Abstract: Authentication is performed on a plurality of links coupling one node of the computing environment and another node of the computing environment. The performing authentication includes obtaining by the one node a shared key from a key server coupled to the one node and another node of the computing environment. A message encrypted with the shared key is sent from the one node to the other node via one link of the plurality of links. An indication that the other node decrypted the message using the shared key obtained by the other node is received from the other node via the one link. The sending and the receiving are repeated on one or more other links of the plurality of links using the shared key previously obtained.

Abstract: Provided are systems, methods, and media for multiphase graph partitioning for malware entity detection. An example method includes receiving an input string associated with the malware entity. A determination is made as to whether the input string includes a symbolic word, a non-symbolic word, a symbolic phrase, or a non-symbolic phrase. A branching graph is formed based on a combination of the input string and a plurality of stored strings that are each associated with the malware entity to determine whether the input string is a valid detection name of the malware entity, in which the branching graph is formed by at least performing a first graph partitioning stage and a second graph partitioning stage. The input string is then labeled based on the formed branching graph and then outputted to a malware detection engine.

Abstract: Methods and systems are described for managing a user's contact data which use evolving sequential sets of rules where the applicability of each set depends upon adherence or proper application of a prior set. In an embodiment, an initial set of restrictions are generated based on input from a first user, the restrictions relating to contact made by a second user to the first user. These initial restrictions are subsequently modified in response to the second user contacting the first user based on the contact made and a characteristic of the contact. The methods may apply to any form of contact between the first and second users and in an embodiment applies to contact made by the second user to a cellular telephone number belonging to the first user.

Abstract: This invention discloses systems and methods for detecting vulnerabilities in IT assets by utilizing crowdsourcing techniques. A corpus containing vulnerability data of IT assets with known vulnerabilities is established. Vulnerability data in the corpus comprises security aspects or attributes related to the IT assets. The security aspects of an IT asset constitute its attack surface which is represented as a feature vector in a feature space. A determination is made as to how similar/close a target asset whose unknown vulnerabilities are to be detected, is to the rest of the IT assets in the corpus. This determination is made based on a measure of similarity/distance between the respective feature vectors in the feature space. Based on the review of similarity results by a community of researchers/experts, a determination of unknown vulnerabilities in the target system is made.

Abstract: Implementations of the disclosure provide for secret keys management in a virtualized data-center. In one implementation, a system is provided. The system comprises a memory to store secret key data and a processing device coupled to the memory. The processing device is to identify authentication information provided by a user, the authentication information comprising access information associated with a data storage domain, receive a secret key to access the data storage domain in view of the authentication information, wherein the secret key comprises a universally unique identifier (UUID), and register the secret key, wherein to register the secret key, the processing device to store a data structure in volatile memory indicating an association between the UUID of the secret key and the hypervisor.

Abstract: A data communication device for storing image data input by scanning an original document in an external storage device includes a scanner, an inputting unit, a log-in processing unit, and a processing unit. The scanner scans an original document to input image data. The inputting unit inputs identification information. The log-in processing unit causes a user who is authenticated based on the input identification information to log into the data communication device. The processing unit performs data processing to store image data input by the scanner in an external storage device which is accessible based on the input identification information.

Abstract: Methods and systems for verifying asset identity. The system includes a rules engine executing a corpus of rules to analyze received fingerprint data regarding one or more assets in a network. The rules engine may execute the rules to create a synthetic fingerprint to provide more accurate and helpful information regarding a network asset.

Abstract: According to an example aspect of the present invention, there is provided an apparatus comprising a receiver configured to receive, from a first node, an indication of privacy preference and, from a second node, an indication relating to an accuracy at which the second node can determine a location of the first node (510), and at least one processing core configured to determine routing information based at least in part on the indication of privacy preference and the indication relating to the accuracy (520).

Abstract: Disclosed herein are methods and systems for validating an autonomous system that comprises a static-code module and a dynamic-code module, the method including the steps of performing a code-integrity-validation process on the static-code module and performing a behavior-integrity-validation process on the dynamic-code module. In some embodiments, performing the code-integrity-validation process on the static-code module includes performing a signature-verification process on the static-code module. In some embodiments, performing the behavior-integrity-validation process on the dynamic-code module includes using an encrypted-and-signed test vector.

Abstract: A method for securing a digital document comprising first and second types of data, where a set of data of the second type is previously identified in an initial version of the document. For each data of the second type, an identifier is allocated to the data and an entry comprising the data is stored in a secure storage unit. The identifier comprises a display value and a link value. The data is reachable in the secure storage unit through the link value. The secure storage unit is configured to use access rules for authorizing or denying a request initiated by a user for accessing data of the second type contained in an entry of the secure storage unit. An updated version of the digital document is generated by replacing each data of the second type by its allocated identifier in the initial version of the digital document.

Abstract: There is described a computer device, including at least a processor and a memory, configured to control process components on the computer device, the computer device comprising: an operating system, a privilege access management service cooperating with the operating system and an agent; wherein the agent is configured to: intercept a request to instantiate a new process component in a user account of a logged-in user, wherein the request originates from an instance of a particular process component amongst a set of process components and wherein the user account has assigned thereto default user privileges by the privilege access management service; determine whether to permit the intercepted request including by: validating a relationship between the new process component and the particular process component; and establishing a set of identified owners by identifying owners of the new process component, the particular process and any parents thereof; permit the intercepted request if the relationship is v

Abstract: A method, computer system, and a computer program product for detecting a malicious activity with respect to an application hosted on a server is provided. The present invention may include collecting user activity data associated an application accessed remotely over a network and generating a graph from the collected user activity data. Each node of the graph may represent a set of user requests received from a user with respect to a location within the application and each connection between nodes may represent a user navigable path between locations within the application. The present invention may include storing the generated graph and monitoring subsequent user activity with respect to the application. The present invention may include detecting a subsequent user activity that does not match the stored graph.

Abstract: A method is provided for providing a notary service for a file, the method includes the steps in which: (a) when a notary service request for a specific file is obtained, server generates, by using a hash function, or supports the generation of, a message digest of the specific file; and (b) if a predetermined condition is satisfied, the server registers, in a database, or supports the registration of, a representative hash value or a value obtained by processing the representative hash value, the representative hash value being generated by calculating at least one neighboring hash value that matches a specific hash value, wherein the specific hash value is a hash value of the result of encrypting the message digest with a private key of a first user, a private key of a second user and a private key of the server.

Abstract: Enterprise users' mobile devices typically access the Internet without being protected by the enterprise's network security policy, which exposes the enterprise network to Internet-mediated attack by malicious actors. This is because the conventional approach to protecting the mobile devices and associated enterprise network is to tunnel all of the devices' Internet communications to the enterprise network, which is very inefficient since typically only a very small percentage of Internet communications originating from an enterprise's mobile devices are communicating with Internet hosts that are associated with threats. In the present disclosure, the mobile device efficiently identifies which communications are associated with Internet threats, and tunnels only such identified traffic to the enterprise network, where actions may be taken to protect the enterprise network.

Abstract: A gateway serving as a security apparatus connected to one or a plurality of buses includes a receiver that receives a frame from a bus, a parameter storage that stores an examination parameter defining a content of an examination of the frame, an updater configured to, in a case where a predetermined condition is satisfied for the frame received by the receiver, update the examination parameter stored in the parameter storage, and an examiner that performs an examination, based on the examination parameter stored in the parameter storage, in terms of judgment of whether or not the frame received by the receiver is an attack frame.

Abstract: A method is provided for providing a notary service for a file, the method includes the steps in which: (a) when a notary service request for a specific file is obtained, a server generates, by using a hash function, or supports the generation of, a message digest of the specific file; and (b) if a predetermined condition is satisfied, the server registers, in a database, or supports the registration of, a representative hash value or a value obtained by processing the representative hash value, the representative hash value being generated by calculating at least one neighboring hash value that matches a specific hash value, wherein the specific hash value is a hash value of the result of encrypting the message digest with a private key of a first user, a private key of a second user and a private key of the server.

Abstract: A security system includes a physical unclonable function circuit, a write-in protection circuit, a memory, and a readout decryption circuit. The physical unclonable function circuit provides a plurality of random bit strings. The write-in protection circuit receives a write-in address and original data, and includes an address scrambling unit. The address scrambling unit generates a scrambled address by scrambling a write-in address according to a random bit string provided by the physical unclonable function circuit. The memory stores the storage data corresponding to the original data according to the scrambled address. The readout decryption circuit reads out the storage data from the memory according to the write-in address to derive the original data.

Abstract: Systems and methods are disclosed herein for determining the validity of certificates possessed by a plurality of computer system instances operating under a service of a computing resource service provider. A certificate authority may hold an election to determine an intermediary computer system instance among the plurality of computer system instances to communicate between the certificate authority and the plurality of computer system instances. The intermediary instance may receive a set of certificate fingerprints from the plurality of computer system instances. The intermediary instance may compare the set of certificate fingerprints to a valid certificate fingerprint generated using a valid certificate to determine the validity of certificates possessed by the plurality of computer system instances. The intermediary instance may generate a report based on the determination of the validity of the certificates.

Abstract: Methods, media, and systems for detecting attack are provided. In some embodiments, the methods include: comparing at least part of a document to a static detection model; determining whether attacking code is included in the document based on the comparison of the document to the static detection model; executing at least part of the document; determining whether attacking code is included in the document based on the execution of the at least part of the document; and if attacking code is determined to be included in the document based on at least one of the comparison of the document to the static detection model and the execution of the at least part of the document, reporting the presence of an attack.

Abstract: A communication method and system according to the present invention generates a unique cryptographically secure URI in response to receiving a user post. The user post and URI are stored temporarily. The URI is sent to an intended recipient. In response to a first instance of accessing the URI, the content is retrieved and sent to the intended recipient. The original uploaded content and URI are then deleted. In response to subsequent instances of accessing the URI, random content determined in part by a current environmental state of the communication, is returned. Recent subsequent instances can return thematically similar content.