Abstract: A storage device includes: a control unit configured to determine, when a first command to update first data stored at a first address in a first area of a storage unit to second data is received from an external apparatus, whether or not an update from the first data to the second data is within an update restricted range. In a case where the update to the second data is not within the update restricted range, the control unit is configured to verify a signature received from the external apparatus together with the first command. In a case where a verification is success, the control unit is configured to store the second data at the first address. In a case where a verification is failure, the control unit is configured not to store the second data at the first address.

Abstract: A method is described that includes computing a first index based on a hash of a first key for a first object to be stored in a memory device, determining an availability of a first segment on the memory device corresponding to the first index, computing a second index based on the hash of the first key for the first object, in response to determining that the first segment corresponding to the first index is unavailable for storage, determining an availability of a second segment on the memory device corresponding to the second index, and adding an indicator of a location of the second segment to a collision table in a first metadata of the first segment.

Abstract: Techniques for implementing a differentially private variational autoencoder for data obfuscation are disclosed. In some embodiments, a computer system performs operations comprising: encoding input data into a latent space representation of the input data, the encoding of the input data comprising: inferring latent space parameters of a latent space distribution based on the input data, the latent space parameters comprising a mean and a standard deviation, the inferring of the latent space parameters comprising bounding the mean within a finite space and using a global value for the standard deviation, the global value being independent of the input data; and sampling data from the latent space distribution; and decoding the sampled data of the latent space representation into output data.

Abstract: The present disclosure relates to a method for autonomous management and control in a quantum key distribution network and a device therefor. A method performed by an apparatus including a first entity in a QKDN supporting AMC according to one aspect of the present disclosure may include: collecting first data from a second entity; determining whether a first ML model available for analyzing the first data exists; generating a control action, wherein i) if the first ML model exists, the control action is generated by analyzing the first data using the first ML model, and ii) if the first ML model does not exist, the control action is generated by analyzing second data collected from the second entity using a second ML model received from a third entity; and requesting the second entity to apply the control action.

Abstract: A method of rotating a set of keys, having a media encryption key (MEK) and a current media encryption key encryption key (MEKEK) encrypted and stored in a self-encrypting drive (SED) having data encrypted with the MEK (MEK(data)), includes decrypting the stored MEK and the current MEKEK. A new MEK (MEK?) and a new MEKEK (MEKEK?) are generated. The MEKEK? is encrypted to replace the current encrypted MEKEK. A concatenation of the MEK and the MEK? is encrypted with MEKEK?. The encrypted data MEK(data) is re-encrypted with MEK?.

Abstract: A key block can be generated from a session key used by a computer-based design tool for a circuit design by encrypting the session key using computer hardware. The key block can be divided, by the computer hardware, into a plurality of sub-blocks. A plurality of enhanced sub-blocks can be generated by the computer hardware by encrypting each sub-block of the plurality of sub-blocks with a different key of a plurality of keys corresponding to a plurality of Intellectual Property (IP) cores of the circuit design. The plurality of enhanced sub-blocks can be stored in a memory.

Abstract: A computer-implemented method for password recovery within an untrusted environment may include (i) deconstructing an encryption key associated with accessing a password for a target user into key components, (ii) distributing the key components to a random subset of users associated with a password manager service, (iii) authenticating recovery signal data associated with a request to recover the target user password, (iv) publishing password recovery data to a recovery signal ledger in response to the request to recover the target user password, and (v) performing a security action that utilizes the password recovery data in the recovery signal ledger to send the key components from the random subset of users to the target user for reconstructing the encryption key. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: A system includes a memory, a processor in communication with the memory, and a first TEE instance. The first TEE instance is configured to maintain an encrypted secret, obtain a cryptographic measurement associated with a second TEE instance, validate the cryptographic measurement, and provision the second TEE instance with the encrypted secret. Additionally, the first TEE instance and the second TEE instance are both configured to service at least a first type of request.

Abstract: According to one embodiment, a memory system includes a nonvolatile memory and a controller. The controller is communicable with a host and is configured to control the nonvolatile memory. The controller is configured to when receiving a key generation command from the host, generate an encryption key by an encrypting and decrypting function unit, store the encryption key in the nonvolatile memory, and transmit an identifier of the encryption key to the host.

Abstract: The cipher message data is distributed to an external device while ensuring the confidentiality of the cipher message data. A terminal device performs communication with an external device through a broker on the basis of a publish-subscribe message model. The terminal device includes: an acquisition unit that acquires external data; an encryption processing unit that encrypts at least a part of the external data to generate cipher message data including ciphertext; and a data distribution unit that distributes an encrypted publish message including topic designation data of plaintext and the cipher message data to the broker.

Abstract: Systems and methods for secure modular hardware binding in a Data Center Modular Hardware System (DC-SCM) environment are described herein. According to one embodiment, an Information Handling System (IHS) includes multiple Complex Programmable Logic Devices (CPLDs), and computer-executable logic to, for each of the CPLDs: store an encrypted secret key in a platform Root-of-Trust (RoT) and the CPLD, and receive, by the platform RoT, a request to authenticate a firmware stack installed on the CPLD. The logic may then present, by the CPLD, an encrypted secret key to the platform RoT, authenticate, by the platform RoT, the firmware stack by comparing the encrypted secret key received from the CPLD with its stored version of the encrypted secret key, and allow operation of the CPLD based on the authentication.

Abstract: A computer-implemented method (CIM), according to one approach, includes generating a primary cryptographic recovery key, and generating an alternate cryptographic recovery key, where the alternate cryptographic recovery key is generated and stored in a cryptographic Hardware Security Module (HSM). The method further includes storing an encrypted fallback key in metadata associated with a data set, where the encrypted fallback key is an operational key encrypted by the primary cryptographic recovery key, and storing a Recovery Key Verification Pattern (RKVP) in the metadata, where the RKVP is associated with the primary cryptographic recovery key and is stored for the primary cryptographic recovery key. In response to a determination that the operational key is unavailable, the encrypted fallback key is retrieved to perform a data decryption operation.

Abstract: In one aspect, in general, a system for securely providing data for training a model comprises: a source entity comprising at least one processor and configured to: receive data configuration instructions associated with training the model, transform unprepared data from one or more data sources into prepared data based at least in part on the data configuration instructions, the prepared data comprising one or more prepared data units, and produce, using a signing module, a data package comprising the one or more prepared data units and a respective signature object associated with each of the one or more prepared data units; wherein the signing module comprises specialized circuitry configured for accelerating at least one quantum resistant computational operation.

Abstract: Systems, methods and devices for implementing cryptographic and security-in-depth techniques on-board spacecrafts or satellites are provided, to allow users to task activities or retrieve satellite data from the satellite system in an anonymous, secure, safe, and private manner, such that no other user sharing the satellite system resources can know what has been tasked or transmitted to the ground. Considerable advantages can be realized by providing spacecraft or satellite systems with a substantial capacity of applying security-in-depth and cryptographic techniques and protocols to data and requests, based on autonomous tasking, allowing a secure, safe and private use of spacecraft or satellite resources.

Abstract: An apparatus in an illustrative embodiment comprises a client device configured for communication with a storage system, with the client device comprising a processor coupled to a memory. The client device is further configured to generate a data encryption key for a data item by computing a function of at least the data item, to encrypt the data item using the data encryption key for the data item, to encrypt the data encryption key using a secret key of the client device, and to send the encrypted data item and the encrypted data encryption key to the storage system for storage in the storage system. The client device is still further configured to retrieve the encrypted data item and the encrypted data encryption key from the storage system, and to perform an integrity check on the retrieved encrypted data item using a result of decrypting the retrieved encrypted data encryption key.

Abstract: A trusted computing technology is shown. An isolated memory stores a security interrupt descriptor table (SIDT) to correspond to security interrupts triggered by security peripherals. A first register of the trusted core stores a first address pointing to the SIDT. A local advanced programmable interrupt controller in the trusted core provides an interrupt arbiter that arbitrates between peripheral interrupts received from the chipset. When producing an arbitration result showing that a target interrupt is a security interrupt, the interrupt arbiter outputs a security interrupt request and a security interrupt vector to trigger the trusted core to search the SIDT indicated by the first register, to get a target security interrupt descriptor for execution of the corresponding interrupt program.

Abstract: Systems, computer program products, and methods are described herein for monitoring access to a virtual environment using device tagging. The present disclosure is configured to receive, from a user input device, a request from a user to establish a first virtual object to access a virtual environment; receive parameters associated with the first virtual object; determine device information associated with the user input device; generate a first unique key based on at least the parameters and the device information; link the user input device and the first virtual object with the first unique key; store the first unique key in a key repository; and establish the first virtual object for the user to access the virtual environment, wherein the first virtual object is established to access the virtual environment exclusively with the user input device.

Abstract: The present disclosure generally relates to digital identification credential user interfaces.

Abstract: A system includes a primary asset custody subsystem in a first cloud computing data center and a backup asset custody subsystem in a second cloud computing data center different from the first cloud computing data center. The primary subsystem includes a plurality of primary multi-party computation (MPC) clusters, where each primary MPC cluster is allocated to an asset owner and includes a primary MPC client and a plurality of primary MPC nodes. The backup subsystem includes a plurality of backup MPC clusters corresponding to the plurality of primary MPC clusters, where each backup MPC cluster is allocated to the asset owner of its corresponding primary MPC cluster and includes a backup MPC client and a plurality of backup MPC nodes. The backup MPC client sends an export public key from each backup MPC node to the primary MPC client, where each export public key is part of a corresponding export public key-export private key pair.

Abstract: Embodiments of the present disclosure may include a key generation device of a lattice-based public key cryptosystem. In some embodiments, the key generation device may include a communication unit, a storage unit, and a processor that may be configured to control the key generation device to perform operations. In some embodiments, the operations may include generating a public key by using a public key polynomial, where the public key polynomial may belong to a first polynomial ring. In some embodiments, the operations may additionally include generating a secret key that may correspond to the public key. In some embodiments, the secret key may be generated by using a secret key polynomial that may belong to a second polynomial ring. In some embodiments, the operations may additionally include storing the public key and the secret key.