Abstract: Various embodiments described herein disclose an endpoint modeling and grouping management system that can collect data from endpoint computer devices in a network. In some embodiments, agents installed on the endpoints can collect real-time information at the kernel level providing the system with deep visibility. In some embodiments, the endpoint modeling and grouping management system can identify similarities in behavior in response to assessing the data collected by the agents. In some embodiments, the endpoint modeling and grouping management system can dynamically model groups such as logical groups, and cluster endpoints based on the similarities and/or differences in behavior of the endpoints. In some embodiments, the endpoint modeling and grouping management system transmits the behavioral models to the agents to allow the agents to identify anomalies and/or security threats autonomously.

Abstract: The subject matter of this specification generally relates to cloud-hosted certificate lifecycle management (CLM) to on-premises certificate authority (CA) communication. In some implementations, a method includes receiving a task request specifying a requested task and an identifier specifying a location for task execution, determining the requested task and that the location for task execution for the requested task is at an on-premises CA device, in response to determining the requested task and that the location of the task is at the on-premises CA device, storing a request task data entry that links the task request to the location for task execution, providing a notification to an on-premises CA gateway, and in response to the notification, providing the requested task for task execution. In some implementations, the remote CA gateway plug-in module maintains a constant communication connection with the on-premises CA gateway via a persistent client-initiated communication protocol.

Abstract: A computer-implemented method can be used for restoring a computer system following an infection event. The computer system can have a plurality of machines, in which a plurality of back-up copies are associated with each one of the plurality of machines, and in which each of the plurality of back-up copies associated with a particular machine is a different version back-up. The method can include searching the plurality of back-up copies to identify one or more clean-back-up copies that do not comprise a signature of the infection event and restoring one or more of the plurality of machines using a respective clean-back-up copy.

Abstract: Techniques for maintaining geographic-based data privacy rules in networked environments. An example method includes receiving a request from a user device; generating, based on the request, a query for data associated with fulfilling the request; transmitting, to a data controller, the query; transmitting, to the data controller, an indication of a geographic region in which at least one device implementing the entity is located; and receiving, from the data controller, a portion of the data associated with fulfilling the request.

Abstract: Disclosed herein are an apparatus and method for processing vehicle data security based on a cloud.

Abstract: Facilitating the generation of ephemeral credentials and verification thereof within a distributed storage system is provided herein. Based on a request for ephemeral credentials from a first account client to a first node of a first storage instance of a distributed system, generating the ephemeral credential comprising a session token and a secret session key for the first account client by a method that derives the secret session key using a first account private key and a first storage instance public key. This session token along with a signature generated using the secret session key of the ephemeral credential is subsequently used to make further requests to a second node of a second storage instance of the distributed system where the secret session key is independently derived using information in the request and the previously shared first account private key to verify the signature in the request.

Abstract: A multi-factor authentication scheme uses an MFA authentication service and a browser extensionless phish-proof method to facilitate an MFA workflow. Phish-proof MFA verifies that the browser the user is in front of is actually visiting the authentic (real) site and not a phished site. This achieved by only allowing MFA to be initiated from a user trusted browser by verifying its authenticity through a signing operation using a key only it possesses, and then also verifying that the verified browser is visiting the authentic site. In a preferred embodiment, this latter check is carried out using an iframe postMessage owning domain check. In a variant embodiment, the browser is verified to be visiting the authentic site through an origin header check. By using the iframe-based or ORIGIN header-based check, the solution does not require a physical security key (such as a USB authenticator) or any browser extension or plug-in.

Abstract: Techniques for securing data are disclosed. A security device includes: one or more processors; one or more authentication components including one or more of a biometric reader, a positioning system, and a wireless receiver; and one or more non-transitory computer-readable media storing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations including securing data on a storage device that is external to the security device, using multiple authentication factors obtained using the one or more authentication components.

Abstract: Disclosed are various embodiments for searching encrypted data. A search query containing a plaintext key can be received from a client device or other application. A request can then be sent to a storage engine for a ciphertext key of a node of a binary tree, the node representing an encrypted key-value pair that includes the ciphertext key. The ciphertext key can be decrypted using a cryptographic key to generate a decrypted ciphertext key. Then, the decrypted ciphertext key can be compared to the plaintext key. A determination can then be made as to whether the encrypted key-value pair represented by the node of the binary tree satisfies the search query based at least in part on a comparison of the decrypted ciphertext key to the plaintext key.

Abstract: Methods and systems are provided for improving user authentication and access control by a network file system service in a multi-tenant public cloud environment by receiving a request for a connection to a file system from a file system client (client), sending an identification request for identification authentication of the client to a control system, receiving a response from the control system, establishing the connection to the file system upon determining that the connection to the file system is allowed based on cloud tenant information associated with the client, receiving an attempt to access the file system from the client by a sub-user, authenticating the sub-user based on the cloud tenant information, issuing a security token including a globally unique sub-user identifier of the sub-user, and using the security token to determine access rights of the sub-user to the file system for a subsequent request.

Abstract: A method to determine a jitter attack on authorization system granting permission using a resource comprising: receiving at least three subcarrier signals from an authentication device, determining a relative phase deviation from an expected relative phase behavior for the at least three subcarrier signals, and concluding on a jitter attack if the relative phase deviation fulfills a predetermined criterion.

Abstract: A server can receive a device public key and forward the device public key to a key server. The key server can perform a first elliptic curve Diffie-Hellman (ECDH) key exchange using the device public key and a network private key to derive a secret X1. The key server can send the secret X1 to the server. The server can derive an ECC PKI key pair and send to the device the server public key. The server can conduct a second ECDH key exchange using the derived server secret key and the device public key to derive a secret X2. The server can perform an ECC point addition using the secret X1 and secret X2 to derive a secret X3. The device can derive the secret X3 using (i) the server public key, a network public key, and the device private key and (ii) a third ECDH key exchange.

Abstract: A secure cloud-based node-locking service with built-in attack detection to eliminate fuzzing, cloning and other attacks is disclosed. White-box base files are securely stored on the cloud service and are not vulnerable to accidental leakage. A secure cloud-based dynamic secret encoding service reduces the risk of exposure of unprotected secrets and other sensitive data.

Abstract: Method, apparatus and computer program product for multi-device user authentication are described herein. For example, the apparatus includes at least one processor and at least one non-transitory memory including program code.

Abstract: One or more computer processors detect a computing device within a proximity to a rollable device. The one or more computer processors determine a location and an orientation of the rollable device relative to the computing device. The one or more computer processors attach the rollable device to the computing device utilizing the set of biometric locks engaged programmatically such that at least one side of the rollable device is locked and hinged to the computing device. The one or more computer processors responsive to the rollable device attached to a side of the computing device, extend a display area of the computing device to the rollable device.

Abstract: The subject matter of this specification generally relates to cloud-hosted certificate lifecycle management (CLM) to on-premises certificate authority (CA) communication. In some implementations, a method includes receiving a task request specifying a requested task and an identifier specifying a location for task execution, determining the requested task and that the location for task execution for the requested task is at an on-premises CA device, in response to determining the requested task and that the location of the task is at the on-premises CA device, storing a request task data entry that links the task request to the location for task execution, providing a notification to an on-premises CA gateway, and in response to the notification, providing the requested task for task execution. In some implementations, the remote CA gateway plug-in module maintains a constant communication connection with the on-premises CA gateway via a persistent client-initiated communication protocol.

Abstract: Disclosed are various approaches for polling federated services for notifications. A request for an access token for a federated service is sent to an authentication service. The access token for the federated service is received from the authentication service. A query is sent to the federated service for a notification, the query comprising the access token. The notification is received from the federated service.

Abstract: An encryption and signature device for AI model protection is provided. The encryption and signature device for AI model protection includes a key derivation unit, a model encryption unit, a model password encryption unit, an image generation unit and a signature unit. The key derivation unit is configured to derive a model key according to a model password and a derivation function. The model encryption unit is configured to encrypt an AI model according to the model key to generate an encrypted AI model. The model password encryption unit is configured to encrypt the model password to generate an encrypted model password. The image generation unit is configured to generate an image file according to the encrypted model password and the encrypted AI model. The signature unit is configured to sign the image file according to a private key to obtain a signed image file.

Abstract: Devices and techniques are generally described for detection of network anomalies. In various examples, first data describing network communication between a plurality of source entities and a plurality of destination entities may be received. In some examples, respective feature data representing network communication between a respective source entity and one or more of the plurality of destination entities may be generated. In some examples, an unsupervised machine learning model may be used to determine a first number of clusters of the feature data. In various cases, a first source entity that is an outlier with respect to the first number of clusters may be determined based at least in part on the first number of clusters. The first source entity may be classified as an anomalous entity.

Abstract: Selectively presenting information by generating a dictionary including information categorized as sensitive according to a participant's characteristic, generating a display matrix including display rules according to the participant's characteristics, detecting sensitive data in a presentation stream, determining display coordinates for the sensitive data, determining a presentation status for the sensitive data according to the participant's characteristics, the dictionary, the decision tree and the display matrix, and masking the presentation of the sensitive information according to the presentation status and the display coordinates.