Abstract: A method of encrypting data at an electronic device where the electronic device is associated with a key device. Each device is associated with an asymmetric cryptography pair, each pair including a first private key and a first public key. Respective second private and public keys may be determined based on the first private key, first public key and a deterministic key. A secret may be determined based on the second private and public keys. The data at the electronic device may be encrypted using the determined secret or an encryption key that is based on the secret. Information indicative of the deterministic key may be sent to the key device where the information may be stored.

Abstract: A system and techniques are described herein for providing authentication. The technique includes registering user authentication data such as biometrics data with a communication device. The authentication data is linked to an account or service provider, and is used to verify the identity of the user when accessing the account. The communication device may obtain a public/private key pair, for which the pubic key may be stored on a secure remote server. When the user attempts to access the account or service provider, the user may provide the authentication data to authenticate the user to the communication device. Thereafter, the communication device may sign an authentication indicator using the private key and send the authentication indicator to the secure remote server. Upon verification of the signature using the public key, the secure remote server may grant access to the user, for example, by releasing a token.

Abstract: An apparatus for deploying a firewall on a software-defined network (SDN) includes a public key distributor configured to transmit a public key, a resource monitor configured to monitor resources of a network, a host monitor configured to receive a firewall rule of at least one host, which is encrypted by the public key, a decryption unit configured to decrypt information received from the host monitor by using a secret key, a merge unit configured to merge the decrypted information to provide a merged firewall rule, and a firewall deployment unit configured to deploy the merged firewall rule to a switch.

Abstract: Methods and apparatuses for providing cryptographic authentication within a voice channel are disclosed. The methods and apparatuses can provide cryptographic authentication solely within a voice channel or can use a combination of a voice channel and another data channel. A method for providing cryptographic authentication within a voice channel can operate between telephonic systems and be suitable for operating over G.711/PCMu, AMR and SPEEX™ codecs, and suitable for operating over mobile, PSTN, and VOIP networks. The method can include providing a modem that is codec agnostic and suitable for executing a TLS-based authentication protocol. The method can include using frequency-shift modulation within a frequency range of 300-3400 Hz.

Abstract: A storage device includes a basic memory to store a message received from an external device, a security memory to store an authentication key for authenticating the message, a controller to output a control signal, and a security engine to obtain the authentication key from the security memory with an authority to access the security memory in response to the control signal from the controller and to block an access of the controller to the security memory.

Abstract: Techniques are described for enabling users to establish Secure Shell (SSH) connections with compute instances running in private subnets of virtual private networks of a cloud provider network. A “bastion” compute instance, including an SSH server and specialized SSH client software, is used to enable connections to compute instances in a private subnet of a virtual private network. A bastion instance is a server designed to be a primary point of access from the internet (e.g., by its inclusion in a public subnet of a virtual private network) and acts as a proxy for compute instances running in a private subnet of a virtual private network. The ability for a bastion instance to establish connections to instances in a private subnet is based on a role attached to the bastion instance, where the role may be defined using an identity and access management service of the cloud provider network.

Abstract: A server can record a device static public key (Sd) and a server static private key (ss). The server can receive a message with (i) a device ephemeral public key (Ed) and (ii) a ciphertext encrypted with key K1. The server can (i) conduct an EC point addition operation on Sd and Ed and (ii) send the resulting point/secret X0 to a key server. The key server can (i) perform a first elliptic curve Diffie-Hellman (ECDH) key exchange using X0 and a network static private key to derive a point/secret X1, and (ii) send X1 to the server. The server can conduct a second ECDH key exchange using the server static private key and point X0 to derive point X2. The server can conduct an EC point addition on X1 and X2 to derive X3. The server can derive K1 using X3 and decrypt the ciphertext.

Abstract: Approaches provide for securing an electronic environment. A threat analysis service can obtain data for devices, users, and threats from disparate sources and can correlate users to devices and threats to build an understanding of an electronic environment's operational, organizational, and security concerns in order to provide customized security strategies and remediations. Additionally, the threat analysis service can develop a model of an electronic environment's behavior by monitoring and analyzing various the data from the data sources. The model can be updated such that the threat analysis service can tailor its orchestration to complement existing operational processes.

Abstract: A system includes an intelligent electronic device (IED) and a control system configured to perform operations that include initiating establishment of a media access control security (MACsec) communication link via a MACsec key agreement (MKA) protocol, identifying information associated with the IED in response to initiation of the establishment of the MACsec communication link, the information being indicative of a protocol to be used by the IED to communicate data, and establishing a unidirectional MACsec communication link based on the information associated with the IED.

Abstract: Collaboratively editing a document in a system of sharee clients includes creating a document change, generating a document token for encrypting the document change, encrypting the document change with the document token, making the encrypted document change available to the other sharee clients, and generating a plurality of copies of the sharee document token. Each sharee document token is encrypted with a respective sharee's public key. Each encrypted sharee document token is distributed to respective sharee clients. Each sharee client is configured to: decrypt a sharee document token using a respective private key, decrypt the encrypted document change using the share document token, and consolidate the document change into a document.

Abstract: A client device may be provisioned with a digital certificate to support various operations. The client may transmit a certificate request to a server. The server may initiate a key agreement process using a short-lived private key generated at the server and a public key of the device to derive a symmetric key. The symmetric key may be used to encrypt a payload that includes the digital certificate and an associated private key. Further, the server initiates a key agreement process using the partial private key that was generated for the client and the short-lived public key. A partial key agreement result, and the encrypted payload may be transmitted to the client. The client may complete the key agreement process using the partial key agreement result and a respective portion of the private key. The client may derive the encryption key and decrypt the payload to access the digital certificate.

Abstract: Example authentication methods and apparatus are described. One example method is applied to an identity management entity, and the identity management entity is deployed in a core network control plane of a Long-Term Evolution (LTE) network. The method includes receiving a certificate request message from terminal equipment and generating a digital certificate for the terminal equipment. An identity request message carrying the digital certificate is sent to an identity proxy entity, where the identity proxy entity is deployed in a blockchain network, and the identity request message is used to obtain a blockchain identity for the terminal equipment.

Abstract: Computerized techniques to determine and verify maliciousness of an object by a security logic engine are described. A method features receiving information pertaining to a first set of events associated with a first object (first information) from an endpoint and information pertaining to a second set of events associated with a second object (second information) from an analysis system. Thereafter, the likelihood of the cyber-attack being conducted on the network is determined by at least correlating the first information and the second information with at least events associated with known malicious objects. Any endpoint vulnerable to the cyber-attack are identified based on a configuration of each of the plurality of endpoints and requesting the analysis system to conduct one or more further analyses in accordance with at least a software profile identified in a configuration of the first endpoint of the plurality of endpoints identified as vulnerable.

Abstract: An intelligent electronic device (IED) includes memory and a processor operatively coupled to the memory. The IED establishes, over a communication network of a power system, a connection association (CA) with a receiving device using a media access control security (MACsec) Key Agreement (MKA) protocol. The IED automatically sends an announce message indicating a set of enabled application protocols on the IED to the receiving device.

Abstract: A digital signature method, a device, and a system of the present invention can generate a partial signature private key T corresponding to a user by a key generation center using a digital signature algorithm based on the EC-Schnorr, and sign a message M by using a standard digital signature algorithm such as the ECDSA. In the calculation of generating the second part w of the partial signature private key T, a signature assignment R is used, and the signature assignment R is a hash digest of a message including at least a pre-signature ? and an ID of a signature side. When signing the message M and verifying the signature of the message M, the operation requiring M as input uses a concatenation of R and M as input. The present invention uses a mechanism to connect two signature algorithms to ensure that the constructed complete algorithm can effectively resist known attacks.

Abstract: A service provider may offer an identity proofing service that can be used to generate verifiable credentials (VCs) with customer-selected attributes. The VCs may use cryptographic signatures to indicate proof of identity certified by, for example, a telecommunications service provider. After a one-time process to obtain the VCs and associate them with a shell identity, the customer with a client device may use the VCs as a form of authentication for relying parties in a two-way (e.g., peer-to-peer) authentication process.

Abstract: Systems and methods are disclosed to implement a machine scanning system that stores machine access credentials in a distributed fashion in a pool of scanner nodes. In embodiments, a storage manager node is selected from the pool to manage the storage of each new credential. The storage manager partitions the credential into portions and distributes the portions among the nodes, which may store the portions under different encryptions. A credential storage metadata is updated to indicate portion assignments and also distributed. At scanning time, the node selected to perform the scan uses the credential storage metadata to gather the portions and reconstruct the credential. In embodiments, the portions may be assigned so that no single node holds all portions of the credential, and at least two nodes hold each portion. Advantageously, the disclosed storage scheme enhances the security and availability of access credentials used by the machine scanning system.

Abstract: A non-transitory computer readable medium including instructions stored thereon, when executed, the instructions being effective to cause at least one processor of a first network device to: derive a private key encryption key based on a public key, a first private key of the first network device, a second private key of a live peer device, and a Connectivity Association Key (CAK); transmit a secret key encrypted by the private key encryption key to the live peer device; and receive a communication from the live peer device, the communication being encrypted by the secret key.

Abstract: In one arrangement, a method for using symmetric keys between two entities comprising a device and a host include initiating, by the device, a transaction involving original data, wherein the original data needs to be verified by the host. The method further includes deriving, by the device, a first key based on a previously generated key and a first number, wherein the first key is unique to the transaction, and the first number is randomly generated. The method further includes sending, by the device, the first key to the host for verification.

Abstract: An electronic device having at least one operational setting, such as a power setting, with at least a first state and a second state. The electronic device may also include an access controller that can receive state data and authorization data from an external source such as a remote control. The access controller may enable a state of the operational setting upon receipt of proper authorization data received from or related to the output from at least one biometric sensor associated with the remote control.