Abstract: Cooperative session orchestration includes devising a crypt for pre-distribution of tokens, distributing the tokens to member nodes of the network, based on a request from a delegate node of the network for brokerage of a session between the delegate node and a supplier node of the network, creating and sending, for each of a plurality of potential supplier nodes of the network, a respective individual puzzle, receiving, from each of one or more potential supplier nodes of the plurality of potential supplier nodes, a respective result obtained by the potential supplier node from solving the individual puzzle using the token distributed to the potential supplier, identifying, based on the receiving, candidate supplier node(s) of the one or more potential supplier nodes as a potential supplier for the session with the delegate node, and identifying to the delegate node the candidate supplier node(s) for the session with the delegate node.

Abstract: A system and method for improving network performance of DNS queries. The system includes a terminal which receives DNS queries from a customer premise equipment (CPE), and supplies matching DNS records in response to the queries. The terminal monitors all traffic from the CPE and generates a preload list containing domains and a time schedule at which name resolution should be requested for the domains. A DNS preload client in the CPE receives the preload list from the terminal, and submits preload DNS queries for name resolution of domains contained in the preload list at times specified in the time schedule. Preload records supplied in response to the preload DNS queries are stored by the CPE and used to resolve DNS queries from applications installed on the CPE.

Abstract: Techniques are provided for ad-hoc authenticated group discovery and data sharing in a mesh network. A group of devices is created without leaving a security gap due to the open communication needed to establish the discovery of the devices forming the group. The group can be authenticated autonomously following network discovery of the devices. Instead of requiring global pre-assigned keys for authentication, the devices in the group are authenticated with signatures and certificate passing thereby providing strong security. The efficiency of data sharing between the devices of the network, such as a mesh network, can also be increased. One or more devices may act as a bridge device between devices of a same group that are not in direct wireless communication with each other to reduce re-broadcasts within the mesh network.

Abstract: A multi-factor identification system is provided in which enrolled user authentication information is updated in the course of an authorization request based upon at least one of a confidence level of a match between a request first factor identifier, produced based upon first unique user identifying information received with the authentication request, and a respective matching enrolled first factor identifier and a confidence level of a match between a request second factor identifier, produced based upon second unique user identifying information received with the authentication request, and a respective matching enrolled second factor identifier.

Abstract: A method of securely processing data in a third party cloud environment is provided. Third party computer executable code is executed in a secure portion of the third party cloud environment. An external data request for external data to be received from an external data provider is then processed whereby the external data request comprises at least a portion of the secure data. The third party cloud environment determines whether to authorise the first external data request, and if the request is so authorised the request is sent to the external data provider and the external data is received from the external data provider.

Abstract: The technology discloses a method applied by a policy manager to a cloud-based security system that unifies functions of access control and traffic inspection, threat detection and activity contextualization on inspectable and non-inspectable traffic, with a data manager coupled to the policy manager storing a superset of fields used to specify security policies across the cloud-based unified functions, including common fields shared by two or more of the functions.

Abstract: Aspects of the disclosure relate to apparatuses, method steps, and systems for optimized Internet of Things (IoT) data processing for real-time decision support systems. The systems are used for real-time processing prioritization using a prioritization code and/or processing code. Edge devices may generate processing codes that are used in optimizing the data processing. For example, the system receives sensor data and preprocesses the sensor data with a simplified state estimation module to calculate a variance that is used to determine a processing code and/or a prioritization code.

Abstract: Systems and methods for archive scanning are provided herein. In some embodiments, a method includes: selecting an archive; reading a metadata representing a plurality of files within the archive; reading a plurality of hash strings from the archive; comparing the plurality of hash strings with a database of hash strings; and determining, based on the comparing, if the plurality of files within the archive represent a security threat based on the plurality of hash strings.

Abstract: Techniques and apparatus for managing remote attestation of infrastructure components based on a customer controlled dynamic attestation policy are described. One technique includes receiving a user-specified configuration for managing remote attestation of infrastructure component(s) hosted in a cloud computing environment. The user-specified configuration indicates information related to managing the life-cycle of the infrastructure component(s). For example, the user-specified configuration can indicate attributes associated with the infrastructure component(s), criteria for validating an attestation policy for the infrastructure component(s), criteria for rotating an attestation policy for the infrastructure component(s), etc. An attestation policy for each infrastructure component is generated, based on the user-specified configuration. The attestation policy for each infrastructure component indicates which of the attributes to use during remote attestation of the infrastructure component.

Abstract: Systems and methods for efficient and secure management of encrypted “snapshots” for a remote provider substrate extension (“PSE”) of a cloud provider network substrate are provided. The PSE may request and obtain a snapshot from the cloud provider network substrate, restore a volume from the snapshot, make changes to data in the restored volume, and/or initiate the creation and storage of a new snapshot that includes incremental updates to the original snapshot to reflect the changes made to data in the volume. An encrypted snapshot stored within the cloud provider network substrate may be decrypted using a cloud provider key designed for internal use only, and then re-encrypted using a PSE-specific key before providing the snapshot to the PSE, thereby avoiding the sharing of the cloud provider internal use only key outside the cloud provider network substrate.

Abstract: Systems and methods for ensuring data privacy in a data sharing system are provided. A computer implemented method carried out at a host computing system includes: accessing a set of data from a data source including a true element and at least one spurious element so that the host computing system cannot differentiate between the elements to obfuscate the true element from the host computing system. The method includes: accessing a code which is executable on the set of data so as to output multiple results for the elements of the set of data; processing the set of data, including for each element: executing the code on the element to generate a result; computing a hash value of the element; and outputting the result in association with the hash value to a third-party computing system. A third-party computing system has access to the true hash value of the true element for identification of the result generated by execution of the code on the true element.

Abstract: Described herein are techniques for managing replication in a data storage environment. The techniques including selectively compressing and selectively encrypting, by a production site, a set of files for replication from the production site to a remote site. Files can be selectively compressed based on a compression ratio satisfying a compression threshold, and files can be selectively encrypted based on a file content satisfying an encryption criteria. The techniques can further include updating, by the production site, metadata associated with selectively compressed files and updating metadata associated with selectively encrypted files. The techniques can further include replicating the set of files for replication from the production site to the remote site, the set of files for replication including the selectively compressed and the selectively encrypted files.

Abstract: Systems, computer program products, and methods are described herein for securely managing device communication. The present invention may be configured to provide, to another system, staging information including a digital certificate, a PIN, and a protocol for storing on a device, receive from the device a request to connect to an internal network after user input of the PIN, receive a digital certificate from the device, establish a wireless connection between the device and the internal network, and cause the device to delete the PIN. In some embodiments, the system is configured to permit communication from the device to the other system for a predetermined time window. In some embodiments, the system receives updates from the other system, via an external network, and the system sends the updates to the device, via the internal network.

Abstract: A method executing an instruction (300) to execute a query (q) for a data block (102) and determining whether the data block is stored in a block stash (370). When the data block is stored in the block stash during a download phase, the method includes removing the data block from the block stash, sending a fake query (304) to a distributed system (140) to retrieve a random data block stored in memory (114) of a distributed system (140), and discarding the random data block. When a current version of the data block is stored in the block stash during an overwrite phase, the method includes sending a fake query to the distributed system to retrieve another random data block stored in the memory of the distributed system, decrypting and re-encrypting the random data block with fresh randomness, and re-uploading the re-encrypted random data block onto the distributed system.

Abstract: A method includes receiving registration information regarding a telematics unit and a respective control system for a plurality of equipment pieces; receiving a seed from a control system of a first equipment piece via a telematics unit of the first equipment piece based on receiving a telematics session request by the control system of the first equipment piece; authenticating the telematics unit and the control system of the first equipment piece based on information included with the seed and the registration information; generating a first encrypted key and a second encrypted key based on the authentication; providing the first key to the telematics unit for the first equipment piece; and providing the second encrypted key to the control system of the first equipment piece via the telematics unit of the first equipment piece to establish a data communication channel.

Abstract: A subscriber identity module (eUICC), comprises profiles for the utilization of a mobile terminal that include at least a first profile and at least a second profile, of which the second profile (Pr1, Pr2) is devised as an active profile. The first profile is designed as a root profile (PrR) which in a normal state of the subscriber identity module is in an inactive state, and which is devised to be activated in response to an authentication command (AUTHENTICATE) received at the subscriber identity module. The authentication command is specially parameterized for the root profile (PrR) with a specific root value of the network parameter (P2) to be activated during a change-over period. The initially active second profile (Pr1, Pr2) is deactivated during the change-over period. After the end of the change-over period, the first profile (PrR) is again deactivated and the second profile (Pr1, Pr2) is again activated.

Abstract: A device includes a power button and a fingerprint sensor, where the power button is integrated with the fingerprint sensor. A method is applied to a process in which a user presses the power button to start up the device. The method includes obtaining fingerprint information acquired by the fingerprint sensor, and saving the fingerprint information. The method further includes obtaining a fingerprint authentication request. The method further includes providing the fingerprint information to perform fingerprint authentication to log in to an operating system of the device.

Abstract: According to certain embodiments, an authentication method of an electronic device, comprises responsive to detecting an external electronic device using a first communication circuit, transmitting first data to the external electronic device using a second communication circuit; determining whether a response to the first data is received; and when the response to the first data is received from the external electronic device, performing communication connection and authentication procedures with the external electronic device.

Abstract: A defense suite for an industrial control system (ICS) network is disclosed. The defense suite is installed and executed on a network server hosting the human-machine interface (HMI) function of the network, thereby gaining communication privileges of the HMI server to query and perform other operations with programmable logic controllers (PLCs) and other assets of the network. The defense suite further comprises a network protection engine (NWPE) that alerts a defense suite user of suspicious activity in the network. Normal behavior of the network is obtained by a learning engine, during a learning period. The learning engine can be reactivated after a configuration change in the network. The data suite also comprises an operating system protection engine (OSPE), for preventing removable devices from accessing the HMI server and a preventing execution of unauthorized executables. The OSPE is also trained for which programs are authorized through its own program discovery module.

Abstract: A communication device stores a first secret key and a first public key, and the on-vehicle authentication device stores a second secret key, a second public key and a signature verification key. The on-vehicle authentication device acquires the first public key, verifies the authenticity of the electronic signature using a signature verification key, encrypts the second public key using the authentic first public key and transmits the encrypted second public key. The communication device receives the encrypted second public key, decrypts the encrypted second public key using the first secret key, encrypts the first public key using the decrypted second public key. The on-vehicle authentication device receives the encrypted first public key, decrypts the encrypted first public key using the second secret key, and authenticates that the communication device is an authentic device when the decrypted first public key has been determined to be authentic.