incident model may be used to determine a match between additional alerts and a sequence of alerts in the security incident model and identify the additional alerts as a security incident corresponding to the sequence of alerts in the security incident model.

Abstract: A lifecycle management system for Controlled Objects is disclosed using a plurality of distinct databases in a plurality of domains. Methods for associating identifiable data records with identifiable Controlled Objects are disclosed. Methods and apparatus are disclosed for authorizing, recording and discontinuing use of a Controlled Object, including pairing of a plurality of Controlled Objects.

Abstract: Introduced here are computer programs and computer-implemented techniques for detecting instances of external fraud by monitoring digital activities that are performed with accounts associated with an enterprise. A threat detection platform may determine the likelihood that an incoming email is indicative of external fraud based on the context and content of the incoming email. For example, to understand the risk posed by an incoming email, the threat detection platform may seek to determine not only whether the sender normally communicates with the recipient, but also whether the topic is one normally discussed by the sender and recipient. In this way, the threat detection platform can establish whether the incoming email deviates from past emails exchanged between the sender and recipient.

Abstract: This numerical splitting device: acquires a numerical value w and a parameter p; generates a first random number r1 and a second random number r2; computes a third random number r3 based on the numerical value w, parameter p, first random number r1, and second random number r2 according to an expression, r3=w?r1-r2 mod p; computes first to third segments s1, s2, s3 based on the first to third random numbers r1, r2, r3 and the parameter p according to expressions, s1=r1+r2 mod p, s2=r2+r3 mod p, and s3=r3+r1 mod p; and transmits a pair of the first segment s1 and the second random number r2, a pair of the second segment s2 and the third random number r3, and a pair of the third segment s3 and the first random number r1 to first to third secure computation devices, respectively.

Abstract: An example operation may include one or more of receiving, by an orderer node, a merge channels transaction for a plurality of channels that includes a modification policy for the plurality of the channels, verifying, by the orderer node, the merge channels transaction based on the modification policy, executing, by the orderer node, the merge channels transaction to generate a merge block, and providing the merge block to participating nodes for a merger of the plurality of the channels into a new channel.