Abstract: A method of providing at least one communications service provider a connection to an Internet Protocol, IP, server in a perimeter network, the IP server providing a service over a public IP network, the method comprising the steps of detecting, in the perimeter network, an irregularity in IP traffic arriving at the perimeter network over the public IP network, disregarding, in the perimeter network, IP traffic arriving at the perimeter network over the public IP network, and enabling, in the perimeter network, a connection between the IP server and the at least one communications service provider for the service provided by the IP server over at least one private IP network.

Abstract: There is provided a system (1) comprising: a processing unit (11) equipped with execution modes including a non-secure mode (3) in which access to a protected region of a memory is prohibited by a support function (12) and a secure mode (2) in which access to the protected region is permitted; and a hypervisor (20) which runs in the secure mode. The hypervisor includes: a first setting unit (23) for setting a first operation condition (21), which includes enabling a first OS (30) running in the secure mode to access the protected region and the unprotected region of the memory; and a second setting unit (24) for setting a second operation condition (22a), which includes enabling a second OS (41) running in the non-secure mode to access the unprotected region, using the support function to prevent the second OS (41) from accessing the secure region, and enabling a transition to the secure mode by accessing of the second OS to a first device shared with the first OS.

Abstract: Examples relate to Input/Output (I/O) data encryption and decryption. In an example, an encryption/decryption engine on an Integrated Circuit (IC) of a computing device obtains at least one plaintext data. Some examples determine, by the encryption/decryption engine, whether the at least one plaintext data is to be sent to a memory in the computing device or to an I/O device. Some examples apply, when the at least one plaintext data is to be sent to the I/O device and by the encryption/decryption engine, an encryption primitive of a block cipher encryption algorithm to the at least one plaintext data to create output encrypted data, wherein an initialization vector that comprises a random number is applied to the encryption primitive.

Abstract: It is presented a method for a server for enabling setting up a secure peer-to-peer connection between a first peer and a second peer. The method comprises the steps of: receiving a request for a web application from the first peer; sending a directive to the first peer requesting a fingerprint of a certificate of the first peer; receiving a first fingerprint from the first peer; and sending the first fingerprint to the second peer.

Abstract: A networked device communication system can configure network devices (e.g., a primary and secondary database) to send and receive sequences of messages, such as replicated data, using one or more keypairs and wrapping keys. The sequences of messages can include an initial set of messages that are encrypted by a wrapping key, and further include another set of messages that are encrypted by a replaced staggered key. The sequence of messages can be configured to be decrypted without exporting keys of hardware security modules.

Abstract: A networked device communication system can configure network devices (e.g., a primary and secondary database) to send and receive sequences of messages, such as replicated data, using one or more keypairs and wrapping keys. The sequences of messages can include an initial set of messages that are encrypted by a wrapping key, and further include another set of messages that are encrypted by a replaced staggered key. The sequence of messages can be configured to be decrypted without exporting keys of hardware security modules.

Abstract: Described herein is a method of enhancing the security of an internet transaction which includes the transmission of structurally formatted information, the method including the steps of: transmitting a request for the structurally formatted information across a network environment; receiving the request and sending a formulated response requiring calculation and decoding to determine the nature and content of the structurally formatted information; and receiving the structurally formatted information.

Abstract: A method and system to improve datacenter security by configuring a security layer as a set of nano-services that are executed to service a single tenant of the datacenter such that the nano-service protects the single tenant from other entities in the datacenter and the nano-service being compromised does not compromise the security of other tenants of the datacenter. The method includes receiving a request to instantiate a virtual resource for a tenant, generating a nano-service to implement at least one security layer function for the virtual resource, and connecting the nano-service to the virtual resource and a virtual bridge in the datacenter to enable communication between the virtual resource (vR) and a network of the datacenter with the security layer function processing traffic between the virtual resource and the virtual bridge. The nano-service can be immutable once it begins execution. The security layer function can be an L2 or L3 function.

Abstract: Methods and devices for opening a firewall port for a specified time period are provided. A data packet having a source address and a destination address beyond a firewall transmitted from a process source is intercepted by an interceptor. Responsive to determining, based on the source address, that a firewall port is not open, buffering the data packet. A request comprising an identifier, a protocol identifier, and a time period the firewall port is to be open is transmitted to a firewall controller. The firewall controller authenticates the request based on the identifier and opens a firewall port determined based on the protocol identifier. The interceptor receives an open firewall port notification indicating that the firewall port has been opened and transmits the data packet through the firewall port to the destination address. The firewall controller closes the firewall port when the time period has expired.

Abstract: Rules are applied at a network perimeter to outbound network communications that contain file attachments. The rules may, in a variety of circumstances, require wrapping of an outbound file from the endpoint in a portable encrypted container. The network perimeter may be enforced locally at the endpoint, or at any network device between the endpoint and a recipient.

Abstract: A method of preventing execution of malware programming in a computing environment, by modifying the portion(s) of computer file names and/or headers and/or file content recognized by the computer for executing said programming. Accordingly, the computer will not recognize the malware file (having standard executable program files) as an executable file, so that the malware program will never be activated.

Abstract: Blockchain-controlled and location-validated locking systems and methods are described. A method includes maintaining state information for a lock, where the first state of the lock corresponds to an open state and the second to a locked state. The method further includes receiving a current location of a device associated with a person, authorized to change a state of the lock, attempting to change a state of the lock and a current location of the lock. The method further includes receiving a digital signature from the device. The method further includes automatically transmitting a control signal to the lock to change the state of the lock only when the current location of the person is determined to be the same as the current location of the lock and a valid proof of work is performed by a miner associated with a blockchain configured to manage transactions corresponding to the lock.

Abstract: Embodiments of the disclosure relate to systems and methods for protecting a physical asset against an attack. In one exemplary embodiment, an asset protection system is configured to use a monitoring system to obtain performance parameters of a physical asset when the physical asset is in operation. The asset protection system is further configured to retrieve from a database, one or more threat signatures and to use the one or more threat signatures to detect an attack upon the physical asset, the detection based at least in part on identifying a relationship between at least one of the threat signatures and at least a portion of the performance parameters of the physical asset. When an attack is detected, a signal can be transmitted to a control system of the physical asset and/or directly to the physical asset, to modify an operation of the physical asset in response to the attack.

Abstract: A communication apparatus of the disclosure includes: an authentication section that performs personal authentication of a user through BAN (Body Area Network) communication prior to data exchange with a communication peer for predetermined processing; and a communication section that performs the data exchange with the communication peer for the predetermined processing in a case of success of the personal authentication.

Abstract: An authentication apparatus and method based on cognitive information. The authentication apparatus based on cognitive information includes an authentication request reception unit for receiving a request to authenticate an authentication target, a behavioral and contextual information collection unit for collecting behavioral and contextual information corresponding to the authentication target, a cognitive information extraction unit for extracting cognitive information corresponding to the request from previously stored big data, and an authentication processing unit for authenticating the authentication target in consideration of the behavioral and contextual information based on the extracted cognitive information.

Abstract: A method for automated recertification of a safety critical system with at least one altered functionality is provided. The method includes providing a failure propagation model of the safety critical system. The method also includes updating the failure propagation model of the safety critical system according to the at least one altered functionality using inner port dependency traces between inports and outports of a failure propagation model element representing the at least one altered functionality. The method includes calculating top events of the updated failure propagation model, and comparing the calculated top events with predetermined system requirements to recertify the safety critical system.

Abstract: A disclosed method is performed at a server (e.g., a content delivery network (CDN) server). The server receives from a QUIC client a first token, where the first token includes a first connection identifier that identifies a first path connecting the QUIC client to the server. The server validates the first token, including validating path properties associated with the first path extracted from the first token. The server further generates a second token associated with a second connection identifier that identifies a second path connecting the QUIC client to the server in accordance with a successful validation of the first token. Additionally, the server transmits the second token to the QUIC client.

Abstract: A portable encryption format wraps encrypted files in a self-executing container that facilitates transparent, identity-based decryption for properly authenticated users while also providing local password access to wrapped files when identity-based decryption is not available.

Abstract: Disclosed are various embodiments for synchronizing authentication sessions between applications. A token exchange service receives a first authentication token from a client computing device. The first authentication token corresponds to a registration of an application of the client computing device for a user account. The first authentication token is validated. A second authentication token is generated, corresponding to a browser-based session for the user account. The second authentication token is sent to the client computing device.

Abstract: Method and apparatus for creating a second unique identifier for a user in a second system based on a first unique identifier for a user in a first system. A first authentication process is initiated based on a first unique identifier associated with the user in the first system. Responsive to the user successfully authenticating during the first authentication process, the second unique identifier for a user in the second system is generated. The second unique identifier is based on user data associated with the first unique identifier in the first system, and the second unique identifier is different from the first unique identifier.