Abstract: According to an aspect, a method for accessing a computing device includes receiving, by the computing device, an authentication credential for recovery access to the computing device, the authentication credential being different from an authentication credential used to access encrypted data on the computing device, obtaining, in response to receipt of the authentication credential for recovery access, a first key portion stored on the computing device, transmitting, over a network, a request to receive a second key portion, receiving, over the network, a response that includes the second key portion, recovering a decryption key using the first key portion and the second key portion, and decrypting the encrypted data on the computing device using the decryption key.

Abstract: Methods, systems, and computer readable media for providing and managing security rules and policies are described. In some implementations, a method may include receiving, at a crowdsourcing security policy server, a security policy from a first user account, and providing a crowdsourced security policy user interface including a section corresponding to the security policy configured to make the security policy available for use by other user accounts. The method may also include receiving from one or more of the other user accounts, a security policy rating corresponding to the security policy, and receiving, from one or more of the other user accounts, a user account rating corresponding to the first user account.

Abstract: Disclosed herein are embodiments of systems, methods, and products providing real-time anti-malware detection and protection. The computer uses artificial intelligence techniques to learn and detect new exploits in real time and protect the full system from harm. The computer trains a first machine learning model for executable files. The computer trains a second machine learning model for non-executable files. The computer trains a third machine learning model for network traffic. The computer identifies malware using the various machine learning models. The computer restores to a clean, uncorrupted state using virtual machine technology. The computer reports the detected malware to a security server, such as security information and even management (SIEM) systems, by transmitting detection alert message regarding the malware. The computer interacts with an administrative system over an isolated control network to allow the system administrator to correct the corruption caused by the malware.

Abstract: A device determines that a policy is to be executed. The device retrieves rules, resource identifiers, and data provider identifiers associated with the policy. The device asynchronously retrieves resources from data providers that are called for by the rules, and executes each of the rules as their corresponding resources are retrieved. The device identifies a group of rules that have failed. The device calculates a risk score for each rule of the group and generates an alert for each rule of the group. The device outputs a report including each alert, each of the alerts being prioritized in the report based on the risk score of their corresponding rule.

Abstract: An apparatus and method for contingent assignment actions is disclosed. The apparatus includes a processor and a memory communicatively connected to the processor. The processor receives assignment data. An assignment is assigned to a user. The processor generates a contingent action. The processor receives a cryptographic proof. The cryptographic proof is validated. The contingent action is executed by the processor, conditionally, based on the validation of the cryptographic proof.

Abstract: Systems, methods, and software for secure access control to digitally stored information. Owners of digitally stored information enter access control data using a first graphical user interface (GUI) on a first device. Vault space is allocated in memory for receiving and storing the information remotely from the first device. A keyholder and a guardian identified by the access control data are associated with the information. A keyholder access request for the information is transmitted via a second GUI on a second device. Responsive to determining the keyholder to be associated with the information, a third device of a guardian receives a notification of the access request, and the guardian may use a third GUI to transmit an access authorization. The information may be transmitted to the second device upon determining that the guardian is associated with the information.

Abstract: A system includes a plurality of information processing devices configured to manage, in a distributed manner, meta information indicating access authority for directories having a hierarchical structure for accessing a file, wherein at least one of the plurality of information processing devices is configured to: receive an access request to the file; respond with a confirmation result of the access authority according to confirmation of the access authority of an access request source from a higher directory of the file to the file based on the meta information; and in response to determining that creating of an access right confirmation history of the confirmation result of the access authority of the access request source from the higher directory to the file based on an access history for the file is to be performed, create the access right confirmation history in association with identification information of the access request source.

Abstract: An access point (AP) in a deployment may be attacked by a rogue AP. The rogue AP may transmit fake beacons that include a fake/incorrect basic service set (BSS) color that does not match the BSS color assigned to/used by the AP under attack. Due to this BSS color mismatch, stations associated to the AP under attack may switch to the fake/incorrect BSS color, and communications between the AP under attack and the stations may be disrupted, and can eventually lead to service denial. Systems and methods are provided for leveraging the BSS color feature to identify when a rogue AP is attacking another AP. Upon detecting an attack, the BSS color feature may be disabled to mitigate the level of service disruption to the AP under attack and the stations associated to that AP.

Abstract: Various aspects include a continuous authentication system for a storage system. The continuous authentication system includes a host having an encryption unit. The continuous authentication system includes a storage device having a decryption unit. The continuous authentication system includes a first physical connection between the host and the storage device. The first physical connection may be configured to transfer I/Os. The continuous authentication system may include a second physical connection between the host and the storage device. The encryption unit may be configured to encrypt a continuous authentication signal. The host may be configured to transmit the continuous authentication signal through the second physical connection. The storage device may be configured to receive the continuous authentication signal through the second physical connection. The decryption unit may be configured to decrypt the continuous authentication signal.

Abstract: Embodiments of the present disclosure relate to methods, systems, and computer program products for event management. In a method, a token is obtained at a first agent device that is included in a network system, the token is for authenticating a first packet that is transmitted in the network system, and the first packet is generated according to a first network format. A second packet is generated based on the first packet and the token according to a second network format. The second packet is transmitted to a second agent device that is included in the network system, here both of the first and second agent devices support the first and second network formats. With these embodiments, the packet may be authenticated in a more effective way.

Abstract: Systems and methods are provided that may be implemented to provide a hardware-rooted, protected, and operating system (OS)-agnostic environment in which designated logic (e.g., one or more software and/or firmware tools such as an OS agent) may be run to verify the ownership and/or registration of a given information handling system before the OS is booted and running, and therefore before system data (e.g., user data) is exposed. In one exemplary embodiment, the designated logic may include a unified extensible firmware interface (UEFI) driver that is protected (e.g., signed), and that runs during the system boot sequence before the OS is booted. The disclosed systems and methods may be advantageously implemented in one embodiment to allow a system user who purchases and acquires a given information handling system from a source and/or channel other than the original system manufacturer to register and/or associate the given information handling system with their manufacturer-assigned user account.

Abstract: An outbound roaming system detects that a wireless device has left a home wireless network and, in response, identifies a visited wireless network on which the wireless device is likely to roam or is currently roaming. The outbound roaming system queries the visited wireless network to offer security information for the wireless device. The security information can include a security parameter for the visited wireless network to mitigate a potential cyberattack enabled by the wireless device. In response to receiving an acceptance of the offer and satisfying a condition, the outbound roaming system provides the security information to the visited wireless network. As such, the visited wireless network can dynamically defend against cyberattacks enabled by roaming devices.

Abstract: One disclosed example method includes obtaining a meeting cryptographic key; transmitting, from a client device to a video conference provider, a request to initiate an encrypted video conference, the encrypted video conference including a plurality of participants; distributing the meeting cryptographic key to each participant of the plurality of participants; obtaining a public cryptographic key of a key pair, the key pair including the public cryptographic key and a private cryptographic key; encrypting the meeting cryptographic key using the public cryptographic key; transmitting, from the client device to the video conference provider, a request to record the video conference; encrypting audio and video from a microphone and image sensor of the client device using the meeting cryptographic key; transmitting the encrypted audio and video to the video conference provider; and providing the encrypted meeting cryptographic key to the video conference provider.

Abstract: Aspects of the disclosure relate to deploying and utilizing a dynamic data stenciling system with a smart linking engine. A computing platform may receive source data from one or more data source systems. Subsequently, the computing platform may identify a target application hosted by an enterprise application host platform as being an intended recipient of a portion of the source data. Then, the computing platform may select a dynamic data stencil from a plurality of available data stencils. Thereafter, the computing platform may overlay the portion of the source data onto the target application using the dynamic data stencil. In addition, by overlaying the portion of the source data onto the target application using the dynamic data stencil, the computing platform may cause the target application to execute one or more data processing functions using the portion of the source data received from the one or more data source systems.

Abstract: A client system includes a client-side host device, and a client-side storage device including a storage controller and a storage memory. The storage controller includes a host interface, a processor configured to control a read operation and a write operation for the storage memory, and a homomorphic encryption and decryption accelerator configured to, based on receiving a read request from the client-side host device, perform homomorphic encryption on first plaintext data that is read from the storage memory, to generate first homomorphic ciphertext data, and provide the first homomorphic ciphertext data to the client-side host device through the host interface, and based on receiving a write request from the client-side host device, perform homomorphic decryption on second homomorphic ciphertext data that is received through the host interface, to generate second plaintext data, and write the second plaintext data in the storage memory.

Abstract: Apparatus and methods for generating a unique token that can be imprinted on a document to attest to the verification of an executor's signature. The apparatus and methods may include a platform that may present a token electronically to the executor via a first electronic channel. The executor may use a registered device to capture a portion of the token, and transmit the portion from the registered device to the platform via a second channel to the platform. The platform may verify that the portion is registered to the executor. The platform may combine the portion with another portion of the token, and imprint the pair of combined portions on the document with another token.

Abstract: Exemplary embodiments can identify the toxic PI combinations and flag these combinations for evaluation. Because organization policies on toxic PI combinations can constantly evolve, the system may be continuously updated with the latest policies. Exemplary embodiments may be used as part of an automated code review for application development and for monitoring of existing applications and programs. Thus, exemplary embodiments take the guesswork out of identifying risks in applications and programs by providing an automated tool that can scan and identify toxic combinations in accordance with various policies.

Abstract: Aspects and features of the present disclosure can provide encryption to maintain data privacy while allowing deduplication of some client data by or cloud-based storage platforms. Data can be identified as public data and left unencrypted so that it can be deduplicated. Other data can be identified as personal data, which can be encrypted with a personal key, or as group data, which can be encrypted with a shared, group key. Identifying the data can include storing the data in storage regions within a closed environment. The storage regions can be established, at the client, in a storage platform, or both. Optionally, a storage platform can include multiple storage regions for multiple groups of users, wherein each group is assigned its own unique encryption key. Such data can thus automatically be subject to the same deduplication routines as unencrypted data.

Abstract: A system includes a binary tree having leaf hashes. The leaf hashes include a device privacy protected index and a set of zero-knowledge commitments relating to a computer device. The system calculates the device privacy protected index using a verifiable random function such that a device entity path in the binary tree cannot reveal any information about any other device in the binary tree, and associates the set of zero-knowledge commitments with the device privacy protected index. The system then generates a privacy-protected attestation for the computer device using the device privacy protected index and the set of zero-knowledge commitments.

Abstract: A first cryptographic communication system is disclosed. The first cryptographic communication system includes a common hardware module configured to receive local cryptographic signals and coalition cryptographic signals that includes a transmitter, a receiver, a common router, a trusted router, and a data loader. The first cryptographic communication system further includes a local cryptographic assembly and a coalition cryptographic assembly each including and end cryptographic unit communicatively coupled to the trusted router, a cross domain guard communicatively coupled to the end cryptographic unit and the trusted router, and a general purpose security module communicatively coupled to the cross domain guard. The first cryptographic communication system further includes a data recoding module communicatively coupled to the data loader that includes local and coalition data recording devices.