Abstract: This disclosure describes a secure tunneling mechanism with DoS mitigation operating in a VPN-based mesh network. The mechanism uses a combination of static and temporal cookies to enable a server to identify peers while still retaining anonymity, and without requiring the server to perform expensive asymmetric cryptography (D-H) operations. In this approach, peers are identifiable by just performing hashes and using symmetric cryptography. The mechanism implements a generalized method of packet handling that provides for data scattering and gathering, thereby enabling encrypted frames conforming to a packet format and communicated by a peer to be spread across multiple physical packets both during a handshake, as well as during the exchange of data (between peers) during the session.

Abstract: Embodiments of this application provide a message processing method and apparatus, and an electronic device. The method is applied to a terminal device, and the method includes: receiving a first message; and pulling up a first application when the first message is a reassembly message, so that the first application performs message reassembly on the first message, including: reading, by the first application, message reassembly configuration information, and performing a message reassembly operation on the first message based on the message reassembly configuration information, to generate a second message. According to the method in the embodiments of this application, after a pushed message is received, the first application is pulled up to reassemble the message, so as to improve user experience of message display.

Abstract: A node on a blockchain network, includes: a memory that stores asset related data including information on an owner of an asset, and contract related data including a transaction price of the asset or a ratio corresponding to the price of the asset; and circuitry to transmit the asset related data and the contract related data to one or more other nodes on the blockchain network to share the asset related data and the contract related data.

Abstract: Techniques for data security are provided. Face data for a patient is received, where the face data is linked to an identifier of the patient. A suggested medical device is determined by processing the face data using a recommendation model. Therapy data stored in a first data store and equipment data stored in a second data store are identified based on the identifier, where the equipment data indicates an actual medical device that was provided to the patient. The suggested medical device, the therapy data, and the equipment data are associated.

Abstract: A data communication system includes a center device that distributes update data to a master device, and a master device that installs the update data downloaded from the center device in an electronic control unit to be reprogrammed. The center device generates a common key for encrypting the update data; encrypts the update data with the common key; encrypts the common key; stores the common key encrypted in a campaign notification; places the update data encrypted with the common key in a content delivery network (CDN); and transmits the campaign notification. The master device acquires the common key from the campaign notification; decrypts the encrypted common key to extract the common key; downloads and acquires encrypted update data from the CDN; performs an exclusive OR operation; and transfers the decrypted update data to the electronic control unit, and installs the update data in the electronic control unit.

Abstract: In a blockchain data processing method, service updating data of each of a plurality of encrypted data is received. The service updating data of each of the plurality of encrypted data includes encrypted primary key information of the respective encrypted data. Each of the plurality of encrypted data includes service data encrypted by a respective service node of a plurality of service nodes. Service intersection data is generated based on a data intersection of the service updating data of the plurality of encrypted data. The service intersection data is transmitted to a service node of the plurality of service nodes. The service intersection data includes supplemental text data from another service node of the plurality of service nodes.

Abstract: A processing device is configured to detect potential encryption downgrades in network communications. The processing device accesses network traffic and detects an attempted first connection between a first entity and a second entity in which the first entity offered at least one post-quantum cryptography (PQC) algorithm to encrypt the attempted first connection. The method detects that the attempted first connection failed, and that a second connection between the first entity and the second entity successfully completed without a PQC algorithm, within a threshold time after the attempted first connection. The processing device identifies this second detection as a downgrade attack and performs a remedial action.

Abstract: Embodiments described herein provide techniques for securely validating firmware on a device using keys and providing a mechanism for deprecating such keys when a traditional certificate authority is unavailable or otherwise cannot be used. When a first firmware package is installed on the device, a first public key in a first secure memory key location is associated with an active status. Responsive to installation of a second firmware package on the device, a second public key in a second secure memory key location on the device is associated with an active status. During a boot-up operation on the device, embodiments determine to use the second public key to validate the second firmware package by starting at a predefined secure memory key location and scanning backwards until a status of active is identified. The second firmware package on the device is then validated using the second public key.

Abstract: Communication of dynamically analyzed malware is mediated. Even in a case where communication with the attacker server is stopped, a response accumulated as past data is returned to continue dynamic analysis.

Abstract: In some embodiments, the present disclosure provides an exemplary system and method that may include steps of identifying a device capable of processing a data stream; calculating a plurality of hash keys for a plurality of monitored segmentations associated with the device capable of the data stream; generating an increment data counter that corresponds to each hash key in a plurality of counting structures; calculating an anomaly score associated for the plurality of monitored segmentations; selecting a monitored segmentation based on the anomaly score; determining that a selected monitored segmentation meets a predetermined threshold associated with the anomaly score; and automatically marking the device capable of the data stream with a pre-generated label.

Abstract: PKI Certificates are fingerprinted bi-directionally, replacing traditional certificate exchange in constrained computing and networking environments during a D/TLS session initiation for faster logon to well acquainted peers. Fingerprinting PKI Certificates bi-directionally allows for certificate compression when one or both peers are unacquainted and use of OCSP stapling or OCSP trusted responders offloading validation to robust clusters. A handshake is described for certificate exchange in an OCSP stapling or OSCP with trusted responder environment, and where the network and clients are constrained, which address the deficiencies of the RFC's.

Abstract: Systems and processes are described for establishing and using a secure channel. A shared secret may be used for authentication of session initiation messages as well as for generation of a private/public key pair for the session. A number of ways of agreeing on the shared secret are described and include pre-sharing the keys, reliance on a key management system, or via a token mechanism that uses a third entity such as a hub to manage authentication, for example. In some instances, the third party may also perform endpoint selection (e.g., load balancing) by providing a particular endpoint along with the token.

Abstract: There is provided a method for implementing a zero trust role-based microsegmentation based on a network switch. The method includes steps of: (a) registering, by a network controller, the specific network device in a specific segment among preset segments by referring to asset information corresponding to the specific network device; and (b) transmitting, by the network controller, a specific segment ID corresponding to the specific segment to the access switch, to thereby instruct the access switch to assign the specific segment ID as metadata to a specific MAC address of the specific network device by using VACL, and control an access of the specific network device to the network resources based on at least one specific resource access control rule corresponding to the specific segment ID by using IACL.

Abstract: The present disclosure provides an information processing apparatus that enables updating of a key for program verification without invalidating a program verification function. An information processing apparatus 1 that calculates a verification value using a key for program verification and that verifies whether the verification value matches a verification expected value stored in advance. The information processing apparatus 1 includes: a key updating control unit 12 that updates the key; a storage unit 100 that stores in advance a verification expected value corresponding to a key updated by the key updating control unit 12; and a verification expected value changing unit 13 that when a verification value calculated based on the updated key is verified, changes the verification expected value in the storage unit, the verification expected value being referred to for verification, to a verification value corresponding to the updated key.

Abstract: Systems and techniques for cryptographically protecting data in a computer memory are disclosed. The techniques include dividing the data into a first portion and a second portion, encrypting the first portion of the data to create a first stored form of the data, encrypting the second portion of the data, and storing, in the computer memory, the first stored form of the data and a second stored form of the data. The techniques include, to encrypt the second portion, calculating a hash based on the first stored form of the data, applying a first pseudorandom function to the hash to obtain a bit sequence, and combining the bit sequence with the second portion of the data to obtain the second stored form of the data.

Abstract: Methods for the encoding an encryption key for secure storage are disclosed. The methods rely on the use of unclonable, one-way functions, such as images of biological objects that may be measured according to challenges to result in responses. A biometric print of a biological object is measured with a set of n challenges resulting in n responses. The responses are an ordered sequence, with each response having a fixed position in the sequence. A key is generated of bit length n. A subset of m responses in the full set of n responses is selected, where the selected responses correspond to positions of is in the key. The response subset is stored. The key is then used, and deleted. A party wishing to re-generate the key generates the same set of challenges, measures the same biological object with the challenges a second time, and generates a second set of n responses.

Abstract: Systems and methods for conducting composable quantum oblivious transfer over noisy quantum channels are disclosed. Embodiments provide a method for constructing a quantum oblivious transfer (QOT) protocol using noisy quantum channels and devices through the use of a quantum-hard one-way function. This construction allows the construction of QOT protocols that achieve simulator security, allowing them to be used in a black-box fashion as part of other cryptographic constructions, including arbitrary secure multiparty computations.

Abstract: An apparatus comprises instruction decoding circuitry to decode a cryptographic hash instruction specifying at least one working operand and an input operand; and processing circuitry to perform, in response to decoding of the cryptographic hash instruction, two or more iterations of a cryptographic hash function. Each iteration of the cryptographic hash function comprises determining an updated value for the at least one working operand based on a previous value for the at least one working operand and a respective portion of the input operand selected to be processed in that iteration. The updated value for the at least one working operand in one iteration becoming the previous value for the at least one working operand in a next iteration. In response to decoding of the cryptographic hash instruction, the processing circuitry performs at least two iterations of the cryptographic hash function per processing cycle.

Abstract: Clear text passcodes are recovered from hashed versions of passcodes in a computational efficient and privacy preserving manner. A service provider computes an initial hash of clear text passcodes in a wordlist, computes a subsequent hash on top of the initial hash, and groups or bins the clear text passcodes based on a portion (e.g., prefix) of their subsequent hashes. A client computes a subsequent hash of a hashed passcode to be cracked, and sends a request specifying a portion of the subsequent hash to the service provider. The service provider returns a set of clear text passcodes whose hash of a hash has a match with the specified portion. The client locally computes the initial hash of clear text passcodes in the returned set, and determines if any of the resulting hashes match the hashed passcode to be cracked, and if so the passcode is considered cracked.

Abstract: Embodiments provide a method executed by a secure remote direct memory (RDMA) system. The method includes detecting, by the secure RDMA system, a connection request to create an encrypted connection between a first computing device and a second computing device. An encryption key is shared between the first computing device and the second computing device. In response to sharing the encryption key, accessing a plurality of images of a plurality of memories of the second computing device. The plurality of images of the plurality of memories includes memory addresses. The method includes receiving an access request specifying a range of memory addresses from the first computing device based on accessing the plurality of images of the plurality of memories. The method includes creating an encrypted tunnel between the first computing device and the second computing device to share memory information based on the range of memory addresses of the plurality of memories, in response to the access request.