Abstract: Embodiments described herein provide techniques for securely validating firmware on a device using keys and providing a mechanism for deprecating such keys when a traditional certificate authority is unavailable or otherwise cannot be used. When a first firmware package is installed on the device, a first public key in a first secure memory key location is associated with an active status. Responsive to installation of a second firmware package on the device, a second public key in a second secure memory key location on the device is associated with an active status. During a boot-up operation on the device, embodiments determine to use the second public key to validate the second firmware package by starting at a predefined secure memory key location and scanning backwards until a status of active is identified. The second firmware package on the device is then validated using the second public key.

Abstract: Communication of dynamically analyzed malware is mediated. Even in a case where communication with the attacker server is stopped, a response accumulated as past data is returned to continue dynamic analysis.

Abstract: In some embodiments, the present disclosure provides an exemplary system and method that may include steps of identifying a device capable of processing a data stream; calculating a plurality of hash keys for a plurality of monitored segmentations associated with the device capable of the data stream; generating an increment data counter that corresponds to each hash key in a plurality of counting structures; calculating an anomaly score associated for the plurality of monitored segmentations; selecting a monitored segmentation based on the anomaly score; determining that a selected monitored segmentation meets a predetermined threshold associated with the anomaly score; and automatically marking the device capable of the data stream with a pre-generated label.

Abstract: PKI Certificates are fingerprinted bi-directionally, replacing traditional certificate exchange in constrained computing and networking environments during a D/TLS session initiation for faster logon to well acquainted peers. Fingerprinting PKI Certificates bi-directionally allows for certificate compression when one or both peers are unacquainted and use of OCSP stapling or OCSP trusted responders offloading validation to robust clusters. A handshake is described for certificate exchange in an OCSP stapling or OSCP with trusted responder environment, and where the network and clients are constrained, which address the deficiencies of the RFC's.

Abstract: Systems and processes are described for establishing and using a secure channel. A shared secret may be used for authentication of session initiation messages as well as for generation of a private/public key pair for the session. A number of ways of agreeing on the shared secret are described and include pre-sharing the keys, reliance on a key management system, or via a token mechanism that uses a third entity such as a hub to manage authentication, for example. In some instances, the third party may also perform endpoint selection (e.g., load balancing) by providing a particular endpoint along with the token.

Abstract: There is provided a method for implementing a zero trust role-based microsegmentation based on a network switch. The method includes steps of: (a) registering, by a network controller, the specific network device in a specific segment among preset segments by referring to asset information corresponding to the specific network device; and (b) transmitting, by the network controller, a specific segment ID corresponding to the specific segment to the access switch, to thereby instruct the access switch to assign the specific segment ID as metadata to a specific MAC address of the specific network device by using VACL, and control an access of the specific network device to the network resources based on at least one specific resource access control rule corresponding to the specific segment ID by using IACL.

Abstract: The present disclosure provides an information processing apparatus that enables updating of a key for program verification without invalidating a program verification function. An information processing apparatus 1 that calculates a verification value using a key for program verification and that verifies whether the verification value matches a verification expected value stored in advance. The information processing apparatus 1 includes: a key updating control unit 12 that updates the key; a storage unit 100 that stores in advance a verification expected value corresponding to a key updated by the key updating control unit 12; and a verification expected value changing unit 13 that when a verification value calculated based on the updated key is verified, changes the verification expected value in the storage unit, the verification expected value being referred to for verification, to a verification value corresponding to the updated key.

Abstract: Systems and techniques for cryptographically protecting data in a computer memory are disclosed. The techniques include dividing the data into a first portion and a second portion, encrypting the first portion of the data to create a first stored form of the data, encrypting the second portion of the data, and storing, in the computer memory, the first stored form of the data and a second stored form of the data. The techniques include, to encrypt the second portion, calculating a hash based on the first stored form of the data, applying a first pseudorandom function to the hash to obtain a bit sequence, and combining the bit sequence with the second portion of the data to obtain the second stored form of the data.

Abstract: Methods for the encoding an encryption key for secure storage are disclosed. The methods rely on the use of unclonable, one-way functions, such as images of biological objects that may be measured according to challenges to result in responses. A biometric print of a biological object is measured with a set of n challenges resulting in n responses. The responses are an ordered sequence, with each response having a fixed position in the sequence. A key is generated of bit length n. A subset of m responses in the full set of n responses is selected, where the selected responses correspond to positions of is in the key. The response subset is stored. The key is then used, and deleted. A party wishing to re-generate the key generates the same set of challenges, measures the same biological object with the challenges a second time, and generates a second set of n responses.

Abstract: Systems and methods for conducting composable quantum oblivious transfer over noisy quantum channels are disclosed. Embodiments provide a method for constructing a quantum oblivious transfer (QOT) protocol using noisy quantum channels and devices through the use of a quantum-hard one-way function. This construction allows the construction of QOT protocols that achieve simulator security, allowing them to be used in a black-box fashion as part of other cryptographic constructions, including arbitrary secure multiparty computations.

Abstract: An apparatus comprises instruction decoding circuitry to decode a cryptographic hash instruction specifying at least one working operand and an input operand; and processing circuitry to perform, in response to decoding of the cryptographic hash instruction, two or more iterations of a cryptographic hash function. Each iteration of the cryptographic hash function comprises determining an updated value for the at least one working operand based on a previous value for the at least one working operand and a respective portion of the input operand selected to be processed in that iteration. The updated value for the at least one working operand in one iteration becoming the previous value for the at least one working operand in a next iteration. In response to decoding of the cryptographic hash instruction, the processing circuitry performs at least two iterations of the cryptographic hash function per processing cycle.

Abstract: Clear text passcodes are recovered from hashed versions of passcodes in a computational efficient and privacy preserving manner. A service provider computes an initial hash of clear text passcodes in a wordlist, computes a subsequent hash on top of the initial hash, and groups or bins the clear text passcodes based on a portion (e.g., prefix) of their subsequent hashes. A client computes a subsequent hash of a hashed passcode to be cracked, and sends a request specifying a portion of the subsequent hash to the service provider. The service provider returns a set of clear text passcodes whose hash of a hash has a match with the specified portion. The client locally computes the initial hash of clear text passcodes in the returned set, and determines if any of the resulting hashes match the hashed passcode to be cracked, and if so the passcode is considered cracked.

Abstract: Embodiments provide a method executed by a secure remote direct memory (RDMA) system. The method includes detecting, by the secure RDMA system, a connection request to create an encrypted connection between a first computing device and a second computing device. An encryption key is shared between the first computing device and the second computing device. In response to sharing the encryption key, accessing a plurality of images of a plurality of memories of the second computing device. The plurality of images of the plurality of memories includes memory addresses. The method includes receiving an access request specifying a range of memory addresses from the first computing device based on accessing the plurality of images of the plurality of memories. The method includes creating an encrypted tunnel between the first computing device and the second computing device to share memory information based on the range of memory addresses of the plurality of memories, in response to the access request.

Abstract: Systems and methods for automatic redaction of sensitive information from video streams are disclosed. According to one embodiment, a method for automatic redaction of sensitive information from video streams may include: (1) receiving, by an image processing computer program executed by an electronic device, a video stream of an area; (2) identifying, by the image processing computer program, an object capable of having sensitive information thereon in the video stream of the area; and (3) redacting or obscuring, by the image processing computer program, the object in the video stream.

Abstract: A method includes operating an activation agent to access a clock value and at least one original object. The activation agent communicates said clock value and said at least one original object to an object activation service. The object activation service is operated to generate keying information and expiration criteria for the at least one original object. The keying information includes a clock offset and an async reset value. The object activation service communicates the keying information and the expiration criteria to the activation agent.

Abstract: The solution presented herein relates to a method for generating, providing and exchanging a trusted electronic record or certificate based on an electronic document relating to a user, comprising the steps of: Providing the document comprising information relating to the user in an electronic format; contacting a blockchain held in a network by the user, the blockchain including a smart contract established and programmed to (i) check whether the document proves the user's compliance with a restriction; (ii) verifying fulfillment/non-fulfillment of the restriction by means of the smart contract; (iii) computing a proof by means of the smart contract, and generating a certificate of the proof by means of the smart contract using a cryptographic function; and (iv) sending the certificate and the proof by the smart contract to the user.

Abstract: A logic circuitry package includes a logic circuit and an interface to communicate with a host logic circuit. The logic circuit includes a memory arrangement storing an asymmetric key, and/or a certificate corresponding to the asymmetric key. The logic circuit is configured to transmit, to the host logic circuit, the certificate; receive, from the host logic circuit, a static signature request comprising challenge data; and/or, transmit, to the host logic circuit, a signature computed based on the challenge data and the asymmetric key in response to the static signature request.

Abstract: Methods, systems, and devices for discounting extensibility latency are described. A software platform may identify a first time period of a campaign to certify access to one or more resources for a plurality of users. The software platform may determine, for each user of the multiple of users, one or more criteria associated with the campaign that are satisfied by respective information associated with each user. The software platform may select, for each user of the multiple users, a reviewer to certify access to the one or more resources for a respective user based on the one or more criteria.

Abstract: A method for provisioning a microelectronic (ME) component or device for non-bypassable, unclonable electronic device fingerprinting includes receiving an initialization vector from a provisioning device. A physically unclonable function (PUF) incorporated into the ME device (and unique to that ME device) provides a unique device bitstream. The device bitstream and initialization vector are cryptographically hashed to generate an electronic device fingerprint recordable to non-volatile memory onboard the ME device, which can be used for subsequent verification that the ME device is not counterfeited or compromised.

Abstract: A hash value computation device (10) computes a hash value H of 2n bits using a block cipher E that takes as input a key K of k bits and a plaintext block P of n bits, which is a smaller number of bits than k bits, and outputs a ciphertext of n bits. A function computation unit (22) computes a function CF that processes the block cipher E a plurality of times sequentially on an input value M* of k?n bits, an input value S[1] of n bits, and an input value S[2] of n bits so as to compute an output value S?[1] of n bits and an output value S?[2] of n bits. A hash value computation unit (23) computes the hash value H from the output value S?[1] and the output value S?[2].