Abstract: An assessment apparatus is an apparatus that assesses an assessment target device that includes physical components for executing processing appropriate to logical components. The assessment apparatus includes an input unit that acquires device information about the assessment target device; a path determiner that determines, based on the device information, a logical path including an array of one or more logical components and a physical path corresponding to the logical path and including an array of one or more physical components, the logical and physical paths being paths of access to an asset (data or a function) of the assessment target device from the outside thereof; and a risk re-assessment unit that assesses a risk value of the asset in accordance with an attack feasibility level indicating attack feasibility for the determined physical and logical paths and an influence level indicating an influence to be exerted when the asset is invaded.

Abstract: Systems, methods, and apparatuses are provided for checking an integrity of data stored in an electronic control unit of a vehicle. A first hash value is determined based on the stored data using a hash function at the electronic control unit triggered by a request of a boot loader of the electronic control unit. A second hash value is determined based on the stored data using the hash function at the electronic control unit triggered by a request of an external computing device connected to the electronic control unit. The integrity of the stored data is checked by comparing the determined first hash value to the determined second hash value.

Abstract: A technique and system provide protection to information or documents via an authorization policy that is applied to multiple application programs and authorization requests are submitted through a REST API over HTTP or HTTPS. Methods, techniques, and systems control access to protected information or documents and use of content in protected information or documents to support information management policies.

Abstract: The present disclosure is directed to monitoring internal process memory of a computer at a time with program code executes. Methods and apparatus consistent with the present disclosure monitor the operation of program code with the intent of detecting whether received program inputs may exploit vulnerabilities that may exist in the program code at runtime. By detecting suspicious activity or malicious code that may affect internal process memory at run-time, methods and apparatus described herein identify suspected malware based on suspicious actions performed as program code executes. Runtime exploit detection may detect certain anomalous activities or chain of events in a potentially vulnerable application during execution. These events may be detected using instrumentation code when a regular code execution path of an application is deviated from.

Abstract: The present disclosure provides a method for identity authentication, an electronic device and a computer readable storage medium. The method for identity authentication may include: acquiring an identity proof of a user, wherein the identity proof comprises an identity attribute of the user and a Merkel root verification path, and the Merkel root verification path in the identity proof is a verification path obtained when the identity proof is generated and based on the identity attribute selected by the user to be disclosed; deducing the Merkel root verification path according to the identity attribute disclosed in the identity proof; and authenticating the identity proof of the user according to the deduced verification path and a verification path in the identity proof.

Abstract: Systems, methods and non-transitory computer readable media for controlling access in privacy firewalls are provided. A request to access a content of an element may be received. The content of the element may include a first portion and a second portion. The first portion may include identifiable information and the second portion may include no identifiable information. A permission record corresponding to the element may be accessed. Based on a value in the permission record, full, partial or no access to the content of the element may be provided. Full access may include access to the first portion and the second portion of the content of the element. Partial access may include access to the second portion of the content of the element and excludes access to the first portion of the content of the element.

Abstract: A method for checking data integrity when data are being transmitted in a vehicle. The method includes carrying out the following steps automatically: ascertaining the data at the vehicle; carrying out a preparation for the transmission of the ascertained data, in which at least one artificially generated and reproducible substitute portion is defined as an approximation of a data portion of the data by means of a piece of substitute information; carrying out the transmission of the data; carrying out the data integrity check on the transmitted data using the substitute information.

Abstract: There is provided a framework to record to a blockchain unique identification (signatures) of physical items which have unique, random properties. Physical items are analysed using spectral imaging to determine the unique identifications. Hardware is shown to perform the analysis and various nodes of a peer-to-peer network are shown and described, which nodes may be configured to provide proof of location, privacy, trust and authentication. The solution can work even if the item is modified in some way if a subset of the unique properties remain.

Abstract: This application provides a method and an apparatus for editing a block chain. The method for editing a block chain includes: A first node receives a request message used to request to edit data, and performs endorsement on the request message to generate an endorsement result. Further, the first node sends the endorsement result to each of at least one second node, where the at least one second node belongs to a second node set. The node with the endorsement function in the block chain performs endorsement on an editing request, and sends an endorsement result to a node with an editing function, to implement block chain editing while improving security assurance.

Abstract: The present disclosure relates to systems, non-transitory computer-readable media, and methods for utilizing a reinforcement fine-tuning pipeline to fine tune an agent machine learning (ML) model utilizing user-defined grader endpoints and/or external tools with a multi-layer security architecture. For example, the disclosed systems can utilize a multi-layer security architecture to filter incoming training datasets, perform content refusal checks, chain-of-thought leak detections, and/or governance oversights prior to training the agent ML model, during active training of the agent ML model using external tools and/or grader models, and/or during post-training of the agent ML model (prior to releasing a fine-tuned snapshot of the model).

Abstract: Systems and methods are disclosed herein for determining reachability of vulnerable code. In some embodiments, a tool receives an alert of a vulnerability within an application, and determines a set of dependent packages by referencing a knowledge graph. For each vulnerable node of the dependency chain having the vulnerability, the tool identifies a set of node pairs having a direct link between an upstream node and the vulnerable node, determines whether the vulnerable node is reachable by each upstream node of the set of upstream nodes, and annotates links for unreachable nodes. For upstream nodes that are able to reach the vulnerable node, the tool iteratively determines whether a respective further upstream node is able to reach respective ones of their respective directly connected downstream nodes. The tool generates a pruned dependency chain by determining a boundary of the dependency chain, separating reachable vulnerable nodes from unreachable vulnerable nodes.

Abstract: A method of rescinding access to a designated block within a blockchain, wherein the designated block contains data encrypted with a content encryption key and is associated with metadata, wherein the metadata for the designated block include an obsolescence lock public key. The method includes creating, at the time the designated block is created, an obsolescence lock for supporting a rescission request if the rescission request is agreed upon by a required number of authorized parties for the designated block; splitting the obsolescence lock private key into a number of secret shares; and upon receiving particular rescission instruction block, an agreement instruction block and a confirmation instruction block, removing all encrypted content encryption keys from the metadata of the designated block, thereby rescinding access to the original data within the designated block. An equivalent method is presented to rescind access to a blockchain.

Abstract: A system and method for authenticating a user device is disclosed. In one embodiment, the method comprises: transmitting a request for credentials from the user device, wherein the request comprises a user device identifier and the credentials comprise an asymmetric key pair having a public key and an associated private key, the private key being encrypted; receiving the credentials in the user device, the credentials comprising the encrypted private key and the public key; retrieving quick response (QR) code data associated with the user device identifier from a QR code data directory, the QR code data generated from the public key and stored in the QR code data directory according to the user device identifier by a secure online service; extracting the public key from the QR code data; and establishing an authenticated and encrypted communication session with the user device according to the extracted public key.

Abstract: A computer-implemented method of generating a respective signature share of a digital signature for signing a message, wherein the method is performed by a first participant of the group and comprises: obtaining at least the threshold number of respective participant indexes, wherein the obtained respective participant indexes comprises a first participant index associated with the first participant; generating a private key index, wherein the private key index is generated based on a hash of a combination of the obtained respective participant indexes; generating a second common private key of the first hierarchical key structure; and generating a first signature share of the digital signature.

Abstract: A system for implementing security measures to a data packet is disclosed. The system assigns each computing device with a respective encryption key. A first computing device encrypts the data packet with a first encryption key upon creation and/or before transmission. The first computing device encodes the data packet with a quantum encryption key and communicates the encoded data packet to a second computing device. The second computing device determines whether the data packet is received without being intercepted. In response to determining that the data packet is received without being intercepted, the second computing device decrypts the data packet.

Abstract: Systems, methods, and other embodiments described herein relate to remote attestation using a homomorphic hash. In one embodiment, a method includes identifying software components and associated metrics of the software components executing within a computing system of a vehicle according to a policy. The method includes constructing a tree according to the software components and partitions within the software components. The method includes storing, in leaf nodes of the tree, measurements of the metrics. The parent nodes define a hierarchical relationship between software components and the partitions. The method includes generating an incremental hash of the tree. The method includes providing the incremental hash as a secure representation of the software components.

Abstract: The present invention provides a mobile device management and control method and apparatus. The method includes the following steps: A web end operates a policy form, and sends policy form data obtained after the operation is completed to a server for processing and generating a policy form code; and a mobile terminal requests to obtain the policy form code from the server, and sends a unique identifier of the mobile terminal and the policy form code to the server for processing and generating a unique identifier. In the present invention, encoded data is exchanged between the mobile terminal and the server at intervals, which resolves a problem that when the mobile terminal is managed and controlled, when the network fluctuates or the mobile terminal stays in an always-on display state for a long time, a connection is broken.

Abstract: Combining allowlist and blocklist support in data queries includes performing operations including obtaining a runtime query and extracting a set of runtime tuples from the runtime query. The operations further include processing the set of runtime tuples by an allowlist semantic comparator comparing the set of runtime tuples with an allowlist to obtain a first comparison result and by a blocklist semantic comparator comparing the set of runtime tuples with a blocklist to obtain a second comparison result. The blocklist semantic comparator performs an inverse comparison of the allowlist semantic comparator. The operations further include combining the first comparison result with the second comparison to form an access determination and executing the runtime query according to the access determination.

Abstract: A device management method, system, and apparatus are disclosed. The method includes: A second device sends an identity file to a first access control node, to indicate the first access control node to store the identity file in a file system, where the identity file includes identity information of a first device and a public key of the second device. The second device receives a first identifier sent by the first access control node. The first identifier is used to read the identity file from the file system. After verification is performed on the second device and information about a device associated with the first device in association information and succeeds, the first access control node sends the identity file to the file system. The association information is stored in a database node and a blockchain.

Abstract: Disclosed herein are techniques for managing activity logs in a manner that promotes user privacy. One technique can by implemented by a centralized management hub, and include the steps of (1) receiving, from a peripheral device, information about activity detected by the peripheral device, where the information includes at least one activity tag, (2) identifying a hash function, (3) providing the at least one activity tag to the hash function to generate at least one hash value, (4) encrypting, using an encryption key that is accessible to the centralized management hub, at least a subset of the information to produce encrypted information, and (5) causing a server device to store, in an activity log associated with the centralized management hub, an activity log entry that includes: a timestamp corresponding to a time at which the activity log entry is stored, the at least one hash value, and the encrypted information.