Abstract: Systems and methods for Transport Layer Security (TLS) concatenation are described. In an illustrative, non-limiting embodiment, an Information Handling System (IHS) may include: a processor; and a memory coupled to the processor, wherein the memory comprises program instructions store thereon that, upon execution by the processor, cause the IHS to: derive a shared session key during a first Transmission Control Protocol (TCP) connection with a second IHS; and after disconnection of the first TCP connection, perform a Transport Layer Security (TLS) negotiation with the second IHS via a second TCP connection using the shared session key.

Abstract: The system may receive, via a bifurcated serial communication processing API, a first serial communication for a first account, wherein the bifurcated serial communication processing API adds a first subroutine identifier to the first serial communication based on a first function for completing. The system may process the first serial communication using a first API subroutine based on the first subroutine identifier, wherein the first API subroutine comprises an account locking function. The system may determine a status of the first account based on the account locking function.

Abstract: A method and a device perform user authentication of an occupant in a vehicle based on speech recognition. The device includes a memory that stores a reference embedding set including a feature embedding for a registered user's utterance and feature embeddings for synthesis results between the registered user's utterance and a plurality of environmental noises. The device also includes a user interface that receives input audio including utterance of an occupant of the vehicle and noise, and a processor that transforms the input audio to an input embedding and determines whether the occupant is a registered user based on a comparison between the input embedding and the reference embedding set.

Abstract: Provided are a method and apparatus for performing authentication on a vehicle on-demand service. A method by which an integrated communication control unit performs authentication on a vehicle on-demand service, includes: storing, in a service authentication server, a first option value related to a vehicle service, received from a tool in factory (TIF) device; obtaining or generating a private root private key and a private root certificate; generating a device certificate and a device private key signed with the private root private key for each performance controller; generating a service token for the first option value by using the private root certificate and the private root private key; and transmitting the generated service token, the private root certificate, and the device private key for each performance controller.

Abstract: Systems and methods for enhancing container security are provided by reducing the attack surface. In one example, the exposure of containers to potential security vulnerabilities is reduced by identifying dynamically loaded symbols by an application via performance of static symbol analysis by examining a section of an executable to identify dynamically loaded symbols corresponding to functions contained within shared libraries. Based on a given shared library's usage of functions within standard libraries and a known mapping between functions of standard libraries and system calls, those system calls potentially accessed by the application may be identified and a security policy may be generated and configured for enforcement by a kernel security module to limit system call usage accordingly. Thereafter, the security policy enforced by the kernel security module may be refined based on performance of dynamic symbol analysis to identify system calls that are actually called by the application during runtime.

Abstract: Systems and methods are described for dynamic execution of artificial intelligence (“AI”) agents. A server can receive, from a client device, an input associated with an AI agent. Based on a manifest file or user profile, the server can identify a management policy that applies to the AI agent. The server then dynamically configures access to the agent objects based on applying the management policy. The management policy is applied to a device status of the client device, a user profile of a user of the client device, and/or a network configuration of the client device. The server then executes a modified workflow based on the dynamically configured access, wherein the modified workflow bypasses or changes operation of at least one of the agent objects. Based on the modified workflow, the server transmits an output to the client device.

Abstract: A mobile terminal includes a touch screen display, a camera, a power button and an activation button for turning on the touch screen display. The mobile terminal has a first function and a second function to perform in response to user input and provides user settings for configuring at least one of the first and second functions such that the at least one of the first and second functions is performed along with turning on the touch screen display when pressing of the activation button is detected while the touch screen display is turned off. The mobile terminal is configured to perform the first and second functions depending upon length of pressing of the activation button in addition to turning on the touch screen display.

Abstract: Examples of the present disclosure are directed to systems and methods for using router identifier information to mitigate denial of service attacks in an autonomous system (AS). Each router of the AS may be assigned a router identifier (ID) that is unique to the AS and may be periodically changed. The ingress router first receiving the packet within a particular AS may insert its router ID into the packet. A threat intelligence system may sample packets of traffic received by the AS and examine the inserted ingress router IDs in making a threat determination. If a distribution of detected ingress router IDs from sampled packets does not match an expected distribution of ingress router IDs, one or more threat mitigation actions may be invoked.

Abstract: A method of rolling security for a system that includes multiple server groups, such as a first server group of one or more servers and a second server group of one or more servers. The method includes repeatedly initiating rebuilding of the first server group of one or more servers. The method also includes repeatedly initiating rebuilding of the second server group of one or more servers. The rebuilding of the first server group of one or more servers is staggered in time from the rebuilding of the second server group of one or more servers. The servers may be physical servers or virtual machines. Rolling security may also be applied to software containers, computing devices within a data center, and computing devices outside of a datacenter.

Abstract: A method and apparatus for secured, peer-to-peer transfer of data rights over a computer network, the method being accomplished by a distributed computing system including a distributed ledger platform. Root rights are defined and delegated to wallets in a multilevel manner to thereby isolate wallets associated with the root right from cyber risk. Root rights are revokable and reassignable, where a root wallet is able to claw back authority delegated to one or more supervisory wallets.

Abstract: The present disclosure relates to a system, a method, and a non-transitory computer readable storage medium for deep packet inspection scanning at an application layer of a computer. A method of the presently claimed invention may scan pieces of data received out of order without reassembly at an application layer from a first input state generating one or more output states for each piece of data. The method may then identify that the first input state includes one or more characters that are associated with malicious content. The method may then identify that the data set may include malicious content when the first input state combined with one or more output states matches a known piece of malicious content.

Abstract: A method of delivering a one-time password to an entity is provided. The entity requesting the one-time password provides a public key of a public-private key pair to the authentication service. The entity can then submit a challenge request to the authentication service. The authentication service will generate a one-time password, and encrypt the one-time password with the public key. The encrypted one-time password is delivered to the entity via an unauthenticated channel.

Abstract: Techniques are disclosed relating to securely authenticating communicating devices. In various embodiments, a computing device receives, via a network connection with a network, a first certificate for a first public key pair of the computing device. The computing device provides the first certificate to an offline accessory device and receives a second certificate for a second public key pair maintained by the offline accessory device. The computing device performs a verification of the second certificate and, responsive to the verification being successful, interacts with the offline accessory device. In some embodiments, prior to providing the first certificate, the computing device determines an ordering in which the first and second certificates are to be exchanged by the first computing device and the offline accessory device, and the first certificate is provided to the offline accessory device in accordance with the determined ordering.

Abstract: The present disclosure provides methods, apparatuses and systems for key management and service processing. In one aspect, a method includes receiving, by a authentication server from a trusted execution environment (TEE) of a terminal device, device authentication information through a secure channel between the TEE and the authentication server. The device authentication information is configured to prove an identity of the terminal device. The method includes performing, by the authentication server based on the device authentication information, device authentication on the terminal device. The method further includes in response to determining that the terminal device passes the device authentication, sending, by the authentication server, a service encryption key and a device identity certificate to the TEE through the secure channel.

Abstract: A data item is provided to an on-premises proxy service by a peer-to-peer (P2P) client device associated with a video conferencing platform. The P2P client device and the on-premises proxy service are associated with a private network. The data item comprises topological information corresponding to the private network. A transformed version of the data item is received from the on-premises proxy service. The transformed version of the data item obscures the topological information corresponding to the private network. The transformed version of the data item is provided to an external tracking service for a P2P configuration operation. The external tracking service is associated with the video conferencing platform and is external to the private network.

Abstract: A cross-certificate method is performed by an electric vehicle (EV) for being supplied with power from electric vehicle supply equipment (EVSE) associated with a charging point operator (CPO) having established a trust relationship with a first vehicle to grid (V2G) root certificate authority (rootCA) and a second V2G root certificate authority. The cross-certificate method may include steps of: requesting charging from the electric vehicle supply equipment; receiving, from the electric vehicle supply equipment, a certificate chain held by the electric vehicle supply equipment; and verifying whether or not a last certificate of the certificate chain has been signed by the second V2G root certificate authority, wherein the last certificate of the certificate chain can be a cross-certificate issued by the second V2G root certificate authority.

Abstract: Examples of the present disclosure provide an authenticator system that protects secret authentication keys associated with relying parties to which a user is authenticating. Present systems and methods allow cross-platform and cross-device WebAuthn usage. Example systems employ a server-based secure enclave and secure tunnel communication between the browser application or mobile application and the secure enclave server. A user of a service provider of the authenticator system owns the secret authentication key, which is stored in an encrypted vault protected by a user secret and hosted by the service provider. Decrypting the secret key may be based on a key arrangement, where keys from the user, the service provider, and the secure enclave are used to successfully decrypt the secret authentication key within the secure enclave.

Abstract: A method for using cryptographic keys in a vehicle on-board communication network. The method includes, during an initialization of a vehicle-bound power supply time period of a vehicle: generating at least one cryptographic key by a central electronic control unit for the respectively initialized vehicle-bound power supply time period of the vehicle; transferring the generated at least one cryptographic key by the central electronic control unit using at least one cryptographic algorithm to at least one further electronic control unit in the on-board communication network; using the transferred cryptographic key by at least one electronic control unit for at least one further or for the same cryptographic algorithm for a communication between the electronic control units for the duration of the respective initialized vehicle-bound power supply time period in the on-board communication network.

Abstract: A computer-implemented method includes receiving a subscriber-initiated request to remove protected content from a raw media item, detecting a plurality of acoustic features associated with the raw media item, based on the plurality of acoustic features indicating that the raw media item includes the one or more protected media assets, automatically routing the raw media item to an audio sanitization service, separating, in response to the audio sanitization service executing a plurality of audio separation machine learning models, the one or more protected media assets from non-protected portions of the raw media item to generate a plurality of sanitized instances of the raw media item; and returning, as a response to the subscriber-initiated request, the plurality of sanitized instances of the raw media item to prevent unauthorized electronic distribution of the one or more protected media assets within the raw media item.

Abstract: Versions of an application program are evaluated to protect a customer from a supply chain attack. The versions of the application program are executed in to identify behaviors exhibited by the versions of the application program, each of the behaviors including activities that perform computer operations. A behavior change is detected by identifying a behavior that is not common to the versions of the application program.