Abstract: Replicating data using inferred trust, including: receiving, by a first storage system from a computing device, data encrypted using a first encryption key; decrypting, by the first storage system, the encrypted data using the first encryption key; encrypting, by the first storage system, the decrypted data using a second encryption key; storing, on the first storage system, the data encrypted using the second encryption key; sending, from the first storage system to the second storage system, the data; and servicing, by the second storage system, an input/output (‘I/O’) operation directed to the data.

Abstract: A method of providing information for display, from a portable electronic device, includes displaying information on a display of the portable electronic device, identifying a portion for redacting from the information displayed on the display of the portable electronic device, extracting the portion from the information to provide redacted information and an extracted portion, storing the redacted information, protecting and storing the extracted portion in association with a location identification in a file, and sending the redacted information and sending the file including extracted portions associated with the location identifiers.

Abstract: A method for executing a computer program includes incorporating, into metadata of a block containing a line of code to be accessed using a pointer, a first pointer identifier associated with the line of code to be accessed, then obtaining a pointer including a first range of bits containing the address of the line of code to be accessed, and a different second range of bits containing a second pointer identifier, then verifying that the second pointer identifier contained in the obtained pointer corresponds to the first pointer identifier associated with the line of code to be accessed and contained in the metadata of the loaded block, and when the first and second pointer identifiers do not correspond, then the security module triggers signaling of an execution fault.

Abstract: A computer-implemented method is disclosed. The method includes: receiving, via a computing device in a locked state, input of a first PIN; determining that the first PIN is associated with a first cryptographic key that is stored in a memory; responsive to determining that the first PIN is associated with the first cryptographic key, retrieving, from the memory, an encrypted form of a first credential that is associated with the first cryptographic key; recovering the first credential from the encrypted form using the first cryptographic key; and causing the computing device to be unlocked using the recovered first credential.

Abstract: Non-transitory computer readable storage mediums have instructions executed by processors to access a first random data element at a first computing device. A first vector and a second vector are generated at a second computing device. A communication channel is utilized to execute a secure multiparty computation protocol between the first computing device and the second computing device. The first computing device alternately identifies a polynomial relations satisfied state and a polynomial relations unsatisfied state. A first selected instruction set is executed at the first computing device in response to the polynomial relations satisfied state. A second selected instruction set is executed at the first computing device in response to the polynomial relations unsatisfied state.

Abstract: A device includes a bottom housing that includes a printed circuit board, a processor formed on the printed circuit board, a probe tip coupled to the processor, and a first wall. The first wall includes a front side surface, a backside surface, and an opening extending from the front side surface to the backside surface. The printed circuit board is coupled to the front side surface of the first wall. The printed circuit board includes a plurality of electrical contacts located on the back surface and coupled to the processor. The electrical contacts on the backside surface of the printed circuit board are visible through the opening formed in the first wall of the bottom housing. The electrical contacts are sealed from fluid penetration and can connect to the electrical contacts of a battery connected to the device.

Abstract: A method, system, and program product for controlling power associated with connectivity between devices is provided. The method includes scheduling a copy function associated with copying data from a production hardware device to a secure hardware device at a specified time period. A first hardware connection between the production hardware device and a production network associated with the production hardware device is disabled during the specified time period and a second hardware connection between the production hardware device and the secure hardware device is enabled. A subsequent copy function is enabled for copying the data from the production hardware device to the secure hardware device. The second hardware connection between the production hardware device and the secure hardware device is disabled after the copy function has completed. In response, the first hardware connection between the production hardware device and the production network is enabled.

Abstract: An encryption device includes one or more hardware processors functioning as the following units. A unit acquires, as a public key, n-variable indeterminate equations X having coefficients with a predetermined degree of a univariate polynomial ring Fp[t] on a finite field Fp. A unit embeds a plaintext m into coefficients of n-variable plaintext polynomial factors m having coefficients with a predetermined degree of the Fp[t]. A unit generates an n-variable plaintext polynomial M by multiplying the n-variable plaintext polynomial factors mi whose number is one or more. A unit randomly generates n-variable polynomials sk (k=1, 2), n-variable polynomials rk, and noise polynomial ek, each having coefficients with a predetermined degree of the Fp[t]. A unit generates a ciphertext ck by executing an operation including at least one of adding, subtracting, and multiplying the sk, the rk, the ek, and the X to, from, or by the M.

Abstract: Security can be improved in a business application, such as an enterprise resource planning (“ERP”) system, by verifying and testing transports within the system or between systems. In one embodiment, a transport is verified by a transport profiler to ensure proper functioning and compliance. In one embodiment, the transport profiler may include visualization functionality for visualizing the transport between systems.

Abstract: An information handling system may include a processor, a memory coupled to the processor, a storage resource, and a basic input/output system (BIOS). The BIOS may be configured to, while the information handling system is in a pre-boot environment and prior to initialization of an operating system of the information handling system: establish a communication session with a remote information handling system; and in response to authentication of the communication session, transmit data to the remote information handling system that is operable to expose a partition of the storage resource to the remote information handling system.

Abstract: A solution is proposed for controlling access to computing resources. A corresponding method comprises receiving and verifying an access request for accessing the computing resources by a secondary computing environment (isolated from the computing resources). A main computing environment (isolated from the secondary computing environment) detects an indication of a positive result of the verification of the access request; in response thereto, the main computing environment verifies an integrity condition of the secondary computing environment and then authorizes the secondary computing environment to access the computing resources accordingly. A computer program and a computer program product for performing the method are also proposed. Moreover, a system for implementing the method is proposed.

Abstract: Cooperative session orchestration includes devising a crypt for pre-distribution of tokens, distributing the tokens to member nodes of the network, based on a request from a delegate node of the network for brokerage of a session between the delegate node and a supplier node of the network, creating and sending, for each of a plurality of potential supplier nodes of the network, a respective individual puzzle, receiving, from each of one or more potential supplier nodes of the plurality of potential supplier nodes, a respective result obtained by the potential supplier node from solving the individual puzzle using the token distributed to the potential supplier, identifying, based on the receiving, candidate supplier node(s) of the one or more potential supplier nodes as a potential supplier for the session with the delegate node, and identifying to the delegate node the candidate supplier node(s) for the session with the delegate node.

Abstract: A system and method for improving network performance of DNS queries. The system includes a terminal which receives DNS queries from a customer premise equipment (CPE), and supplies matching DNS records in response to the queries. The terminal monitors all traffic from the CPE and generates a preload list containing domains and a time schedule at which name resolution should be requested for the domains. A DNS preload client in the CPE receives the preload list from the terminal, and submits preload DNS queries for name resolution of domains contained in the preload list at times specified in the time schedule. Preload records supplied in response to the preload DNS queries are stored by the CPE and used to resolve DNS queries from applications installed on the CPE.

Abstract: A multi-factor identification system is provided in which enrolled user authentication information is updated in the course of an authorization request based upon at least one of a confidence level of a match between a request first factor identifier, produced based upon first unique user identifying information received with the authentication request, and a respective matching enrolled first factor identifier and a confidence level of a match between a request second factor identifier, produced based upon second unique user identifying information received with the authentication request, and a respective matching enrolled second factor identifier.

Abstract: Techniques are provided for ad-hoc authenticated group discovery and data sharing in a mesh network. A group of devices is created without leaving a security gap due to the open communication needed to establish the discovery of the devices forming the group. The group can be authenticated autonomously following network discovery of the devices. Instead of requiring global pre-assigned keys for authentication, the devices in the group are authenticated with signatures and certificate passing thereby providing strong security. The efficiency of data sharing between the devices of the network, such as a mesh network, can also be increased. One or more devices may act as a bridge device between devices of a same group that are not in direct wireless communication with each other to reduce re-broadcasts within the mesh network.

Abstract: A method of securely processing data in a third party cloud environment is provided. Third party computer executable code is executed in a secure portion of the third party cloud environment. An external data request for external data to be received from an external data provider is then processed whereby the external data request comprises at least a portion of the secure data. The third party cloud environment determines whether to authorise the first external data request, and if the request is so authorised the request is sent to the external data provider and the external data is received from the external data provider.

Abstract: The technology discloses a method applied by a policy manager to a cloud-based security system that unifies functions of access control and traffic inspection, threat detection and activity contextualization on inspectable and non-inspectable traffic, with a data manager coupled to the policy manager storing a superset of fields used to specify security policies across the cloud-based unified functions, including common fields shared by two or more of the functions.

Abstract: Aspects of the disclosure relate to apparatuses, method steps, and systems for optimized Internet of Things (IoT) data processing for real-time decision support systems. The systems are used for real-time processing prioritization using a prioritization code and/or processing code. Edge devices may generate processing codes that are used in optimizing the data processing. For example, the system receives sensor data and preprocesses the sensor data with a simplified state estimation module to calculate a variance that is used to determine a processing code and/or a prioritization code.

Abstract: Systems and methods for archive scanning are provided herein. In some embodiments, a method includes: selecting an archive; reading a metadata representing a plurality of files within the archive; reading a plurality of hash strings from the archive; comparing the plurality of hash strings with a database of hash strings; and determining, based on the comparing, if the plurality of files within the archive represent a security threat based on the plurality of hash strings.

Abstract: Techniques and apparatus for managing remote attestation of infrastructure components based on a customer controlled dynamic attestation policy are described. One technique includes receiving a user-specified configuration for managing remote attestation of infrastructure component(s) hosted in a cloud computing environment. The user-specified configuration indicates information related to managing the life-cycle of the infrastructure component(s). For example, the user-specified configuration can indicate attributes associated with the infrastructure component(s), criteria for validating an attestation policy for the infrastructure component(s), criteria for rotating an attestation policy for the infrastructure component(s), etc. An attestation policy for each infrastructure component is generated, based on the user-specified configuration. The attestation policy for each infrastructure component indicates which of the attributes to use during remote attestation of the infrastructure component.