Abstract: A method of rotating a set of keys, having a media encryption key (MEK) and a current media encryption key encryption key (MEKEK) encrypted and stored in a self-encrypting drive (SED) having data encrypted with the MEK (MEK(data)), includes decrypting the stored MEK and the current MEKEK. A new MEK (MEK?) and a new MEKEK (MEKEK?) are generated. The MEKEK? is encrypted to replace the current encrypted MEKEK. A concatenation of the MEK and the MEK? is encrypted with MEKEK?. The encrypted data MEK(data) is re-encrypted with MEK?.

Abstract: A key block can be generated from a session key used by a computer-based design tool for a circuit design by encrypting the session key using computer hardware. The key block can be divided, by the computer hardware, into a plurality of sub-blocks. A plurality of enhanced sub-blocks can be generated by the computer hardware by encrypting each sub-block of the plurality of sub-blocks with a different key of a plurality of keys corresponding to a plurality of Intellectual Property (IP) cores of the circuit design. The plurality of enhanced sub-blocks can be stored in a memory.

Abstract: A detection and protection system for fake relay stations in a telecommunication network comprises a core network, which comprises a threat detection device comprising a radio terminal and a processor; and a plurality of signal relay stations, wherein the radio terminal is communicated with the signal relay stations, the threat detection device performs a wireless signal scanning, and the processor identifies the signal relay stations according to a result of the wireless signal scanning and judges whether there are fake relay stations among the signal relay stations; wherein, the processor decodes the information in the result of the wireless signal scanning, compares the identification information of each signal relay station in the information with a white list, so as to identify whether the signal relay stations include fake relay stations which do not belong to the white list, wherein the white list contains the identification information of legitimate relay stations; and wherein in case that the fake re

Abstract: Aspects of the disclosure relate to detecting and preventing transmission of spam messages using modified source numbers. A computing platform may detect that a first message, sent to a recipient device from a sender device, includes suspicious content. Subsequently, the computing platform may receive, from the recipient device, user interaction information indicating that a user of the recipient device has sent a reply message in response to the first message. Then, the computing platform may generate a modified message by modifying a first source number corresponding to the reply message. Next, the computing platform may cause transmission of the modified message with the modified first source number to the sender device. Thereafter, the computing platform may intercept one or more additional messages between the sender device and the modified first source number and redirect the one or more additional messages.

Abstract: In various examples, input queries (e.g. open user queries) are used combination with predefined queries to perform security policy-related actions using a generative machine learning (GML) model or GML models. In one example, an input query relating to a security policy is matched with a predefined query stored in an instruction database. In some examples, the instruction database contains examples of structured configuration data, which in turn can be used by a GML model to configure a predetermined extractor code module to perform a specific policy-related action. In other examples, a security context relating to a security policy is used together with an input query and template query to generate a GML model query. In some examples, the two approaches are combined.

Abstract: Arrangements for detecting unauthorized activity using artificial intelligence (AI)-driven searching are provided. In some aspects, input from a computing device associated with an entity may be received. A monitoring tool may be used to determine that the entity is a human entity. Responsive to determining that the entity is a human entity, one or more data sources may be queried for identity information related to the entity. Using an AI model, data from the received input may be compared with the identity information from the one or more data sources. Based on the comparison, a risk score associated with the entity may be assigned. The risk score may determine a presence of potential unauthorized activity associated with the entity. Feedback data on the risk score assigned by the AI model may be received. The AI model may be automatically and continuously updated based on the feedback data.

Abstract: Data is received that comprises or characterizes an executable and dynamic linked library (DLL). Features are then extracted from the executable and DLL. The extracted features are input into at least one machine learning model to generate a suspiciousness score. The machine learning model can be trained to determine whether the executable file comprises ransomware. An execution chain of trust score for the executable and DLL can later be determined based on the extracted features and the suspiciousness score. This execution chain of trust score for the executable and DLL characterizes one or more associated parent processes. This suspiciousness score and the execution chain of trust score can be used to determine whether or not to initiate one or more ransomware countermeasures. Related apparatus, systems, techniques and articles are also described.

Abstract: A system includes a memory, a processor in communication with the memory, and a first TEE instance. The first TEE instance is configured to maintain an encrypted secret, obtain a cryptographic measurement associated with a second TEE instance, validate the cryptographic measurement, and provision the second TEE instance with the encrypted secret. Additionally, the first TEE instance and the second TEE instance are both configured to service at least a first type of request.

Abstract: Proactive threat detection in a security system includes monitoring user input received for operating the security system over time and establishing a baseline user input for operating the security system that produces a baseline operation of the security system that can monitor for and identify each of a plurality of baseline security events. An anomaly in the user input relative to the baseline user input is detected and a determination is made as to whether the anomaly means the security system is not able to identify one or more of the baseline security events. When the anomaly in the user input causes the security system to not be able to identify one or more of the baseline security events, a proactive threat detection alert is provided that prompts an operator to take action to resolve the anomaly.

Abstract: According to one embodiment, a memory system includes a nonvolatile memory and a controller. The controller is communicable with a host and is configured to control the nonvolatile memory. The controller is configured to when receiving a key generation command from the host, generate an encryption key by an encrypting and decrypting function unit, store the encryption key in the nonvolatile memory, and transmit an identifier of the encryption key to the host.

Abstract: Disclosed herein are systems and methods for detecting cyclic activity in an event stream. In one aspect, an exemplary method comprises, creating a buffer, determining a threshold for indicating a beginning of a cycle, processing each event by filling the buffer with the event, determining a number of unique events in the buffer, when the number reaches a predetermined size of the buffer, replacing one event with another by excluding the earliest event and including the new event, recalculating the number of unique events, comparing the recalculated number with a threshold for a maximum number of unique events for cycle detection, detecting a beginning of a cycle when the number of unique events is less than or equal to the maximum number of unique events for cycle detection, excluding further events from the event stream, and continuing to recalculate the number of unique events after each addition.

Abstract: Systems and methods for redacting malicious URLs and other activatable content from messages are disclosed. A content analysis system may receive a text message or a multimedia message and determine whether a URL is contained in such a message. If so, the content analysis system may determine the maliciousness of the URL using various techniques, redacting the URL from the message before providing it to the user device if the URL is determined to be malicious. The original message may be stored for user access if desired.

Abstract: A method and apparatus for proving the originality of a creative design in a communication system, on the basis of a wearable device, by proving a causal relationship between a creative process of the creative design and a creative output by using a hash code associated with an image for each creative process of the creative design, and generating a piece of final hash information by combining a hash code for an intermediate image and a hash code for a final image during a creative process of a creative design through an arithmetic function, and transmitting an NFT including the final hash information and information about the final image to a blockchain, such that a design creator can claim an association between the intermediate image and the final image during the creative process of the creative design together at the time of disclosure of the design on a blockchain network.

Abstract: Methods can be provided for reducing risks of being a target of cyber attacks, or a data breach of personal data, or impersonation or theft of a digital identity, etc. Such methods may be implemented, for example, via a security application.

Abstract: Disclosed herein is an algorithm selector logic for determining an operational flow of operating system (OS) components. The algorithm selector logic features data retrieval logic, emulation logic, trace generation logic and software component selection logic. The data retrieval logic retrieves a targeted memory structure for an OS component. The emulation logic conducts emulation operations on the OS component. The trace generation logic inserts intercept points at memory address offset locations that correspond to parameters within the targeted memory structure to generate a trace. The software component selection logic compares an execution flow associated with the generated trace with known execution flows, where the known execution flows are associated with different OS versions.

Abstract: A method, comprising: executing an embedded malware detector, the embedded malware detector being executed inside a first guest operating system, the first guest operating system being executed on a storage processor that is part of a storage system, the storage processor being configured to execute one or more second guest operating systems in addition to the first guest operating system, each of the second guest operating systems being arranged to execute software for reading and/or writing data to one or more storage devices that are provided in the storage system; identifying, by the embedded malware detector, a given one of the storage devices; obtaining, by the embedded malware detector, a snapshot of the given one of the storage devices; mounting, by the embedded malware detector, the snapshot in the first guest operating system; scanning the mounted snapshot for malware.

Abstract: The cipher message data is distributed to an external device while ensuring the confidentiality of the cipher message data. A terminal device performs communication with an external device through a broker on the basis of a publish-subscribe message model. The terminal device includes: an acquisition unit that acquires external data; an encryption processing unit that encrypts at least a part of the external data to generate cipher message data including ciphertext; and a data distribution unit that distributes an encrypted publish message including topic designation data of plaintext and the cipher message data to the broker.

Abstract: Systems and methods for secure modular hardware binding in a Data Center Modular Hardware System (DC-SCM) environment are described herein. According to one embodiment, an Information Handling System (IHS) includes multiple Complex Programmable Logic Devices (CPLDs), and computer-executable logic to, for each of the CPLDs: store an encrypted secret key in a platform Root-of-Trust (RoT) and the CPLD, and receive, by the platform RoT, a request to authenticate a firmware stack installed on the CPLD. The logic may then present, by the CPLD, an encrypted secret key to the platform RoT, authenticate, by the platform RoT, the firmware stack by comparing the encrypted secret key received from the CPLD with its stored version of the encrypted secret key, and allow operation of the CPLD based on the authentication.

Abstract: Solutions are disclosed that provide isolated telecommunication (telco) functions for enhanced security monitoring and analysis. Examples monitor a plurality of network functions (NFs) of a wireless network for indications of malicious activity, such as mobility management entities (MMEs), user plane functions (UPFs), authentication server functions (AUSFs), and others. When suspected malicious activity is detected from a user equipment (UE), an isolated telco stack (i.e., an isolated network slice) is stood up in real-time to isolate the traffic to/from the UE. This facilitates capturing and analyzing the traffic, so that a responsive action may be selected. The configuration of the isolated telco stack (i.e., the NFs included in the isolated network slice) may be customized based on the nature of the suspected malicious activity. For example, suspected data exfiltration will trigger a first configuration, whereas suspected denial service will trigger a different configuration.

Abstract: A computer-implemented method (CIM), according to one approach, includes generating a primary cryptographic recovery key, and generating an alternate cryptographic recovery key, where the alternate cryptographic recovery key is generated and stored in a cryptographic Hardware Security Module (HSM). The method further includes storing an encrypted fallback key in metadata associated with a data set, where the encrypted fallback key is an operational key encrypted by the primary cryptographic recovery key, and storing a Recovery Key Verification Pattern (RKVP) in the metadata, where the RKVP is associated with the primary cryptographic recovery key and is stored for the primary cryptographic recovery key. In response to a determination that the operational key is unavailable, the encrypted fallback key is retrieved to perform a data decryption operation.