Abstract: In some implementations, a server device may receive, from a client device, a login credential associated with a user and a request to access a resource. The server device may identify a confidant associated with the user and a confidant device associated with the confidant, wherein the confidant device is different from a user device associated with the user. The server device may transmit, to the confidant device, a request to verify an identity of the user. The server device may determine whether a verification of the identity of the user is received from the confidant device. The server device may grant or deny access to the resource based on determining whether the verification of the identity of the user is received from the confidant device.

Abstract: Systems and methods are described for preserving the privacy of a user in connection with an extended reality (XR) application. The system and methods may receive, by an interposer application, image data from a video capture driver and determine, by the interposer application and based on privacy preferences of a user profile, whether a region of the image data comprises sensitive content. In response to determining that a region of the image data comprises sensitive content, the image data may be modified by applying, by the interposer application, a modification to the region of the image data. The modified image data may be provided by the interposer application to the XR application, wherein the wherein the XR application may be prohibited from directly accessing data from the video capture driver.

Abstract: Techniques are described for performing multi-factor authentication of a user during a service session, based at least partly on a code conveyed using an audio file. A code is generated that corresponds to the user and/or their user device. A playback device that is registered to the user can be used to output a playback of an audio file that encodes the code. The playback of the audio file is conveyed through the service session by the user device and received by a backend server, which analyzes the playback of the audio file to extract the code. The user can be authenticated based at least partly on verifying the code that is extracted from the playback of the audio file, by comparing the extracted code to the code that was generated and sent to the playback device.

Abstract: Distributed firewalls in a network are disclosed. Example firewall controllers disclosed herein are to instruct a first network node of a software-defined network to implement a first firewall instance of a distributed firewall, the first network node to implement the first firewall instance with a first virtual machine. Disclosed example firewall controllers are also to configure a second network node of the software-defined network to route network traffic through the first firewall instance and, after at least some of the network traffic is dropped by the first firewall instance, instruct the second network node to implement a second firewall instance of the distributed firewall, the second network node to implement the second firewall instance with a second virtual machine.

Abstract: A computing device can capture a current access token of a user process. The computing device can perform a determination of whether the current access token for the user process differs from a particular access token of a parent process of the user process. The computing device can detect whether the user process has been subject to an escalation of privilege attack based on the determination of whether the current access token for the user process differs from the particular access token. The computing device can performing a mitigation action with respect to the user process in response to detecting that the user process has been subject to the escalation of privilege attack.

Abstract: An information processing apparatus in the present invention includes: a matching unit that matches biometric information acquired from a user requesting use of a management target with registered biometric information of each of a plurality of registrants; a determination unit that determines whether or not a registrant with which a matching result is that the matching is successful out of the plurality of registrants has usage authority for the management target; and an output unit that, when the matching result from the matching unit is that the matching failed, outputs first error information, and when it is determined in the determination unit that the registrant with which the matching result is that the matching is successful does not have the usage authority, outputs second error information different from the first error information.

Abstract: Systems and methods for providing multi-factor authentication based on visual objects associated with an out of band shared secret delivery channel and at least one user device of a telecommunication network include an access point communicatively coupled to an authentication system. The authentication system is structured to generate a set of visual objects, cause the set of visual objects to be output by a first user device, transmit, via an out of band shared secret delivery channel, a visual object request to cause a secondary user device to output one or more out of band visual objects, receive an indication of object selection from the set of visual objects, determine that the indication of the object selection is associated with a visual selection match among the set of visual objects, and based on the visual selection match, authenticate access to an application associated with the authentication system.

Abstract: A system for managing data of an automation field device in a secure manner includes a decentralized distributed ledger-type database, or blockchain, comprising a plurality of subscriber nodes, comprising validation-capable subscriber nodes and an automation field device with an electronic unit. The electronic unit is designed to run a distributed ledger software stack. The field device generates data, comprising measurement values and/or calibration certificates requiring verification, and the field device operates as a light node of the decentralized database after running the distributed ledger software stack and is designed to transmit the data to the decentralized database via the communication network and write said data in encrypted form into the decentralized database.

Abstract: Nested namespaces for selective content sharing.

Abstract: A system and method for cybersecurity vulnerability management through ticket system reduction reduces alert fatigue. The method includes receiving a plurality of alerts from a cybersecurity monitoring system, the cybersecurity monitoring system configured to monitor a computing environment, wherein each alert includes a plurality of attributes; generating in a graph database a ticket node corresponding to each alert of the received plurality of alerts; generating in the graph database a ticket group node, the ticket group node connected to a plurality of ticket nodes, each ticket node of the plurality of ticket nodes corresponding to an alert having an attribute with a same value; generating a ticket in a ticketing system corresponding to the ticket group node; and generating a visual representation of the ticket corresponding to the ticket group node.

Abstract: Systems and methods for secure distribution of biometric matching processing are provided. Certain configurations include homomorphic encrypting of captured biometric information. In some configurations, the biometric information is classified without decryption between a first identity class and a second identity class. The biometric information may be formed as a feature vector. A homomorphic encrypted feature vector may be formed by homomorphic encrypting of the biometric information.

Abstract: A method including retrieving, by a device associated with a virtual private network (VPN) server from a read-only device, an initial operating system associated with the VPN server providing VPN services; transmitting, by the device based at least in part on executing the initial operating system, a first request to an infrastructure device for a VPN operating system to enable the VPN server to provide the VPN services; receiving, by the device from the infrastructure device based at least in part on transmitting the request, the VPN operating system; and executing, by the device, the VPN operating system to provide the VPN services is disclosed. Various other aspects are contemplated.

Abstract: The present invention is directed to a computer-implemented method for linking identity information of a physical identifier to a digital identifier. The identity information comprises a plurality of symbols. The method comprises cryptographically obfuscating one or more symbols of the identity information separately into an obfuscated symbol such that a separate deobfuscation information is needed for each obfuscated symbol to deobfuscate it and storing the obfuscated symbols within the digital identifier.

Abstract: An authentication system facilitates efficient generation of authentication integrations with third-party identity providers for client systems. The authentication system provides one or more interfaces configured to receive requests to make authentication integrations available for a third-party identity provider. The requests to make authentication integrations available include integration information for the relevant identity provider. Based on the request to make authentication integrations available, the authentication system generates an identity provider profile for the identity provider that can be used to generate authentication integrations with the identity provider for one or more client systems. Once the identity provider profile is generated, the authentication system uses the identity provider profile to generate authentication integrations for one or more client systems that request authentication through the third-party identity provider.

Abstract: Embodiments of this application provide a service continuity implementation method, an apparatus, and a system, to ensure service continuity in an application layer data packet transmission process. The method includes: receiving, by a session management network element, first survival time information from a policy control network element, where the first survival time information indicates duration of a service that survives when a correct data packet is not received; determining, by the session management network element, the first survival time information as a binding parameter of a quality of service QoS flow; and sending, by the session management network element, second survival time information to an access network device, where the second survival time information is used to indicate the duration; and after receiving the second survival time information from the session management network element, scheduling, by the access network device, a data packet based on the second survival time formation.

Abstract: Embodiments for processing authentication tokens in a system with multiple Representational State Transfer (REST) servers and clients. An intelligence process for multiple processes or multiple REST clients in an OS effectively communicates with multiple REST servers and proactively manages each server's authentication token. A shared library is loaded into a process that uses shared memory to manage the generation and expiry of a token and to communicate with a supported REST server through a single function call. The REST Authentication token will be generated for each REST server and stored in the shared memory which will be reused across multiple processes that use the library. The REST token will be validated for each function call.

Abstract: A content management system for collecting files from one or more submitters in a collection folder. A collector, who generates the collection folder, can invite one or more submitters to submit one or more files to the collection folder in response to a public file request. The one or more submitters have limited rights to the collection folder. The limited rights can include uploading rights and prohibiting a submitter from viewing files that other submitters associated with the collection folder submitted. Thus, the collection folder is able to store files from the one or more submitters, but prevent them from viewing other's submissions.

Abstract: An information processing device 10 includes a configuration information storage unit which stores cluster configuration information making it possible to identify which cluster each information processing device in a system including multiple information processing devices belongs to, a verification information management unit which manages a first value corresponding to a content of a program of each of the information processing devices in the system; and a verification unit which derives a second value for a program in the information processing device by a method identical to a method of deriving the first value in response to reception of a verification request, and transmits the second value to a transmission source of the verification request, wherein the verification unit verifies the program in the information processing device by comparing the second value received from the information processing device with the first value.

Abstract: The present disclosure provides a security assessment apparatus, a method, and a program capable of making an assessment of a security risk simply and appropriately. The security assessment apparatus according to the present disclosure is a security assessment apparatus of a facility to be controlled using a controller, including: an identification unit (15) configured to identify a compromised component which puts the facility into an unsafe situation based on data regarding a plurality of components provided in the facility and control program code of the controller, thereby generating a list of the compromised component; and a compromised behavior generating unit (16) configured to generate a compromised behavior of a selected component selected from the list of the compromised component.

Abstract: The present disclosure proposes method and systems for establishing secure communication session (s) between a first device and a second device, where the first device operates in a user network and implements a first key exchange protocol for secure communication. The second device is capable of communicating with the first device over a wireless communication network. The second device implements a second key exchange protocol that is different to the first key exchange protocol for secure communication. A proxy entity configured for implementing the first and the second key exchange protocols for secure communication is provided. The proxy entity is configured for generating and/or provisioning one or more session keys for the first and the second devices using the key exchange protocols specific to each device for establishing secure communication between the first and second device based on the generated session key(s).