Abstract: A data deidentification system that extracts insights from user data and retains both the insights and user data in a form that complies with applicable data privacy and related standards. The system receives user data, which can include personal identifying information and other sensitive data governed by one or more standards, including standards specifying how the data can be used and how long it can be retained. From the data, the system extracts insights characterizing various aspects of the associated users. The system also selectively hashes portions of the data, obscuring the identity of associated users. Neither the insights nor the selectively hashed data identify individual users, and therefore they are not subject to the same standards and can be retained indefinitely. Later, after the standards-protected data has been discarded, the system can provide insight information in response to a request.

Abstract: Methods and systems for data security are provided. The method includes generating respective tags for data segments in a dataset, deriving respective temporal keys associated with the respective tags for the plurality of data segments from a master key, and transforming the plurality of data segments from a plaintext to a ciphertext using the respective temporal keys as a first input and the respective tags as a second input, while format-preserving the data segments. The master key can be updated to prevent from reverse-transforming a selected data segment in the dataset from the ciphertext to the plaintext.

Abstract: A data deidentification system that extracts insights from user data and retains both the insights and user data in a form that complies with applicable data privacy and related standards. The system receives user data, which can include personal identifying information and other sensitive data governed by one or more standards, including standards specifying how the data can be used and how long it can be retained. From the data, the system extracts insights characterizing various aspects of the associated users. The system also selectively hashes portions of the data, obscuring the identity of associated users. Neither the insights nor the selectively hashed data identify individual users, and therefore they are not subject to the same standards and can be retained indefinitely. Later, after the standards-protected data has been discarded, the system can provide insight information in response to a request.

Abstract: A method for pairing a content provider system and a receiving device, a cryptographic function and a receiving device unique identifier being populated in the receiving device. According to such method, the receiving device executes: obtaining a first key which is a result of a first function taking as arguments an Identity Based Encryption scheme master key owned by an authority server and an output of the cryptographic function applied to the receiving device unique identifier; receiving, from the content provider system, a content provider unique identifier; and computing a secret key which is a result of a second function taking as operands the first key and an output of the cryptographic function applied to the content provider unique identifier, the secret key being known from the content provider system.

Abstract: A method and system for generating cluster level explanations for an input data having limited or special values are disclosed. The method includes obtaining an input data set and a clustering stopping criteria, the input data set including multiple features, and each of the features having multiple feature values; performing features decomposition on the input data; performing correlation analysis based on the features decomposition and a correlation threshold value; grouping the features having different feature values into multiple clusters; training a model based on the obtained input data; obtaining a target input data to be tested and a number of cores; grouping the number of cores into multiple clusters; and computing explanations at a cluster level.

Abstract: Method and system for detecting a Denial-of-Service (DoS) attack on a network. The method includes sampling a traffic carried by the network between data processing devices, the traffic comprising data packets transmitted between the data processing devices, determining statistically estimated features of the traffic based on the sampling thereof, executing one or more heuristic algorithm based on the statistically estimated features, the one or more heuristic algorithms being configured to generate a confidence score indicative of a probability that at least some of the data packets constitute a DoS attack and comparing the confidence score with a confidence threshold to determine whether a mitigation order is to be generated.

Abstract: Provided is a method for providing a response to a user query for domain-related information of a domain. The method can include obtaining, at a client over a network, the user query for the domain-related information, and identifying one or more thick services based on thin data for the domain. The method can also include providing, by the client, the user query to the identified one or more thick services and obtaining a first answer to the user query from the one or more thick services. Furthermore, the method can include providing a second answer to a user based on the first answer.

Abstract: Implementations are described herein for unlocking a wireless device using image analysis and liveliness detection. A wireless device may capture, using a camera of the wireless device, an image of a person that is interacting with the wireless device. The wireless device may transmit a first signal using a first antenna and may receive a second signal using a second antenna. The wireless device may determine whether the image corresponds to a stored image. The wireless device may determine whether the second signal indicates a movement of the person or a depth characteristic of the person. The wireless device may selectively unlock the wireless device based on whether the image matches a stored image of the plurality of the stored images and based on whether the second signal indicates at least one of the movement of the person or the depth characteristic of the person.

Abstract: Systems and methods for account association with voice-enabled devices are disclosed. For example, a voice-enabled device situated in a managed environment, such as a hotel room, may be taken by a temporary resident or guest of the environment. Upon determining that the device has been removed from the environment, a device identifier associated with the device may be dissociated from components and/or services associated with environment and/or systems related thereto, and the device identifier may be associated with a user account of the user.

Abstract: A storage device includes a non-volatile memory, and a memory controller, wherein the memory controller encrypts plaintext to generate a homomorphic ciphertext with a first level among homomorphic ciphertexts with different levels, stores the homomorphic ciphertext with the first level in the non-volatile memory, and provides the homomorphic ciphertext with the first level in response to a request received from a host. The homomorphic ciphertext with the first level has a smallest length among the homomorphic ciphertexts with different levels.

Abstract: A data processing method, including: obtaining a challenge sequence of challenge-response pairs, and generating, by a physical unclonable function, an original response sequence corresponding to the challenge-response pairs; generating a first index parameter according to the challenge sequence, and obtaining feature bit information in the original response sequence according to the first index parameter; converting the challenge sequence to generate a second index parameter, and updating the first index parameter according to the second index parameter and the feature bit information; obtaining new feature bit information in the original response sequence according to the updated first index parameter; and repeatedly generating second index parameters, updating the first index parameter according to the second index parameters and the latest obtained feature bit information, and obtaining multiple pieces of feature bit information, to generate a target response sequence according to the multiple pieces of fe

Abstract: A method is provided for changing and recovering personalization data of a trusted software in a secure element and changing and restoring diversified data. The method includes the steps of providing an update agent in the secure element; storing personalization data in the installed software; performing a Full Reflash to recover or update a software or operating system comprising the steps of first securing personalization data to a memory of the update agent before, in following step, recovering or loading a software image into the secure element. The method includes as a final step personalizing the software image by the personalization data secured during the first step of the Full Reflash.

Abstract: A method performed by a node of a blockchain network, comprising: accessing the locking script from a first transaction on the blockchain; receiving a second transaction not yet on-chain, the second transaction comprising an unlocking script; extracting from the first transaction or another transaction on the blockchain, a portion of code formulated in a second language other than a first language used for the locking and unlocking scripts; running the extracted portion of code in the second language, wherein as a result thereof the code generates at least one value; writing this value to a storage location readable by the locking script; and running the locking script together with the unlocking script in order to validate the second transaction, wherein the unlocking script is configured to read the first value from said storage location, and a condition for validation according to the locking script is dependent on the first value.

Abstract: A secure technology for allowing two communication devices intending to execute encrypted communication to have a common initial solution. A large number of user devices all have a function of generating the same solution under the same condition when the user devices have the same initial solution, and can execute encrypted communication through use of a synchronized solution successively generated from the same initial solution. Each of two server devices generates synchronization information which is not the initial solution itself and which is required by the two user devices intending to execute the communication to generate the same initial solution, and transmits the synchronization information to the two user devices each of which executes predetermined calculation on the two pieces of synchronization information, to thereby generate the same initial solution. After that, the two user devices execute the encrypted communication based on the same initial solution.

Abstract: Various techniques for providing a DNS automated intelligence solution are disclosed. In some embodiments, a DNS Automated Intelligence System (DAISy) is disclosed that includes a system designed to create threat intelligence for use in protective DNS, or DNS Detection and Response systems which control access to internet resources at a DNS resolver. The disclosed DAISy solution includes the ingestion of raw source data, the curation and refinement of this source data into specialized data sets used for identifying threats, active processes to increase visibility into internet domain names, and can also include human-in-the-loop acceleration that allows for rapid automation, and a modular incorporation of DNS-specific signatures for identification of suspicious domain names. The disclosed DAISy solution is self-sustaining, automated, and incorporates human guidance.

Abstract: The invention enables digital music content to be downloaded to and used on a portable wireless computing device. An application running on the wireless device has been automatically adapted to parameters associated with the wireless device without end-user input (e.g. the application has been configured in dependence on the device OS and firmware, related bugs, screen size, pixel number, security models, connection handling, memory etc., This application enables an end-user to browse and search music content on a remote server using a wireless network; to download music content from that remote server using the wireless network and to playback and manage that downloaded music content. The application also includes a digital rights management system that enables unlimited legal downloads of different music tracks to the device and also enables any of those tracks stored on the device to be played so long as a subscription service has not terminated.

Abstract: This method comprises opening (82) a secure connection between a connected building object and a remote controller, implementing a first security certificate of the connected object and a second security certificate of the remote controller, and receiving via said secure connection (42) a command to perform at least one action issued by the remote controller, followed by the steps of: extracting (86) a value from a predetermined field of the second security certificate, referred to as the remote controller's access authorisation value; checking (90), in a structure for storing associations between access authorisation values and sets of authorised commands, that said received command belongs to a set of at least one authorised command associated with said access value; and if the check is positive, executing (92) at least one action associated with the received command.

Abstract: The disclosure reduces a memory footprint of a hash table that employs chaining as a collision avoidance solution. The methods and systems disclosed herein enable the use of chaining collision handling while reducing a memory footprint by storing parts of a tag and a link list pointer associated with a linked list that contain useful information, without storing parts of the tag and pointer that do not contain useful information. The linked list pointer and a hash key are packed together without reducing either size, and without using additional memory overhead.

Abstract: One or more embodiments initialize a signature validation object in a secure element (SE) platform runtime environment and utilize the signature validation object to perform signature validation operations. A system accesses an authentication path that includes a set of hash values corresponding to a set of nodes of a tree structure associated with a hash-based signature protocol utilized to generate a digital signature. The system computes a root hash value corresponding to a root node of the tree structure based on the set of hash values of the authentication path. The system verifies the root hash value against a root public key associated with the digital signature. The system determines that the digital signature is valid responsive at least in part to successfully verifying the root hash value against the root public key.

Abstract: A system and method is described that reduces a likelihood that a privileged account at a system (e.g., device, network, and/or application) for a user is compromised. For example, the privileged account for the user at the system is disabled in response to being created. The user can provide a request for at least one elevated right at the system corresponding to a request to use the privileged account at the system. An identity of the user is authenticated in response to receiving the request to confirm that the user is requesting the privileged account at the system. The privileged account for the user is enabled at the system to allow the user to perform at least one action that the user was not previously allowed to perform.