Abstract: An example apparatus includes: memory; instructions in the apparatus; and at least one processor to execute the instructions to: check for proof of trust information in one or more pre-determined positions in a trusted digital image, the proof of trust information including a secure output marker, the secure output marker indicative of information corresponding to a trusted output area of the trusted digital image; decrypt the secure output marker using one or more security keys from a trusted execution environment (TEE), the TEE isolated from a computing application; and enable activation of a trusted output indicator in response to a match between first data corresponding to the secure output marker and second data corresponding to the trusted output area of the trusted digital image.

Abstract: The present invention provides an information processing apparatus and a method of controlling the information processing apparatus. The information processing apparatus comprises a first storage that stores a boot program, and a second storage that stores hardware configuration information of the information processing apparatus. At activation of the information processing apparatus, the information processing apparatus verifies a validity of the hardware configuration information stored in the second storage by executing the boot program, and in a case that the validity of the hardware configuration information is verified, the information processing apparatus adds unique information that depends on an individual of the information processing apparatus by executing the boot program to the hardware configuration information of the second storage.

Abstract: A process of anonymizing a person captured in an image. An anonymization server receives a request from an agency to anonymize a person captured in an image including an unredacted facial feature corresponding to the person and an unredacted non-facial feature. The server redacts the facial feature captured in the image to generate a first redacted image. The server then identifies a second image accessible to users not associated with the agency. When the server determines that the anonymity of the person captured in the first redacted image can be compromised using unredacted facial and non-facial features captured in the second image, the server further redacts the non-facial feature captured in the image.

Abstract: The present invention provides a wireless communication method of an access point. The wireless communication method comprises the steps of: establishing a cache table comprising a plurality of reference MAC and corresponding PMKs and reference PMKIDs; receiving an association request from a station; reading a MAC address of the station and a PMKID from the association request; if the MAC address of the station and the PMKID do not match items of the cache table, performing a calculation on the PMKID to obtain an original PMKID; determining if the original PMKID matches any one of the reference PMKIDs within the cache table; and if the original PMKID matches one reference PMKID within the cache table, determining that the reference MAC recorded in the cache table and the MAC address belong to the same station.

Abstract: Methods, systems, and apparatus, including computer program products, for secure authentication for accessing remote resources are disclosed. In some implementations, a user is authenticated for a first time on an interface using a first communications channel; the user is authenticated a second time on the interface using a second communications channel; access privileges are determined based on authenticating the user for the second time; and a random Uniform Resource Locator (URL) is generated based on the access privileges, where the random URL is single-use and indirectly associated with a requested resource.

Abstract: Techniques are described for pooling data originating from different entities into a data pool managed by a data pool management system for performing accurate and resource-efficient statistical and other data operations by entities. Techniques further include maintaining rule sets that govern access to the data sets of the data pool. The DPMS uses the rule sets to determine whether a particular data set, on which a particular operation is requested to be performed, qualifies as authorized data for the requesting entity. In an embodiment, the DPMS determines, based on one rule set, that the particular data set does not qualify as authorized data for the particular operation. The DPMS further determines that based on another rule set the particular data set does qualify as authorized data for the particular operation. Based on determining that authorizing rule set overrides the non-authorizing rule set, DPMS proceeds to performing the particular operation using the particular data set.

Abstract: Systems, methods, and apparatuses are disclosed for securing the use of command line entries. Techniques may include invoking, by a main process, a secondary process in a computing environment in a suspended mode and providing one or more placeholder command line entry to the secondary process. Techniques may further include retrieving at least one secret by the main process and storing an operable command line entry in a memory location associated with the secondary process, wherein the one or more placeholder command line entry is nullified, wherein the secondary process is configured to process the operable command line entry and use the at least one secret.

Abstract: Systems and methods are provided for enforcing symmetric flows of cross-region network traffic through firewalls in multi-region network environments. Enforcement may be configured automatically by analyzing network policy data to identify cross-region traffic that is to be firewalled, and configuring gateway nodes in the various regions to implement symmetric bidirectional flows through any firewalls in the communication path. Beneficially, by enforcing symmetric bi-directional flows of traffic through any firewalls in a communication path, the firewalls may maintain the state of a given communication session even when the communication session is between endpoints in different regions that have different architectures.

Abstract: Embodiments described herein provide a system and method for controlling access to electronic files by linking the files to a file access monitoring system, called the file access monitor in this application. The file access monitor then authorizes the use of the one or more files by performing one or more qualifying steps on the accessing computer system. The file access monitor may be a standalone program or an embedded logic within a closed system like an application, an operating system (O/S), an external device like a printer, a web browser or a web browsing application. Access to electronic files can include the exchange, modification, execution, printing, viewing, listening, copying and replication of these files to name a few. A given protected electronic file is transferred from a sending computer system to a receiving computer system for eventual access. The receiving computer may also become the accessing computer should a user on the receiving computer wish to access the transferred file.

Abstract: Systems and methods for generating transient object references are provided. The systems and methods perform operations including establishing a session between a first entity and a second entity. The operations include identifying an object that the first entity is authorized to access according to a first set of access privileges. The operations include generating a reference associated with the object. The operations include temporarily authorizing the second entity to access the object using the reference according to a second set of access privileges, the second set of access privileges being derived from the first set of access privileges.

Abstract: A method for runtime integrity check, performed by a security core including one or more processors includes storing a first output value, which is generated by using a one-way encryption algorithm based on first data and a first encryption key managed by an encryption key manager accessible by the security core, in a main memory that is a volatile memory in association with the first data, generating a second output value for the first data based on the first data and the first encryption key by using the one-way encryption algorithm, and checking for possible tampering of the first data stored in the main memory by comparing the first output value with the generated second output value.

Abstract: A secure communication system enabling secure transport of information is disclosed. The system comprises a secure network with one or more packet processing units connected by links through an internal communication system. The secure network transports packets of information between credentialed and authenticated agents. Each packet is associated with a visa issued by a visa service. The visa specifies the procedures governing the processing of the packet by the packet processing units as it is transported along a compliant flow, between agents thorough the network, according to a set of policies specified in a network configuration. Packet processing units include docks and forwarders. Adaptors serving the agents communicate with the network through tie-ins to docks. The system also includes and admin service, accessible to one more admins, that facilitates configuration and management of the network.

Abstract: A chip set for a terminal comprises at least one secure processor, in which a one-time programmable memory is integrated. At least one terminal serial number of the terminal is stored in the chip set. Information for securing the terminal serial number against tampering is stored in the one-time programmable memory.

Abstract: Systems, devices, and methods are disclosed for instantaneously decrypting data in an end-to-end encrypted secure messaging session while maintaining forward secrecy and post-compromise security using a double ratchet communication protocol. Unique message keys can be generated in a predictable progression independently on each device, ratcheting keys for each message on an as-needed basis, and a seed key and state for the predictable progression can be updated based on an asymmetric key exchange between the devices, thereby serving as a second ratchet. Message keys can feed a pseudo-random number generator (PRG) to generate the next message key in a progression. A Continuous Key Agreement (CKA) engine can use an asymmetric key pair to generate a shared secret key to feed a Pseudo-Random Function (PRF-PRNG) to reset the state of the PRG and provide a refresh key to the PRG.

Abstract: A method of secure wireless ranging between a verifier node and a prover node comprises performing a measurement procedure resulting in a two-way phase measurement and a round-trip time measurement between the verifier node and the prover node. The measurement procedure comprises the verifier node transmitting on the frequency a verifier packet, the prover node receiving the verifier packet and performing a phase measurement of a verifier carrier signal and a time-of-arrival measurement of a verifier frame delimiter, the prover node transmitting a prover packet, and the verifier node receiving the prover packet and performing a phase measurement of the prover carrier signal and a time-of-arrival measurement of the prover frame delimiter. The method further comprises calculating a distance between the verifier node and the prover node based on the two-way phase measurements and the round-trip time measurements for the plurality of frequencies.

Abstract: Methods, apparatus, and systems for session key generation for AV operation are disclosed. In an embodiment, a vehicle service subscriber system generates an entropy. The vehicle service subscriber system is associated with a vehicle service subscriber. The vehicle service subscriber system transmits a synchronization message to a vehicle service provider system associated with at least one vehicle. The synchronization message includes the entropy. The vehicle service subscriber system receives a salt from the vehicle service provider system. The vehicle service subscriber system verifies that the salt was generated using the entropy. The vehicle service subscriber system calculates session keys using the salt. The vehicle service subscriber system receives a protected message from the vehicle service provider system. The vehicle service subscriber system authenticates the protected message using the session keys. The protected message is used to provide a ride involving the at least one vehicle.

Abstract: Various embodiments are generally directed to an apparatus, method and other techniques to detect an access request to access a computing resource while in a system management mode (SMM), determine a bit of a lock register is set to enable access to a bitmap associated with the computing resource, the bitmap to indicate an access policy for the computing resource, and determine whether the access request violate the access policy set in the bitmap. Embodiments may also include performing the access request if the access request does not violate the access policy, and causing a fault if the access request does violate the access policy.

Abstract: The foundation of Matrix Encryption is a discrete function called the Modified Combinatorial Batch Decimation Function (CBDF-Mod) and its asymmetric inverse (CBDI-Mod). Herein we disclose the nature of Matrix Encryption, an encryption technology built upon these two discrete functions, together with their shared, Secondary Variable Functions. Matrix Encryption implements a block encryption with arbitrary block size dependent upon the length of text to be encrypted, thereby allowing for keys of user desired length and for the surpassing of industry standards of security. A Master Key may be used to generate a Key Set containing keys of appropriate length for any data presented above a minimum length, up to a length corresponding to the length of a message for which the Master Key is appropriate. Matrix Encryption reads and writes numerically encrypted text to text files as designated by the user.

Abstract: The disclosed embodiments relate to secure booting of memory device. The disclosed embodiments generate measurement data associated with a memory device. Next, the disclosed embodiments read a golden measurement from a secure location in the memory device, the golden measurement generated based on a version of the data associated with the memory device, and therefore it is unique to the device. The disclosed embodiments validate the golden measurement value using a public key and determine whether the golden measurement is equal to the measurement data. The golden measurement value can also be saved in a write protected area which can only be changed by a secure write command, therefore, it is imutable by others. Finally, the disclosed embodiments continue a boot process when the golden measurement is equal to the measurement data.

Abstract: An Information Handling System (IHS) includes at least one hardware device in communication with a Baseboard Management Controller (BMC). The hardware device includes executable instructions for establishing a secure communication channel with the BMC, and subsequently receiving a list of allowed commands from the BMC. When a command is received by the hardware device, it determines whether the command is included in the list such that when the command is in the list and the command is received within the secure communication channel, the hardware device performs the command. However, when the command is in the list and the command is received outside of the secure communication channel, the hardware device ignores the command.