Abstract: A system includes a memory, a processor in communication with the memory, and a first TEE instance. The first TEE instance is configured to maintain an encrypted secret, obtain a cryptographic measurement associated with a second TEE instance, validate the cryptographic measurement, and provision the second TEE instance with the encrypted secret. Additionally, the first TEE instance and the second TEE instance are both configured to service at least a first type of request.

Abstract: According to one embodiment, a memory system includes a nonvolatile memory and a controller. The controller is communicable with a host and is configured to control the nonvolatile memory. The controller is configured to when receiving a key generation command from the host, generate an encryption key by an encrypting and decrypting function unit, store the encryption key in the nonvolatile memory, and transmit an identifier of the encryption key to the host.

Abstract: The cipher message data is distributed to an external device while ensuring the confidentiality of the cipher message data. A terminal device performs communication with an external device through a broker on the basis of a publish-subscribe message model. The terminal device includes: an acquisition unit that acquires external data; an encryption processing unit that encrypts at least a part of the external data to generate cipher message data including ciphertext; and a data distribution unit that distributes an encrypted publish message including topic designation data of plaintext and the cipher message data to the broker.

Abstract: Systems and methods for secure modular hardware binding in a Data Center Modular Hardware System (DC-SCM) environment are described herein. According to one embodiment, an Information Handling System (IHS) includes multiple Complex Programmable Logic Devices (CPLDs), and computer-executable logic to, for each of the CPLDs: store an encrypted secret key in a platform Root-of-Trust (RoT) and the CPLD, and receive, by the platform RoT, a request to authenticate a firmware stack installed on the CPLD. The logic may then present, by the CPLD, an encrypted secret key to the platform RoT, authenticate, by the platform RoT, the firmware stack by comparing the encrypted secret key received from the CPLD with its stored version of the encrypted secret key, and allow operation of the CPLD based on the authentication.

Abstract: A computer-implemented method (CIM), according to one approach, includes generating a primary cryptographic recovery key, and generating an alternate cryptographic recovery key, where the alternate cryptographic recovery key is generated and stored in a cryptographic Hardware Security Module (HSM). The method further includes storing an encrypted fallback key in metadata associated with a data set, where the encrypted fallback key is an operational key encrypted by the primary cryptographic recovery key, and storing a Recovery Key Verification Pattern (RKVP) in the metadata, where the RKVP is associated with the primary cryptographic recovery key and is stored for the primary cryptographic recovery key. In response to a determination that the operational key is unavailable, the encrypted fallback key is retrieved to perform a data decryption operation.

Abstract: In one aspect, in general, a system for securely providing data for training a model comprises: a source entity comprising at least one processor and configured to: receive data configuration instructions associated with training the model, transform unprepared data from one or more data sources into prepared data based at least in part on the data configuration instructions, the prepared data comprising one or more prepared data units, and produce, using a signing module, a data package comprising the one or more prepared data units and a respective signature object associated with each of the one or more prepared data units; wherein the signing module comprises specialized circuitry configured for accelerating at least one quantum resistant computational operation.

Abstract: Systems, methods and devices for implementing cryptographic and security-in-depth techniques on-board spacecrafts or satellites are provided, to allow users to task activities or retrieve satellite data from the satellite system in an anonymous, secure, safe, and private manner, such that no other user sharing the satellite system resources can know what has been tasked or transmitted to the ground. Considerable advantages can be realized by providing spacecraft or satellite systems with a substantial capacity of applying security-in-depth and cryptographic techniques and protocols to data and requests, based on autonomous tasking, allowing a secure, safe and private use of spacecraft or satellite resources.

Abstract: An apparatus in an illustrative embodiment comprises a client device configured for communication with a storage system, with the client device comprising a processor coupled to a memory. The client device is further configured to generate a data encryption key for a data item by computing a function of at least the data item, to encrypt the data item using the data encryption key for the data item, to encrypt the data encryption key using a secret key of the client device, and to send the encrypted data item and the encrypted data encryption key to the storage system for storage in the storage system. The client device is still further configured to retrieve the encrypted data item and the encrypted data encryption key from the storage system, and to perform an integrity check on the retrieved encrypted data item using a result of decrypting the retrieved encrypted data encryption key.

Abstract: A trusted computing technology is shown. An isolated memory stores a security interrupt descriptor table (SIDT) to correspond to security interrupts triggered by security peripherals. A first register of the trusted core stores a first address pointing to the SIDT. A local advanced programmable interrupt controller in the trusted core provides an interrupt arbiter that arbitrates between peripheral interrupts received from the chipset. When producing an arbitration result showing that a target interrupt is a security interrupt, the interrupt arbiter outputs a security interrupt request and a security interrupt vector to trigger the trusted core to search the SIDT indicated by the first register, to get a target security interrupt descriptor for execution of the corresponding interrupt program.

Abstract: Systems, computer program products, and methods are described herein for monitoring access to a virtual environment using device tagging. The present disclosure is configured to receive, from a user input device, a request from a user to establish a first virtual object to access a virtual environment; receive parameters associated with the first virtual object; determine device information associated with the user input device; generate a first unique key based on at least the parameters and the device information; link the user input device and the first virtual object with the first unique key; store the first unique key in a key repository; and establish the first virtual object for the user to access the virtual environment, wherein the first virtual object is established to access the virtual environment exclusively with the user input device.

Abstract: The present disclosure generally relates to digital identification credential user interfaces.

Abstract: A system includes a primary asset custody subsystem in a first cloud computing data center and a backup asset custody subsystem in a second cloud computing data center different from the first cloud computing data center. The primary subsystem includes a plurality of primary multi-party computation (MPC) clusters, where each primary MPC cluster is allocated to an asset owner and includes a primary MPC client and a plurality of primary MPC nodes. The backup subsystem includes a plurality of backup MPC clusters corresponding to the plurality of primary MPC clusters, where each backup MPC cluster is allocated to the asset owner of its corresponding primary MPC cluster and includes a backup MPC client and a plurality of backup MPC nodes. The backup MPC client sends an export public key from each backup MPC node to the primary MPC client, where each export public key is part of a corresponding export public key-export private key pair.

Abstract: Embodiments of the present disclosure may include a key generation device of a lattice-based public key cryptosystem. In some embodiments, the key generation device may include a communication unit, a storage unit, and a processor that may be configured to control the key generation device to perform operations. In some embodiments, the operations may include generating a public key by using a public key polynomial, where the public key polynomial may belong to a first polynomial ring. In some embodiments, the operations may additionally include generating a secret key that may correspond to the public key. In some embodiments, the secret key may be generated by using a secret key polynomial that may belong to a second polynomial ring. In some embodiments, the operations may additionally include storing the public key and the secret key.

Abstract: A method, a network device, and a non-transitory computer-readable storage medium are described in relation to a multifaceted detection of fraudulent data usage service. The multifaceted detection of fraudulent data usage service may apply fraudulent detection to multiple facets of network usage including end device identifier analysis, end device registration analysis, traffic analysis, and end device examination analysis. The multifaceted detection of fraudulent data usage service may include weightings and scoring associated with the examinations.

Abstract: A computer for an aircraft includes a dock part installed fixedly in the aircraft: configured so as to be connected to at least one avionics equipment by way of a bidirectional data bus, comprising a docking station, a server part installed removably on the docking station of the dock part, configured so as to exchange data and signals with the dock part through a connector, and configured so as to be connected to at least one non-avionics equipment through at least one communications link, the dock part being configured so as to implement a pairing mechanism with the server part in order to authorize or prevent the transmission of data between the server part and said at least one avionics equipment.

Abstract: An apparatus comprising a network interface card (NIC), including packet processing circuitry to determine whether the NIC is to operate according to a first telemetry protection mode to prevent copying of packet data payloads for telemetry or a second telemetry protection mode to enable copying of packet payloads for telemetry.

Abstract: Provided are systems, software, and methods for phishing analysis and detection. The provided systems, software, and methods may comprise interfaces configured to capture and scan network session activity in real-time to detect a phishing attack using a set of trained machine learning classifiers, detect a phishing attach, classify the attack into one or more phishing classes, block the phishing attack and provide a safe preview of the blocked phishing attack. The machine learning classifiers may be deployed remotely. The systems, software, and methods may further comprise a web application programing interface configured to integrate the one or more analysis interfaces into at least one external software or application.

Abstract: A method, in a server, for exchanging cryptographic keys for quantum-secure communication between the server and a client. The method includes: receiving a request message for a secure communication channel from a client, including at least one quantum-secure public ephemeral key and a first secret text; decapsulating the first secret text with a decapsulation function using a quantum-secure secret static key of the server, including generating a first secret; encapsulating the quantum-secure public ephemeral key with an encapsulation function including generating a second secret text and a second shared secret; encapsulating a quantum-secure public static key of the client using the encapsulation function, including generating a third secret text and a third shared secret; generating symmetric keys using at least the first, second, and third secrets; and sending a response message to the client, including the second and third secret texts.

Abstract: A device may receive input key material, and may process the input key material, with a trained generative adversarial network (GAN) model, to generate an encryption key with a maximized entropy. The trained GAN model may include a key generator network model trained to generate encryption keys that generalize key derivation functions with higher entropy to enhance cryptographic security, and a key discriminator network model trained to predict authenticities of the encryption keys generated by the key generator network model. The device may perform one or more actions based on the encryption key.

Abstract: An access control method and a communications device are provided. The method includes: sending first information and/or first indication information to a first target end, where the first information includes at least one of the following: index information of a second authentication server, vendor-related information of the first communications device, and address-related information of the second authentication server; and the first indication information is used for requesting to obtain a credential related to a first network, or used to indicate that an access type is a restricted service.