Abstract: Techniques and mechanisms are disclosed for a data intake and query system to generate “meta-notable” events by applying a meta-notable event rule to a collection of notable event data. A meta-notable event rule specifies one or more patterns of notable event instances defined by a set of notable event states and a set of transition rules (also referred to as association rules) indicating conditions for transitioning from one notable event state to another. The set of notable event states includes at least one start state and at least one end state. A meta-notable event is generated when a set of analyzed notable events satisfies a set of transition rules linking a start state to an end state (including transitions through any intermediary states between the start state and the end state).

Abstract: A memory system component comprises transaction handling circuitry to receive memory access transactions. Each memory access transaction specifies at least: an issuing domain identifier which indicates an issuing security domain specified by an issuing master device for the memory access transaction, where the issuing security domain is one of a plurality of security domains; a target address; and a security check indication which indicates whether it is already known that the memory access transaction would pass a security checking procedure. The security checking procedure determines whether the memory access transaction indicating said issuing security domain is authorised to access the target address, based on control data indicative of which of the plurality of security domains are allowed to access the target address. The memory system component comprises control circuitry to determine, on the basis of the security check indication, whether the security checking procedure still needs to be performed.

Abstract: A method includes retrieving, by a workspace client on a computing device, a first set of resource associations from a workspace server. The first set of resource associations identify one or more data file-types executable by each application on a virtualization server. The method also includes generating, by the workspace client, from the first set of resource associations, a second set of resource associations. The second set of resource associations identify a subset of applications on the virtualization server operable to perform operations on each of the one or more data file-types. The method further includes obtaining, by a storage provider client on the computing device, the second set of resource associations. The storage provider client is configured to enable one or more applications on the virtualization server to execute at least one data file accessible from a storage provider.

Abstract: An encryption mechanism used on cooperative multi-band wireless STA architecture that enables full duplex operations. In encrypting a frame, an AAD can be constructed by using a selected MAC address, which may not be associated with a band to be used for transmitting the frame in an upcoming TXOP. An STA that supports simultaneous transmission in a multi-band operation uses the same MAC address to encrypt the frames to be transmitted on different bands. An AAD is constructed by using a same MAC address corresponding to one of the transceivers. A transmit STA may specify band information used for encryption in the MAC header, which serves to signal the receive STA to decrypt the frame by using the proper information.

Abstract: Methods, systems, storage media for authentication are described. On the methods includes receiving, at a smart contract on a distributed ledger, a signed authentication challenge. The method includes verifying the identity of the user who signed authentication challenge. The method includes raising an event that indicates that the user has been authenticated; wherein a server listens for events from the smart contract, and associates a session between the browser and the server with the user based on the event.

Abstract: The present disclosure relates to centralized volume encryption key management for edge devices with trusted platform modules (TPM)s. In some aspects a volume encryption key is generated for a gateway device. A sealing authorization policy is also generated for the gateway device. The sealing authorization policy is generated based on a predetermined platform configuration register (PCR) mask and expected PCR values. The volume encryption key and the sealing authorization policy are transmitted from the management service to the gateway device to provision the gateway device with the volume encryption key.

Abstract: A technique to cache content securely within edge network environments, even within portions of that network that might be considered less secure than what a customer desires, while still providing the acceleration and off-loading benefits of the edge network. The approach ensures that customer confidential data (whether content, keys, etc.) are not exposed either in transit or at rest. In this approach, only encrypted copies of the customer's content objects are maintained within the portion of the edge network, but without any need to manage the encryption keys. To take full advantage of the secure content caching technique, preferably the encrypted content (or portions thereof) are pre-positioned within the edge network portion to improve performance of secure content delivery from the environment.

Abstract: A technique to cache content securely within edge network environments, even within portions of that network that might be considered less secure than what a customer desires, while still providing the acceleration and off-loading benefits of the edge network. The approach ensures that customer confidential data (whether content, keys, etc.) are not exposed either in transit or at rest. In this approach, only encrypted copies of the customer's content objects are maintained within the portion of the edge network, but without any need to manage the encryption keys. To take full advantage of the secure content caching technique, preferably the encrypted content (or portions thereof) are pre-positioned within the edge network portion to improve performance of secure content delivery from the environment.

Abstract: A method including determining, by a device, an assigned key pair including an assigned public key and an assigned private key; determining, by the device for a folder including encrypted content, a folder access key pair including a folder access public key and a folder access private key; encrypting, by the device, the folder access private key by utilizing the assigned public key; and accessing, by the device, the encrypted content based at least in part on decrypting the folder access private key. Various other aspects are contemplated.

Abstract: Security policies may be utilized to grant or deny permissions related to the access of computing resources. Two or more security policies may be compared to determine whether the policies are equivalent, whether one security is more permissive than another, and more. In some cases, it may be possible to identify whether there exists a security permission that is sufficient to determine two security policies lack equivalency. Propositional logics may be utilized in the evaluation of security policies.

Abstract: Methods and integrated circuit architectures for assuring the protection of intellectual property between third party IP providers, system designers (e.g., SoC designers), fabrication entities, and assembly entities are provided. Novel design flows for the prevention of IP overuse, IP piracy, and IC overproduction are also provided. A comprehensive framework for forward trust between 3PIP vendors, SoC design houses, fabrication entities, and assembly entities can be achieved, and the unwanted modification of IP can be prevented.

Abstract: A document management system manages documents of an entity. The document management system monitors for entries in a document that are suspicious. Entries in the document are classified by the document management system as a “suspicious entry” or a “non-suspicious entry.” In one embodiment, a suspicious entry is indicative of potentially suspicious activity at the entity.

Abstract: A boot read only memory (ROM) chip unit can perform a secure boot routine based on various operations. A processor device comprises a boot ROM chip with processing circuitry on a system board configured to perform a system board power up according to a read operation in a one-time-programmable OTP memory/non-volatile memory (NVM). The OTP memory/NVM includes a spare area in a portion of the OTP/NVM that can receive a first sequence pattern. The processor determines whether a secure boot indication indicates a secure boot routine, and differentiates one or more read return content of the OTP memory/NVM between a wrongly read return content and a trusted read return content, in response to, or concurrent with, the secure boot indication indicating the secure boot routine.

Abstract: A computer implemented method for access control for a restricted resource in a computer system, the method including receiving a first set of records for the computer system, each record detailing an occurrence in the computer system during a training time period when the resource is accessed in an approved manner; generating a sparse distributed representation of the set of records to form a training set for a hierarchical temporal memory (HTM); training the HTM based on the training set in order that the trained HTM provides a model of the operation of the computer system during the training time period; receiving a second set of records for the computer system, each record detailing an occurrence in the computer system during an operating time period for the computer system in use by a consumer of the resource; generating a sparse distributed representation of the second set of records to form an input set for the trained HTM; executing the trained HTM based on the input set to determine a degree of recog

Abstract: A method for recovering a network key of an access point to a network, implemented by a terminal. The network key allows the terminal to be associated with the access point upon a first connection of the terminal to the access point. The network key recovery method includes: receiving, by the terminal, a network key provided by the access point on a server following a request, by the terminal to the server, for the network key of the access point, the request including an identifier of the access point and having been relayed by the server to the access point associated with the identifier of the access point in the request. Thus, as the access point does not transmit the network key directly to the terminal, but to a server on which the terminal will recover it, this limits intrusions into the network linked to the vulnerability of the Wi-Fi network.

Abstract: A method for managing memory within a computing system. The method includes one or more computer processors identifying a range of physical memory addresses that store a first data. The method further includes determining whether a second data is stored within the range of physical memory addresses that stores the first data. The method further includes responding to determining that the second data is stored within the range of physical memory addresses that store the first data, by determining whether a process accessing the second data is identified as associated with a side-channel attack. The method further includes responding to determining that the process accessing the second data is associated with the side-channel attack, by initiating a response associated with the process accessing the second data.

Abstract: Features are described for efficiently and accurately identifying a user of an electronic device with limited user interaction. The features include receiving a mobile device identifier from the mobile device. The features include transmitting the mobile device identifier to a service provider associated with the mobile device. The features include receiving information identifying the user from the service provider. The features include identifying a set of candidates associated with at least a portion of the information. The features include generating a metric for the candidates included in the set of candidates. An individual metric indicates a degree of relatedness between a value for the user for the at least one data field and a value for a candidate for the at least one data field. The features include identifying the user as a specific candidate included in the set of candidates based on the metric corresponding to a threshold.

Abstract: A method including determining, by a first user device, a sharing encryption key based at least in part on a folder access private key associated with a folder and an assigned public key associated with a second user device; encrypting the folder access private key associated with the folder utilizing the sharing encryption key; and transmitting the encrypted folder access private key to enable the second user device to access the folder. Various other aspects are contemplated.

Abstract: Methods, systems, computer-readable media, and apparatuses may provide creation and management of composite tokens for use with services in a virtual environment without the user having to re-authenticate each time the user accesses a different service. A composite identity server may receive a request to upgrade a first authentication token for a user. The composite identity server may redirect a user agent to an identity provider for authentication and, in response, may receive a second authentication token for the user. The composite identity server may send the second authentication token to a federated microservice and, in response, may receive one or more claims of the second authentication token designated for inclusion in a composite token. The composite identity server may generate a composite token including the one or more claims of the first authentication token and one or more claims of the second authentication token.

Abstract: A host Virtual Machine Monitor (VMM) operates “blindly,” without the host VMM having the ability to access data within a guest virtual machine (VM) or the ability to access directly control structures that control execution flow of the guest VM. Guest VMs execute within a protected region of memory (called a key domain) that even the host VMM cannot access. Virtualization data structures that pertain to the execution state (e.g., a Virtual Machine Control Structure (VMCS)) and memory mappings (e.g., Extended Page Tables (EPTs)) of the guest VM are also located in the protected memory region and are also encrypted with the key domain key. The host VMM and other guest VMs, which do not possess the key domain key for other key domains, cannot directly modify these control structures nor access the protected memory region. The host VMM, however, using VMPageIn and VMPageOut instructions, can build virtual machines in key domains and page VM pages in and out of key domains.