Abstract: Elliptic Curve Cryptography (ECC) can provide security against quantum computers that could feasibly determine private keys from public keys. A server communicating with a device can store and use PKI keys comprising server private key ss, device public key Sd, and device ephemeral public key Ed. The device can store and use the corresponding PKI keys, such as server public key Ss. The key use can support all of (i) mutual authentication, (ii) forward secrecy, and (iii) shared secret key exchange. The server and the device can conduct an ECDHE key exchange with the PKI keys to mutually derive a symmetric ciphering key K1. The device can encrypt a device public key PK.Device with K1 and send to the server as a first ciphertext. The server can encrypt a server public key PK.Network with at least K1 and send to the device as a second ciphertext.

Abstract: A method for performing a key exchange between a first device, a second device, and an intermediary device, wherein the intermediary device: transmits to the first device a first secret symbol string over a first quantum channel and a first basis set over a first channel, transmits to the second device a second secret symbol string over a second quantum channel and a second basis set over a second channel, and generates a third symbol string by combining the first and second secret symbol strings and transmits data representative of the third symbol string to the second device, whereby the first and second devices perform a quantum key exchange and sifting based on the first and second secret symbol strings and first and second basis sets, and a fourth set of symbols is generated by the second device by combining the second secret symbols with the third symbol string.

Abstract: Mechanisms are provided for performing ciphertext nullification operations. The mechanisms receive a ciphertext in nullification logic of a cryptographic circuit, where the cryptographic circuit comprises one or more cryptographic functions to be performed on the ciphertext. The mechanisms determine, by the nullification logic, whether the received ciphertext is to be nullified. In response to the determination indicating that the ciphertext is to be nullified, the mechanisms generate, by the nullification logic, a nullified ciphertext and output the nullified ciphertext. In response to the determination indicating that the ciphertext is not to be nullified, the nullification logic outputs the received ciphertext.

Abstract: Systems and methods for quantum key distribution in an optical network and quantum-secured optical channels. A node for operation in an optical network includes one or more degrees each connected to a corresponding optical span including one or more fibers; and one or more Quantum-Optical Service modules (QOSM) for each of the one or more degrees, each QOSM supporting Quantum Key Distribution (QKD) for establishing a quantum-secured channel and Optical Service Channel (OSC) functionality over the quantum-secured channel. A line amplifier system for operation in an optical network includes one or more optical amplifiers configured to amplify optical channels over an optical span in the optical network; and a trusted quantum repeater, connected to the optical span, and configured to support QKD for establishing a first quantum-secured channel and a second quantum-secured channel and OSC functionality over the first quantum-secured channel and the second quantum-secured channel.

Abstract: A method for forward security Quantum Secure Layer (QSL), where the method causing a server to hold long-term public/private Key Encapsulation Mechanism (KEM) keypair; uses KEM to establish a pre-master shared secret; causing the server to send ephemeral KEM public key to the client; uses KEM to establish master shared secret; and generates a session key by the server and encrypted to the client using the master shared secret. A method for forward secrecy Quantum Secure Layer (QSL), where the method causing a server to hold a pre-shared ephemeral public/private Key Encapsulation Mechanism (KEM) keypair; uses KEM to establish a master shared secret; and generates a session key by the server and encrypted to the client using the master shared secret.

Abstract: A bypassing technique bypasses an indexing service and provides a bypass data path for transferring/retrieving snapshots from a production cluster to an object store. In an embodiment, the production cluster may determine how extents of the snapshots are packed into objects of the object store and transfers the snapshots directly to the object store over the bypass data path. Once the snapshot transfer is completed, the production cluster provides location metadata as to how the snapshot extents are packed into objects to the indexing service. The indexing service is invoked to create an index of the location metadata and is not involved in the data transfer of the snapshots. In another embodiment, the production cluster identifies a snapshot to restore and queries the indexing service to compute the deltas between the snapshot to be restored and a reference snapshot. The indexing service returns a set of segments that indicates the changed delta regions between the two snapshots.

Abstract: A key update method, a network element, user equipment, and a storage medium are disclosed. The method may include: sending an application key update request to a second network element according to a user identity in response to an application key corresponding to a key identifier carried in a session establishment request being invalid; and determining an updated application key according to a message associated with the application key update request.

Abstract: Systems and methods for authenticating a user may include receiving a first data packet. The first data packet may include a biometric image captured during an authentication process an identifier identifying a resource server. The first data packet may be received in connection with a request for authenticating the user to access the resource server. The method may include receiving a second data packet. The second data packet may include a digital identity document of the user. The digital identity document may include an image of the user. The method may include verifying an authenticity of the digital identity document, based on information from the second data packet. The method may include comparing the image data and the digital identity document. The method may include transmitting authentication information user to the resource server. The authentication information may be transmitted based on the comparison and authenticity of the digital identity document.

Abstract: An encoder receives first data encapsulating second data in a hidden compartment along with a decoder identifier corresponding to either of a first decoder or a second decoder. The encoder then generates an embedding corresponding to the first data. The first decoder decodes the embedding to result in a representation of the first data when the decoder identifier corresponds to the first decoder. The second decoder decodes the embedding to result in a representation of the second data when the decoder identifier corresponds to the second decoder. The decoded embedding can be provided to a consuming application or process. Related apparatus, systems, techniques and articles are also described.

Abstract: A computer system with multiple security levels, the system comprising a high-power processing device (130), a low-power processing device (110), and an interface unit (120) comprising functions for moving classified information between the high-power device (130) and the low-power device (110) according to formal rules for confidentiality and/or integrity. Additional security aspects, e.g. availability, may readily be accommodated. A method for implementing multiple levels of security along a number of independent security axes on the system is also disclosed.

Abstract: For a communications network having a plurality of network security elements and a plurality of existing network security element specification files which limit packet flow on the network security elements, obtain, from a user, instructions to compose at least one of: a new network security element specification file; or one of the existing network security element specification files. Facilitate queuing a configuration change request that implements the instructions in an implementation pipeline. Facilitate pushing the configuration change request to at least one corresponding network security element of the plurality of network security elements.

Abstract: A method for managing docking and authentication of computing devices includes detecting when a computing device docks with a docking station, identifying the device by extracting a unique identifier, and authenticating a user via an external interface. Upon successful authentication, a configuration profile is retrieved from a centralized management server and transmitted to the device over a secure channel. The device applies the profile, which may include application restrictions, wireless network settings, and user interface preferences. Session metadata is synchronized with a management system, and events may be logged for compliance tracking. In response to an undocking event, the system may issue a lock command encrypted using AES-256, enforcing local access restrictions. Administrative features include override capabilities, grace period enforcement, and notification handling. Configuration and enforcement actions may be backed up to cloud storage.

Abstract: A method (100) performed by an apparatus in a Software Defined Network, SDN, the method comprising: receiving (102) a request to define a virtual link, VL, in the SDN, the request including security constraint information for the VL; identifying (104) from a network topology of the SDN physical links that are Quantum Cryptography, QC, enabled; computing (106) a path for the VL using only physical links of the identified QC enabled physical links; and initiating (108) provisioning of the VL using the computed path.

Abstract: The present disclosure provides a video transmission method, a video transmission apparatus, an electronic device, and a readable medium, belongs to the field of information transmission technology, and can solve the problem of security of information transmission. The video transmission method of the present disclosure includes: acquiring block data of a video stream to be transmitted; generating an encryption key for an rth block with a block data digest of an (r?1)th block, wherein r is an integer greater than or equal to 2; encrypting block video data of the rth block with the encryption key for the rth block, to obtain block encrypted video data of the rth block; and transmitting the block encrypted video data of the rth block to a receiving end.

Abstract: According to one embodiment, a transmitting device includes an encryption key pre-fetching unit and an encryption chunk generation unit. The encryption key pre-fetching unit acquires the encryption key for encrypting plaintext data from a key management system before receiving the plaintext data. The encryption chunk generation unit generates a packet in which first encrypted data acquired by encrypting first plaintext data using a first encryption key and a first key ID of the first encryption key are stored, and a second key ID of a second encryption key used for encrypting second plaintext data transmitted after the first plaintext data, is embedded. A receiving device includes an encryption chunk analysis unit and a decryption key pre-fetching unit. The encryption chunk analysis unit analyzes the packet and reads the second key ID.

Abstract: Systems and methods for adaptive recursive descent data redundancy are described herein. In one embodiment, a method can include identifying the data object or file for Quantum Fragmentation, determining, via a first portion of a Quantum Fragmentation instance, a factor of fragmentation for the data object or file, transforming the data object or file into a plurality of first data fragments according to the factor of fragmentation by applying one or more cryptographic processing, integrity checking, and resilient fragmentation schemes, via the first portion of the Quantum Fragmentation instance, and persisting, via the first portion of the Quantum Fragmentation instance, each of the plurality of first data fragments to a data store of a plurality of available Cloud or other data stores or to a subsequent portion of the Quantum Fragmentation instance, wherein the persistence for each of the first data fragment occurs independently from the other first data fragments.

Abstract: Embodiments of the present disclosure include a system for performing authentication. The system can include a computing device comprising processor resources and memory resources, the memory resources storing computer-readable instructions that can be executed by the processor resources to perform various functions. In some embodiments, instructions can be executed by the processor to receive, with a transport layer security stack, a first transport layer security request from a first internal communication endpoint task and a second transport layer security request from a second internal communication endpoint task, wherein the first transport layer security request is related to establishing a secure connection with a first external communication endpoint and the second transport layer security request is related to establishing a secure connection with a second external communication endpoint.

Abstract: A cipher instruction is executed that includes encrypting a confidential value. A power block sequencing value is obtained as input to the cipher instruction, and a mask value is generated using the encrypted confidential value and the power block sequencing value. A cipher operation is performed on at least a portion of a message specified by the cipher instruction using the mask value. The power block sequencing value is updated, based on performing the cipher operation of the at least the portion of the message, to provide an updated power block sequencing value to be used in re-execution of the cipher instruction based on the cipher instruction being interrupted. The updated power block sequencing value is to be provided as input to the cipher instruction based on the cipher instruction being re-executed to re-generate the mask value to be used in continuing the cipher operation of the message.

Abstract: Various aspects of the disclosure relate to verification of data sets used for real-time processes and/or batch processes. A computing platform negotiates, by a first quantum node, a shared key group with at least a second quantum node and calculates an exclusive or (XOR) value of a pair of the first quantum node and the second quantum node. The first quantum service node performs a shared key grouping with the second quantum node and then selects a quantum key relay link between a real-time node and a batch source node. The computing platform selects a corresponding state of all virtual quantum nodes associated with the quantum key relay link and encapsulates a virtual quantum link state between any two quantum service nodes in the quantum network into a database decision engine data file.

Abstract: An attribute based encryption system includes a key generator configured to generate a cyclic group (G) having a prime order q; generate an attribute key matrix (M); generate a master public key (MPK) based, at least in part, on the group (G) and (M); generate a master secret key (MSK) based on a first vector s and a second vector t that represent an encryption policy; generate a user secret key based, at least in part, on the MSK and on a set of one or more user attributes; and send the user secret key to a user device, wherein a ciphertext message can be successfully decrypted if a vector y associated with attributes of the user associated with the user secret key is orthogonal to each row of a set of rows of M selected according to a set of authorization attributes used to encrypt the ciphertext message.