Abstract: This disclosure is directed to a computing system that performs techniques relating to the secure storage, maintenance, and retrieval of data. Techniques described in this disclosure may prevent, limit, or otherwise insulate the data from unauthorized access by hackers, rogue devices, and unauthorized users. In some examples, a computing system may store a file by fracturing the file into multiple data blocks, encrypting the data blocks or the data stored within the data blocks, and storing the data blocks in scattered locations on a network. Further, the computing system may occasionally move at least some of the stored data blocks, and may, upon moving such data blocks, reencrypt the moved data blocks with a different encryption key. Still further, the computing system may inject fake data and/or fake data blocks into the system.

Abstract: A computer-based system and method for securing passwords, including: obtaining, by an authentication service, a plurality of public keys, each associated with one of a plurality of devices associated with a user; generating, by the authentication service, a password for the user; sending, by the authentication service, the password to a password management entity; encrypting, by the authentication service, the password with each of the public keys, thus generating a plurality of encrypted passwords, each encrypted with one of the public keys and associated with a device of the plurality of devices; and deleting the password by the authentication service.

Abstract: Methods, apparatuses, systems, and computer-readable mediums for sharing user credentials in federated authentication are described herein. An identity provider may receive a user credential from a user device. The identity provider may receive, from a relying party, a request for an access token. The identity provider may encrypt the user credential based on a nonce that is uniquely generated for the relying party. The identity provider may send a response to the relying party. The response may include the access token, the encrypted user credential, and the nonce.

Abstract: A system and method for detecting cyber-attacks using quantile regression analysis are disclosed. The method includes identifying at least one hit quantile out of a plurality of quantiles, wherein at least one sample of traffic directed at a protected entity falls within quantile edges of the at least one identified hit quantile, wherein each of the plurality of quantiles is characterized by a probability distribution of at least one feature of a data stream, each of the plurality of quantiles having a respective probability estimate of bytes to fall into it; updating the probability estimates of the plurality of quantiles when the hit quantile has been identified; determining if the probability estimate of the at least one hit quantile is above a threshold; and detecting a cyber-attack when the probability estimate of the at least one hit quantile is above the threshold.

Abstract: Various embodiments are generally directed to an apparatus, method and other techniques to determine a secure memory region for a transaction, the secure memory region associated with a security association context to perform one or more of an encryption/decryption operation and an authentication operation for the transaction, perform one or more of the encryption/decryption operation and the authentication operation for the transaction based on the security association context, and cause communication of the transaction.

Abstract: Methods are provided for minting and distributing quantities of cryptographically generated data based on the quality of received biological datasets. Computer readable media, computing apparatuses, and systems are also provided.

Abstract: A computer-implemented method can comprise determining, by a device comprising a processor, personally identifying data elements of data, representative of a group of transactions, that comprise personally identifying information according to an anonymization criterion associated with personally identifying information being determined not to be satisfied by the data elements, and storing, by the device, non-identifying data elements of the data to a non-identifying data store.

Abstract: A method for distributed and private symmetric searchable encryption includes receiving encrypted data, creating a search index for one or more servers based on the encrypted data using a distributed point function (DPF), splitting the encrypted data into a number of portions based on the number of servers, and partitioning the servers into two or more groups. The method also includes updating the search index based on the splitting and the partitioning, transmitting the split encrypted data to the servers based on the updated search index, verifying the transmitted data using data not transmitted to the server, and determining, based on the verifying, whether any server deviated from an assigned protocol.

Abstract: Methods and systems for management of subscriber identities associated with user devices are described herein. The user device may enroll the user device to a server and lock a subscriber identity associated with the device by setting a password on the subscriber identity. If a credential entered by a user is verified, the subscriber identity associated with the device may be unlocked. Alternatively, the user device may retrieve one or more identities associated with the user, the user device and/or the subscriber identity. A server may register the one or more identities with a database. If the user device sends a request to connect to the network, the server may verify the one or more identities retrieved by the user device to determine whether to grant access from the user device to the network.

Abstract: The technology disclosed relates to non-intrusively enforcing security during federated single sign-on (SSO) authentication without modifying a trust relationship between a service provider (SP) and an identity provider (IDP). In particular, it relates to an assertion proxy receiving a verified assertion from an IDP obtained from an assertion that is generated when a user logs into a service provider (SP) and is verified in dependence upon the IDP's public key. It also relates to evaluating the verified assertion against one or more security policies. It further relates to forwarding the verified assertion evaluated to the SP and causing establishment of a single sign-on (SSO) authenticated session without modifying the assertion.

Abstract: Disclosed are various embodiments for searching encrypted data. A search query containing a plaintext key can be received from a client device or other application. A request can then be sent to a storage engine for a ciphertext key of a node of a binary tree, the node representing an encrypted key-value pair that includes the ciphertext key. The ciphertext key can be decrypted using a cryptographic key to generate a decrypted ciphertext key. Then, the decrypted ciphertext key can be compared to the plaintext key. A determination can then be made as to whether the encrypted key-value pair represented by the node of the binary tree satisfies the search query based at least in part on a comparison of the decrypted ciphertext key to the plaintext key.

Abstract: Systems and methods for securely sharing and authenticating a last secret can include generating, by a cryptographic module on a first network node, a seed configured for deriving or recovering a last secret, the last secret providing access to a secure entity and being a last cryptographic element controlling access to the secure entity, creating, by the cryptographic module, an envelope for the seed, enveloping the seed by the envelope, and transmitting, by the cryptographic module, the seed to a computing system on a second node different than the first node, the computing system being configured to decrypt the envelope of the enveloped seed to recover the seed, and obtain the last secret based on the seed, where the cryptographic module is prevented from deriving the last secret.

Abstract: Systems and methods that may be used to provide multitenant key derivation and management using a unique protocol in which key derivation may be executed between the server that holds the root key and a client that holds the derivation data and obtains an encryption key. In one or more embodiments, the derivation data may be hashed. The disclosed protocol ensures that the server does not get access to or learn anything about the client's derived key, while the client does not get access to or learn anything about the server's root key.

Abstract: An autonomous driving controller includes a plurality of parallel processors operating on common input data received from the plurality of autonomous driving sensors. Each of the plurality of parallel processors includes communication circuitry, a general processor, a security processor subsystem (SCS), and a safety subsystem (SMS). The communication circuitry supports communications between the plurality of parallel processors, including inter-processor communications between the general processors of the plurality of parallel processors, communications between the SCSs of the plurality of parallel processors using SCS cryptography, and communications between the SMSs of the plurality of parallel processors using SMS cryptography, the SMS cryptography differing from the SCS cryptography. The SCS and/or the SMS may each include dedicated hardware and/or memory to support the communications.

Abstract: A computer system may generate alerts related to a potential cyber attack an resource of an organization. The computer system may receive activity information associated with activity on a computer network of the organization, access contextual information about the resource, determine, based on the contextual information, select, based at least in part on the contextual information, one or more indicators that are indicative of a cyber attack against the resource to form a second plurality of indicators, and generate, based at least in part on the second plurality of indicators and the contextual information, a risk score, wherein the risk score indicates a probability that the resource is at risk of a cyber attack. In response to the risk score satisfying a threshold value, the computer system may generate an alert. Alerts may be presented using a graphical user interface. Analysts' actions may be tracked for review.

Abstract: Systems, apparatuses, and methods for more effectively preparing for and responding to cybersecurity threats directed at people or at groups of people. A segmentation process is described that evaluates multiple characteristics of a person that may make them a potential target or that may make a cybersecurity attack on that person more likely to be successful. Based on the segmentation, a security analyst can apply an appropriate risk reduction or security protocol to each person or group of similarly situated people to reduce the likelihood of an attack and/or the likelihood of a successful attack.

Abstract: A secure cloud-based node-locking service with built-in attack detection to eliminate fuzzing, cloning and other attacks is disclosed. White-box base files are securely stored on the cloud service and are not vulnerable to accidental leakage. A secure cloud-based dynamic secret encoding service reduces the risk of exposure of unprotected secrets and other sensitive data.

Abstract: A data diode provides a flexible device for collecting data from a data source and transmitting the data to a data destination using one-way data transmission across a main channel. On-board processing elements allow the data diode to identify automatically the type of connectivity provided to the data diode and configure the data diode to handle the identified type of connectivity. Either or both of the inbound and outbound side of the data diode may comprise one or both of wired and wireless communication interfaces. A secure reverse channel, separate from the main channel, allows carefully predetermined communications from the data destination to the data source.

Abstract: A database-management system provides sargable evaluation for query predicates that compare an “LHS” encrypted database-column operand to an “RHS” expression operand. The system directly compares the two operands if all their attributes match. If the operands are encrypted string-type values differing only in length, the system truncates the RHS or pads it with encrypted blanks and, if a truncation loses meaningful data, evaluates the predicate as never satisfying an equality condition. In all other cases, if all attributes of a plaintext RHS don't match those of the plaintext data encoded into the LHS column, the system attempts to cast the RHS to match the plaintext LHS data. An error condition or data loss at this step allows the system to sargably evaluate the predicate without further analysis, but if the casting is successful and error-free, the system encrypts the resulting RHS and performs a sargable predicate evaluation.

Abstract: A data diode provides a flexible device for collecting data from a data source and transmitting the data to a data destination using one-way data transmission across a main channel. On-board processing elements allow the data diode to identify automatically the type of connectivity provided to the data diode and configure the data diode to handle the identified type of connectivity. Either or both of the inbound and outbound side of the data diode may comprise one or both of wired and wireless communication interfaces. A secure reverse channel, separate from the main channel, allows carefully predetermined communications from the data destination to the data source.