Abstract: Access control request parameter interleaving may be implemented that supports user-configurable and host-configurable processing stages. A request may be received and evaluated to determine whether user-configured interleaving, host-configured interleaving, or both user-interleaving and host-interleaving are applied. For applied interleaving, two different portions of a request parameter may be swapped.

Abstract: A device can (i) store public keys Ss and Sn for a network and (ii) record private key sd. A network can record a corresponding private keys ss and sn. The device can (i) generate a device ephemeral PKI key pair (Ed, ed) and (ii) send public key Ed to the network. The device can receive an ephemeral public key Es from the network. The device can calculate values for A: an elliptic curve point addition over Ss, Sn, and Es, and B: (sd+ed)mod n. The device can input values for X and Y into an elliptic curve Diffie Hellman key exchange (ECDH) in order to determine a mutually derived shared secret X5, where the network can also derive shared secret X5. The device can (i) use X5 to derive a key K2 and (ii) decrypt a ciphertext from the network using key K2.

Abstract: The invention enables digital music content to be downloaded to and used on a portable wireless computing device. An application running on the wireless device has been automatically adapted to parameters associated with the wireless device without end-user input (e.g. the application has been configured in dependence on the device OS and firmware, related bugs, screen size, pixel number, security models, connection handling, memory etc. This application enables an end-user to browse and search music content on a remote server using a wireless network; to download music content from that remote server using the wireless network and to playback and manage that downloaded music content. The application also includes a digital rights management system that enables unlimited legal downloads of different music tracks to the device and also enables any of those tracks stored on the device to be played so long as a subscription service has not terminated.

Abstract: A method of executing in-session encryption verification includes receiving a plurality of client data packets for transmission through a network; receiving one or more test data packets for verifying an encryption device; merging the client data packets and the one or more test packets into a data stream; selecting security parameters for each packet in the data stream based on a corresponding packet type; encrypting each packet in the data stream using the encryption device and the corresponding security parameters; and transmitting the data stream comprising encrypted packets through the network. The method also includes decrypting the encrypted packets at a receiving system using congruent techniques.

Abstract: A method and system for provisioning credentials is disclosed. The method includes receiving an encrypted data packet including a first passcode and credentials in encrypted form, and a second passcode. The second passcode is compared to a first passcode. If the passcodes match, then a server computer can transmit a token associated with the credentials to a service provider computer.

Abstract: A subscriber identity module (SIM). The SIM comprises a processor, a non-transitory memory storing a configuration file, a wireless identity, a wireless access key, and a remote update agent stored in the non-transitory memory. When executed by the processor, the remote update agent determines that the SIM is communicatively coupled to a wireless communication network via a radio transceiver of a communication device with which the SIM is associated, in response to determining that the SIM is communicatively coupled to the wireless communication network, sends a provide local information (PLI) command to the mobile communication device to acquire network measurement results (NMR) based on the configuration file, transmits NMR data via the radio transceiver using a bearer independent protocol (BIP), receives SIM update information via the radio transceiver, and stores the SIM update information in the configuration file in the non-transitory memory.

Abstract: An aircraft interface device comprising two or more data interface devices, an external data transceiver, a power module, a domain switch, and a controller is disclosed. The two or more data interface devices communicate data, the external data transceiver communicate to an external communication device, and the power module provides power to the two or more data interface devices and the external data transceiver. The two or more data interface devices comprise a first data interface device that communicates with avionics equipment when the first data interface device is powered and a second data interface device that communicates with non-avionics equipment when the second data interface device is powered. The domain switch selectively provides power from the power module to at least one of the two or more data interface devices. The controller provides a data communication path between the selectively powered data interface device and the external data transceiver for the external communication device.

Abstract: A system and method for establishing secure communications over a network based on combined capabilities of classical and quantum computers. The system and method include receiving, by a classical computer via a network, a request for client data associated with a client device. The system and method include encrypting, by the classical computer responsive to the request, the client data using a cryptographic key to generate an encrypted data packet. The system and method include transmitting, by the classical computer via the network, the encrypted data packet to a quantum computer, the encrypted data packet causing the quantum computer to decrypt the encrypted data packet to recover a decrypted data packet.

Abstract: A method of and system for gate-level masking of secret data during a cryptographic process is described. A mask share is determined, wherein a first portion of the mask share includes a first number of zero-values and a second number of one-values, and a second portion of the mask share includes the first number of one-values and the second number of zero-values. Masked data values and the first portion of the mask share are input into a first portion of masked gate logic, and the masked data values and the second portion of the mask share are input into a second portion of the masked gate logic. A first output from the first portion of the masked gate logic and a second output from the second portion of the masked gate logic are identified, wherein either the first output or the second output is a zero-value.

Abstract: A system and method for managing communication. The system and method applying to but not limited to settop boxes (STBs) and other devices used to interface services. The management including any number of features and processes associated with achieving Quality of Service (QoS) across different domains and according to network limitations associated with the same.

Abstract: The present application is directed a computer-implemented methods and systems implementing control policies created or modified by Software Defined Network applications. The control policies can be provided to SDN controllers for implementation.

Abstract: Enterprise users' mobile devices typically access the Internet without being protected by the enterprise's network security policy, which exposes the enterprise network to Internet-mediated attack by malicious actors. This is because the conventional approach to protecting the mobile devices and associated enterprise network is to tunnel all of the devices' Internet communications to the enterprise network, which is very inefficient since typically only a very small percentage of Internet communications originating from an enterprise's mobile devices are communicating with Internet hosts that are associated with threats. In the present disclosure, the mobile device efficiently identifies which communications are associated with Internet threats, and tunnels only such identified traffic to the enterprise network, where actions may be taken to protect the enterprise network.

Abstract: Disclosed are a system and method for calculating elliptic curve cryptography scalar multiplication using an FPGA (Field Programmable Gate Array), the system and method scheduling calculation, which is used in a Montgomery ladder Algorithm, and enabling efficient calculation through an improved modular arithmetic calculation method. The system for calculating elliptic curve cryptography (ECC) scalar multiplication using an FPGA includes: a scheduler implementing Montgomery ladder step calculation in a pipeline structure; a pipeline modular adder/subtractor implementing n-bit modular addition in a d-stage pipeline structure; and a modular multiplier implementing n-bit modular multiplication in a 10-stage pipeline structure up to maximum 256 bits.

Abstract: A method includes authenticating, by a computing device, a first connection between one or more storage units and at least one of the computing device and a first user computing device. The method further includes determining, by the computing device, to add a second connection between the one or more storage units and at least one of the computing device and a second user computing device. The method further includes generating, by the computing device, a secret code and sending the secret code to the one or more storage units via the first connection. The method further includes sending, by the one or more storage units, responses to the secret code to the computing device via the second connection. The method further includes authenticating, by the computing device, the second connection based on the authentication of the first connection and the responses from the one or more storage units.

Abstract: Although TLS provides desirable end-to-end encryption, there are circumstances in which it is desirable or a regulatory requirement for a client to establish a TLS connection through an intermediary that is capable of creating an archival record. There is provided a modification to the TLS protocol that allows an aware client to provide a recovery record to such an intermediary. The recovery record permits the intermediary to verify that the encrypted recovery records can be decrypted by a party that holds the corresponding private key but does not enable decryption by the intermediary.

Abstract: Techniques for providing secured, automatic log-in and authentication of a user to a website via a browser executing at the user's personal electronic device (PED) include generating a token based on an identifier of the PED and a user identifier, and storing the token at the user's PED for use in validating and authenticating the user and device credentials against those stored at back-end system and/or in another memory location at the device. Based on the persisted token (and optionally on a user preference), the user may be automatically logged in as the user navigates across restricted and unrestricted portions of the website, and/or to other websites (e.g., without the user's knowledge). At least these features enable automatic log-in and authentication to be performed on an as-needed basis, and/or on a per-device basis, thereby providing significantly more secure access as compared to known techniques.

Abstract: A device attestation server and method for attesting to the integrity of a mobile device is provided. An attestation request is sent from a mobile device to a device attestation server. The device attestation server runs an attestation method that is supported by the mobile device. The device attestation server creates an attestation token that includes a validation result and a plurality of attributes. The device attestation server sends the attestation token to the mobile device, which performs a validation method using the attestation token.

Abstract: Techniques to enforce policies with respect to managed files and/or endpoints are disclosed. A policy to be applied with respect to one or more files included in a synchronization set and/or an endpoint associated with the synchronization set is received. Compliance with the policy is ensured across a plurality of heterogeneous endpoints associated with the synchronization set.

Abstract: A security apparatus includes a receiver that receives a frame front at least one network, a parameter storage that stores at least one examination parameter defining a content of an examination on a frame, and processing circuitry that performs operations. The operations include judging whether a predetermined condition is satisfied for the frame received by the receiver. When the predetermined condition is satisfied, updating the stored at least one examination parameter, and when the predetermined condition is not satisfied, not updating the stored at least one examination parameter. The operations also include executing an examination, based on the stored at least one examination parameter, as to whether the frame received by the receiver is an attack frame, and performing a process depending on a result of the execution of the examination such that an influence of an attack frame on at least one electronic control unit is suppressed.

Abstract: An anonymized biometric representation of a target individual is used in a computer based security system. A detailed input biometric signal associated with a target individual is obtained. A weakened biometric representation of the detailed biometric signal is constructed such that the weakened biometric representation is designed to identify a plurality of individuals including the target individual. The target individual is enrolled in a data store associated with the computer based security system wherein the weakened biometric representation is included in a record for the target individual. In another aspect of the invention, a detailed input biometric signal from a screening candidate individual is obtained. The detailed biometric signal of the screening candidate is matched against the weakened biometric representation included in the record for the target individual.