Abstract: Systems and methods for decryption of payloads are disclosed herein. In various embodiments, systems and methods herein are configured for decrypting thousands of transactions per second. Further, in particular embodiments, the systems and methods herein are scalable, such that many thousands of transactions can be processed per second upon replicating particular architectural components.

Abstract: A system for cyber-attack detection within cyber-physical systems (such as a vehicle). The system operates by obtaining a time-varying analog side-channel signal from components with the cyber-physical system and converting the time-varying analog side-channel signal to a digital side-channel signal. A time-series of system states are then identified based on the digital side-channel signal. The time-series of system states are compared with software states as generated by the cyber-physical system components, such that when the software states are unmatched with the time-series of system states, a side-channel is designated as having a security breach. In such an event, the cyber-physical system is then caused to implement an action based on the side-channel security breach.

Abstract: Security-enhancing devices, systems, methods, and non-transitory computer-readable media for performing non-interactive zero knowledge proof (NIZKP) authentication. In one embodiment, a computing device includes a memory and an electronic processor. The memory stores a NIZKP authentication program and a plurality of unique passwords. The electronic processor is configured to receive a first random value from an electronic source, generate a second random value by performing an exclusive disjunction operation on the first random value with a first password of the plurality of unique passwords, perform an extraction operation on the second random value, determine whether the extraction operation performed on the second random value extracted a non-random value from the second random value, and responsive to determining that the extraction operation performed on the second random value extracted the non-random value from the second random value, authenticate communications with the electronic source.

Abstract: Disclosed is an approach to implement a new layer of security within mobile devices using an encryption SDK, which implements a standalone component for applications to encrypt, decrypt, and view sensitive data on the device. A security layer is implemented on the device, wherein the security layer manages encryption for data retrieved onto the device from a cloud-based environment. Encrypted content is then generated at the security layer before storing the encrypted content by receiving the content object from the cloud-based environment and encrypting the content object with an encryption key that is password protected. The encrypted content is stored within an encrypted filesystem for presenting the content on the device.

Abstract: A system protects personally identifiable information (PII) by implementing an unconventional key management scheme. In this scheme, the system uses a set of keys rather than an individual key for encrypting PII. Different portions of the PII are encrypted using different keys from the set of keys. In this manner, even if a malicious user were to access a key, that key would not give the malicious user the ability to decrypt all of the PII. Additionally, the system generates a new set of keys periodically (e.g., once a month). The system also deletes sets of keys that are too old (e.g., six months old). As a result, even if a malicious user were to access a key, the usefulness of that key would be time limited.

Abstract: Techniques are described for enabling a Kerberos-based authentication system to provide a client with access to a plurality of unmodifiable components that require plain text passwords. Such an approach enables a user to sign into a distributed computer system using a single password, and access multiple components that require different passwords without the need to enter a second password. By using Kerberos based authentication, passwords are not unnecessarily sent throughout distributed computing system where they may be vulnerable. A proxy key distribution center can be used to manage passwords or other credentials on behalf of various clients, which can be used with various processes discussed herein.

Abstract: A physical card (in some cases without any on-board source of power or computing capabilities) is configured to maintain access information for digital bearer assets. The physical card may include disposed thereon a single address operable to receive digital bearer assets in one or more transactions on a decentralized computing platform, like a blockchain-based decentralized computing platform. Other decentralized computing platforms utilize different address generation protocols, thus preventing use of a single address on those other platforms. A set of addresses is generated, each address corresponding to a given decentralized computing platform. Each address is based on a same underlying key-pair, and a primary address is selected from the set for a given card. The remaining addresses in the set are stored, without storage of the public key or private key, and returned in a response to a request for additional addresses of the currency card.

Abstract: Method for generating cryptotokens including identifying an asset; using a secret sharing algorithm, creating a token that corresponds to the asset, wherein the token represents a private key and comprises a first half and a second half; on the client side, generating first half of public key and first half of private key; transmitting first half of public key to a server; on the server, using first half of public key to generate a second half of private key; generating second half of public key using second half of private key; associating the asset with the token; access to the asset requires the first second halves of the private key; performing a transaction with the asset by transferring first half of private key from first user to second user, and re-associating the asset from first to second user; first half of private key is never stored together with second half.

Abstract: Implementations of the subject technology provide for performing, by a device, a request for obtaining information related to a phone authentication certificate (PAC) that was generated for the device, the PAC authenticating that a particular phone number is associated with the device, the request including packets of data. The subject technology receives the information related to the PAC, the information including an indication that the PAC was generated for the device. The subject technology sends, from the device, a request for validating the PAC to a remote server based at least in part on the information related to the PAC. Further, the subject technology receives a confirmation of validating the PAC from the remote server based at least in part on the information related to the PAC.

Abstract: Security-enhancing devices, systems, methods, and non-transitory computer-readable media for performing non-interactive zero knowledge proof (NIZKP) authentication. In one embodiment, a computing device includes a memory and an electronic processor. The memory stores a NIZKP authentication program and a plurality of unique passwords. The electronic processor is configured to receive a first random value from an electronic source, generate a second random value by performing an exclusive disjunction operation on the first random value with a first password of the plurality of unique passwords, perform an extraction operation on the second random value, determine whether the extraction operation performed on the second random value extracted a non-random value from the second random value, and responsive to determining that the extraction operation performed on the second random value extracted the non-random value from the second random value, authenticate communications with the electronic source.

Abstract: Case management systems and techniques are disclosed. In various embodiments, a hierarchical document permission model is received, the model describing a document hierarchy comprising a plurality of hierarchically related document nodes and defining for each of at least a subset of said document nodes one or more document roles and for each such role one or more document permissions with respect to that document node. The hierarchical document permission model is used to determine and enforce permissions with respect to case management instances to which the hierarchical document permission model applies.

Abstract: Disclosed herein are systems and methods for enabling the automatic detection of executable code from a stream of bytes. In some embodiments, the stream of bytes can be sourced from the hidden areas of files that traditional malware detection solutions ignore. In some embodiments, a machine learning model is trained to detect whether a particular stream of bytes is executable code. Other embodiments described herein disclose systems and methods for automatic feature extraction using a neural network. Given a new file, the systems and methods may preprocess the code to be inputted into a trained neural network. The neural network may be used as a “feature generator” for a malware detection model. Other embodiments herein are directed to systems and methods for identifying, flagging, and/or detecting threat actors which attempt to obtain access to library functions independently.

Abstract: Techniques are disclosed for enhanced crawling of unexposed web applications for vulnerability scanning purposes. A response to a request to a web application is received and a web application framework detection routine is executed on the response. A determination is made that a web application framework is part of the response and the response is loaded in a web browser associated with the web application. A custom web application framework hook for the web application framework is injected into a web page of a web browser and a list of Document Object Model (DOM) elements and corresponding event handlers is received. A determination is made, based on the list, to execute DOM events to discover functionality of the web application. The DOM events are executed, and network activity of the web browser during execution of the DOM events is recorded.

Abstract: The present invention provides an electronic device, an external input device and a method for connecting the electronic device and the external input device. An electronic device according to various embodiments comprises: a camera module; a communication module, a display, a memory; and a processor electrically connected to the camera module, a communication module, a display and memory, wherein the processor displays, on the display, images comprising a left-eye image and a right-eye image, determines whether or not a connectable external input device is present if an event for the connection with the external input device occurs with respect to the images, displays, on at least one part of the display, external images, obtained by means of the camera module, if a connectable first external input device is present, and can perform connection with the first external input device. Moreover, other embodiments are possible.

Abstract: The disclosure extends to methods, systems, and devices for crowdsourcing an outcome to an issue through a platform. The method includes receiving voting data comprising a vote for an election from a user associated with an account facilitated by a voting server. The method includes generating a record for storing the voting data, wherein the record includes: a hashed identifier assigned to the user of the account, a public key assigned to the user of the account, and the voting data. The method includes broadcasting the record to a distributed network and storing the record on a blockchain database.

Abstract: An identity of an email-address utilized by a client device is verified. According to one example, a server receives a request for verifying the identity of the email-address and calculates a first verification token, which is transmitted to the email address to be verified. The first verification token is received by the client device, which in response calculates a second verification token. The second verification token is transmitted to the server. The server verifies the identity of the email-address by verifying that the first and second verification tokens are identical. Other examples are disclosed.

Abstract: Systems, devices, and techniques for service authorization are described. A described device includes a transceiver to communicate with an authorization server, and a processor. The processor can set an authorization timer for a first time period based on obtaining an authorization from the authorization server, and activate device features for a duration of the first time period. The processor can receive from the authorization server an authorization message that includes an authorization key hash based on a shared secret key and a server timestamp, determine a local key hash based on the shared secret key and a local timestamp, set the authorization timer for a second time period based on the authorization key hash matching the local key hash, and maintain an activation of the features for a duration of the second time period.

Abstract: A method includes receiving a data capture event affecting personal data of a user stored in at least one storage device of a computing system and mapped in a privacy graph database. Personal data of the user may be identified in the data capture event and classified into the data categories. In response to the data capture event, a mapping of user-centric nodes associated with the at least one user associated with other users in the privacy graph database is automatically updated using the classified personal data in the data capture event. A request by a requester for personal data of at least one specific user stored in the at least one storage device is received. The privacy graph database is queried to provide the requested personal data and locations of the requested personal data of the at least one specific user in the request stored in the computing system.

Abstract: A computer-implemented method comprising: accessing, at a client device, a first artifact and artifact metadata corresponding to the artifact; creating, at the client device, an artifact cryptographic digest corresponding to the artifact to certify existence of the artifact; transmitting, at the client device, the artifact cryptographic digest and artifact metadata to a server; adding, at the server device, the artifact cryptographic digest to a block chain; and adding, at the server device, the artifact cryptographic digest, the artifact metadata and the first artifact to a data storage device separate and distinct from the block chain to reference the artifact cryptographic digest on the block chain.

Abstract: Disclosed are systems and methods for personalized care management. The method includes collecting login credentials of a user. The login credentials are checked and the user is authenticated accordingly. Then, user profile of the user is accessed to determine a specific role of the user. Based on the specific role of the user, a user interface is presented on a user device of the user. The user interacts with the user interface by providing at least one voice input including a request. Further, a notification is generated based on the voice input of the user for at least one user. The at least one user provides at least one voice input including a response for the user via a user interface on at least one user device of the at least one user. The response is presented to the user through the user interface.