Abstract: A computer-implemented method for managing a life-cycle of at least in parts interdependent cryptographic keys is disclosed. Each of the cryptographic keys is signed and relates to a different one of artifacts. The method comprises creating a key manifest, wherein the key manifest comprises data about determined dependencies of the cryptographic keys at a point in time when one of the artifacts is built encrypting the key manifest with a manifest key, and upon a life-cycle change happening to one out of the group comprising one of the artifacts and one of the interdependent cryptographic keys in the key manifest of the one of the artifacts, the method comprises decrypting the key manifest and invoking an action to a related one out of the group comprising the one of the artifacts and at least one of the interdependent cryptographic keys in accordance with the key manifest.

Abstract: In a method for sending packet traffic, an access device transmits a first part of to-be-transmitted traffic to a forwarding controller for check. After the check is passed, the forwarding controller forwards the first part of the to-be-transmitted traffic. The access device transmits a second part of the to-be-transmitted traffic to a first forwarding node, and the first forwarding node forwards the second part of the to-be-transmitted traffic based on received forwarding indication information and forwarding information of the to-be-transmitted traffic.

Abstract: An erroneous transmission, of a record of data, to a distributed ledger system can be prevented. A first operation can confirm that a format of a content within the record of data is correct. A second operation can confirm that formats of elements of a set of information, about authorizations used to cause the record of data to be communicated via the distributed ledger system, are correct. A third operation can confirm that subject matters of the elements and a subject matter of the record of data are the same. A fourth operation can retrieve credentials associated with entities that produced the elements. A fifth operation, using the credentials, can confirm that the entities that produced the elements were authorized to produce them. A sixth operation can confirm that the set of information is sufficient to authorize causing the record of data to be communicated via the distributed ledger system.

Abstract: A server may perform server side authentication of a user device. The user device may generate a first authentication string by performing a hash function on a username, a password, and a first salt. The first authentication string may be registered with the server for subsequent login attempts. At login, the user device generates the first authentication string and transmits the first authentication string to the server. When the authentication strings match, the user device is authenticated. The user device may also update the first authentication string. The server may provide the first salt and a second salt to the user device. The user device may generate a first authentication string and a second authentication string from the first salt and the second salt, respectively. When the first authentication strings match, the server may update the user device's authentication string by replacing it with the second authentication string.

Abstract: The disclosure herein describes the processing of malware scan requests from VCIs by an anti-malware scanner (AMS) on a host device. A malware scan request is received by the AMS from a VCI, the malware scan request including script data of a script from a memory buffer of the VCI. The AMS scans the script data of the malware scan request, outside of the VCI, and determines that the script includes malware. The AMS notifies the VCI that the script includes malware, whereby the VCI is configured to prevent execution of the script or take other mitigating action. The AMS provides scanning for fileless malware to VCIs on a host device without consuming or otherwise affecting resources of the VCIs.

Abstract: A virtual session manager of an electronic device maintains a web session for a user across multiple electronic devices. The virtual session manager receives an authentication request from a first electronic device that is in a communication range of the device. The virtual session manager transmits the authentication request to an endpoint device with a grant token without providing the first electronic device with any access to the grant token. The virtual session manager will receive, from the endpoint device, a first access token in response to the first authentication request. The virtual session manager will transmit the first access token to the first electronic device so that the first electronic device can establish a virtual session with the first web resource.

Abstract: The present disclosure is related to virtual spaces, such as channels, of a communication platform. In some cases, a channel may be designated as a private channel, which may permit access to the private channel by only users joined to the channel and may restrict/prevent access by all other users. The present disclosure is related to solutions for changing the private channel to a public channel, which may allow additional user accounts that were not associated with the private channel to discover and/or access the converted channel.

Abstract: A method at a network element for monitoring user plane traffic for a user equipment, the method including configuring a set of characteristics and a range of values for each of the set of characteristics for user plane traffic between the user equipment and the network element; monitoring user plane traffic for the user equipment at the network element, the monitoring determining whether at least one characteristic of the user plane traffic falls outside of the configured range of a values, resulting in a characteristic violation; and if the at least one characteristic of the user plane traffic falls outside the configured range of a values, performing an action resulting from the characteristic violation.

Abstract: Computing platforms, methods, and storage media for processing a data access request are disclosed. Exemplary implementations may: receive, at an apparatus, a data access request from a communication device and via a network; and generate, at the apparatus and based on the received data access request, a revocable 1:1:1 token that authorizes data sharing for a specific combination of third party application-aggregator-institution. Exemplary implementations may transmit the revocable 1:1:1 token for storage in a token database, and may store the 1:1:1 tokens in a token database associated with an institution related to the data access request; this allows access to be managed by the user and controlled by the institution, without relying on the aggregator. Exemplary implementations may provide a dashboard enabling a user to individually remove apps from data sharing, based on management of the 1:1:1 tokens.

Abstract: A method for performing data encryption and application-agnostic querying of encrypted data includes identifying, via a processor, selected data for encryption. Encryption is applied to the selected data, to produce encrypted data. A query is received at the processor, the query originating from a software application. The query is translated into a modified query compatible with the encrypted data. The processor causes execution of the modified query, to produce query results. The query results include a subset of the encrypted data. The query results are sent to the software application without decrypting the subset of the encrypted data.

Abstract: An apparatus comprising a memory comprising a protected memory region and a processor comprising a trusted execution environment (TEE) to load a library in a shared library region within the protected memory region and execute a plurality of applications to share access to the library in the shared library region.

Abstract: Disclosed are various examples for providing a single sign-on experience for mobile applications that may or may not be managed. A first application executed in a client device sends an access request to a service provider. The first application receives a redirection response from the service provider that redirects the first application to an identity provider. The first application then receives a further redirection response from the identity provider that causes the first application to request an identity assertion from a second application executed in the client device. The first application receives the identity assertion from the second application. The first authentication then authenticates with the service provider using the identity assertion.

Abstract: A method and apparatus for using a dynamic security certificate. The method analyzes a browser to access browser information and generates a dynamic security certificate based on the browser information. The method modifies a configuration file for the browser to cause the browser to trust the dynamic security certificate and inserts the dynamic security certificate into the browser to enable a client application to access encrypted data available to the browser. The method may be performed solely upon a user device or have portions thereof performed by a user device and a server.

Abstract: This disclosure describes embodiments of an improvement to the static group solution because all the administrator needs to do is specify the criteria they care about. Unlike static groups, where the administrator needs to keep track of the status of individual users and move them between static groups as their status changes, smart groups allows for automatic identification of the relevant users at the moment that action needs to be taken. This feature automates user management for the purposes of enrollment in either phishing and training campaigns. Because the smart group membership is determined as the group is about to be used for something, the smart group membership is always accurate and never outdated. The query that determines the smart group membership gets run at the time when you are about to do a campaign or perform some other action that needs to know the membership of the smart group.

Abstract: A method for detecting a fake keypad includes: monitoring outputs of plural magnetic field sensors connected to a keypad; detecting the output of at least one of the magnetic field sensors indicates the presence of a magnetic field; starting, in response to the detecting, a timer; determining the first timer reaches a first threshold while the output of the at least one of the magnetic field sensors still indicates the presence of a magnetic field; in response to the timer reaching the first threshold, determining a number of the magnetic field sensors whose output indicates the presence of a magnetic field equals or exceeds a second threshold; in response to the number of the magnetic field sensors equaling or exceeding the second threshold, determining a security action; and initiating the security action.

Abstract: A first component of an industrial automation system includes an electrically erasable programmable read-only memory (EEPROM) storing data identifying the first component. The data identifying the first component is read from the EEPROM by a second component to which the first component is communicatively coupled to authenticate the first component. The first component lacks a processor and a microcontroller, and does not run firmware.

Abstract: Systems and methods discussed for redirection of launch requests for local applications to corresponding remote applications, such as SaaS or network applications provided by an application server, and access of the corresponding remote application via an embedded browser of a client application. A client application executed by a client device may detect a request of a user to launch a local application of the client device. The client application may determine that the local application corresponds to a network application provided by an application server. The client application may intercept the request to launch the local application, responsive to the determination. An embedded browser of the client application may access the network application from the application server, responsive to interception of the request.

Abstract: According to an example aspect of the present invention, there is provided a method, comprising receiving from a source entity a workflow description for network based media processing (200), determining encryption requirements on the basis of an encryption descriptor in the workflow description, the encryption descriptor comprising information indicative of one or more encryption methods and at least one prioritized encryption method (210), and selecting, on the basis of the encryption descriptor, an encryption method for protecting data for at least one task of a media processing workflow generated on the basis of the workflow description (220).

Abstract: A cross-site scripting (XSS) risk analysis method based on a Bayesian network and a STRIDE model includes: constructing an XSS attack-related STRIDE threat model of a network information release system; obtaining a network structure of a Bayesian network-based XSS attack risk analysis model based on the STRIDE model; obtaining prior probabilities of all nodes in the network structure of the Bayesian network-based XSS attack risk analysis model based on expert experience and a node ranking algorithm; obtaining a training dataset through simulation by using a rejection sampling algorithm or a direct sampling method; performing network training on the network structure of the Bayesian network-based XSS attack risk analysis model by using the training dataset to obtain the Bayesian network-based XSS attack risk analysis model; and reasoning a Bayesian network to obtain a quantitative analysis result of an XSS attack risk of the network information release system.

Abstract: A system comprising a distributed ledger (BC) configured to store a smart contract (SB) related to a problem statement (Z), the smart contract (SB) enabling a zero-knowledge proof (ZK) concerning the problem statement (Z).