Abstract: Various systems, mediums, and methods may involve a data engine with various components. For example, a system with the data engine may include a segmentation component, an asset preparation component, a clustering component, a variable generation component, and classification component. As such, the system may determine a number of assets associated with a number of activities of one or more accounts. Further, the system may determine various links associated with the number of assets. As such, the system may detect an attack and/or an attack trend associated with the one or more accounts based on the various links associated with the number assets. Further, the system may generate a notification that indicates the attack and/or the attack trend detected.

Abstract: A device receives end user device information for end user devices associated with a network, and creates a data structure that includes the end user device information. The device creates a data structure that includes false account credentials, and maps the end user device information and the false account credentials to create a mapped data structure. The device provides the false account credentials to memory locations of corresponding ones of the end user devices, and provides information from the mapped data structure to one or more network devices associated with the network, wherein the information from the mapped data structure enables the one or more network devices to detect an unauthorized access attempt of the network using one or more of the false account credentials.

Abstract: A method for providing additional security for a blockchain wallet through the use of a dynamic pseudo key confirmed through digit positioning includes: storing digit pairs, each including a predefined value and a character position; receiving a dynamic pseudo key and transaction information, where the key includes characters in set positions and the transaction information includes a destination address and data value; validating that the dynamic pseudo key has not been used for a prior blockchain transaction; validating that the characters in set positions in the dynamic pseudo key includes the predefined value in the corresponding character position for each of the digit pairs; generating a digital signature using a private key after successful validation of the dynamic pseudo key; and transmitting the digital signature and transaction information to a node in a blockchain network associated with a blockchain.

Abstract: A hardware secure module includes a processing unit and a cryptographic coprocessor. The cryptographic coprocessor includes a key storage memory; a hardware key management circuit configured to store a first cryptographic key in the key storage memory; a first interface configured to receive source data to be processed; a second interface configured to receive the first cryptographic key from the processing unit for storing in the key storage memory; a hardware cryptographic engine configured to process the source data as a function of the first cryptographic key stored in the key storage memory; and a third interface configured to receive a second cryptographic key. The hardware secure module further includes a non-volatile memory configured to store the second cryptographic key; and a hardware configuration module configured to read the second cryptographic key from the non-volatile memory and send the second cryptographic key to the third interface.

Abstract: Some embodiments provide a method for a first data compute node (DCN) operating in a public datacenter. The method receives an encryption rule from a centralized network controller. The method determines that the network encryption rule requires encryption of packets between second and third DCNs operating in the public datacenter. The method requests a first key from a secure key storage. Upon receipt of the first key, the method uses the first key and additional parameters to generate second and third keys. The method distributes the second key to the second DCN and the third key to the third DCN in the public datacenter.

Abstract: Software development kit (“SDK”) applications may be implemented with user data on an enterprise end-user or shared device subsequent to a single check-out process on the device. A user profile and a context ID for a user can be accessed based on user provided credentials. An agent application can set a value of an agent context ID to a server context ID corresponding to the context ID for the user profile. A status of a local context ID (“LCID”) of an SDK application can be determined in response to an application launch. Using the LCD, a context ID comparison can be performed on the device with a value of a context ID from one of the SDK application, the server, and the agent application based on the LCID status. The SDK application can be implemented with user specific user data obtained from one of the SDK application and the agent application based on a result of the context ID comparison.

Abstract: Software development kit (“SDK”) applications may be implemented with user data on an enterprise end-user or shared device subsequent to a single check-out process on the device. A user profile and a context ID for a user can be accessed based on user provided credentials. An SDK application can be identified as one application of an application cluster including at least two applications. A status of a local context ID (“LCID”) of the SDK application can be determined, and a value for the LCID can be established based on the status and a value of a comparison context ID obtained from a server or an agent application. The LCID and a context ID for a keychain for the application cluster can be compared, and the SDK application can be implemented with user specific user data obtained from the agent application or the keychain based on a result of the comparison.

Abstract: The solutions disclosed enable security credentials to be shared between two entities. Embodiments of the present invention can be used to facilitate the transfer security credentials associated with a first level of permission of a first entity to a second entity that does not have the security credentials associated with the first level of permission in response to receiving a request to share security credentials between two entities.

Abstract: A system including a network communication device, a storage device, and a controller is provided. The storage device stores first mappings between IP addresses and devices, and second mappings between software and devices. The controller obtains a connection log from the proxy server or the firewall device via the network communication device, uses the first mappings and the second mappings to analyze the connection log to determine one or more different connections between connections of devices on which first software is installed and connections of devices on which the first software is not installed, determines whether the first software functions normally on a first device blocking the different connections, and adds destination addresses of the different connections into a blocking list in response to the first software functioning normally on the first device, such that the proxy server or the firewall device blocks all connections towards the destination addresses.

Abstract: A collection of documents or other files and the like within an enterprise network are labelled according to an enterprise document classification scheme, and then a recognition model such as a neural network or other machine learning model can be used to automatically label other files throughout the enterprise network. In this manner, documents and the like throughout an enterprise can be automatically identified and managed according to features such as confidentiality, sensitivity, security risk, business value, and so forth.

Abstract: In various embodiments, a request is received for a claim that is responsive to an interrogatory, where the interrogatory uses values of items of interest regarding a subject user to produce the claim. Based on the request, it is determined that one or more permissions, included in one or more digitally signed transactions of one or more transaction blocks on one or more copies of a blockchain maintained at least in part by nodes of a distributed ledger system, represents the subject user granting a receiving entity with a right to receive claims that are responsive to interrogatories that use the values to produce the claims. Based on the determining, the receiving entity is granted access to the claim.

Abstract: A method for authenticating a user is presented. Responsive to a request for access to a computer resource, a computer system prompts the user making the request to access the computer resource to perform a new motion in an environment in which the user is monitored by a sensor system. Detected biometric data in the new motion performed by the user is identified by the computer system. A determination is made as to whether the user performing the new motion is an authenticated user based on comparing the detected biometric data with stored biometric data for a prior motion performed by the authenticated user. The computer system provides access to the computer resource when the user is identified as the authenticated user.

Abstract: Example implementations relate to protecting data of a particular data type. For example, a system for protecting data of a particular type may include a configuration engine to receive a stream of data, where a portion of the stream of data includes data of a particular data type. The configuration engine may determine the particular data type to be protected based, at least in part, on a format associated with the stream of data. Further, the system for protecting data of a particular type may include a cryptography engine to protect the data of the particular data type, and a generation engine to output the stream of data such that at least the data of the particular data type is protected.

Abstract: Some embodiments of the invention provide a system for defining, distributing and enforcing policies for authorizing API (Application Programming Interface) calls to applications executing on one or more sets of associated machines (e.g., virtual machines, containers, computers, etc.) in one or more datacenters. This system has a set of one or more servers that acts as a logically centralized resource for defining and storing policies and parameters for evaluating these policies. The server set in some embodiments also enforces these API-authorizing policies. Conjunctively, or alternatively, the server set in some embodiments distributes the defined policies and parameters to policy-enforcing local agents that execute near the applications that process the API calls.

Abstract: A request to add tags (e.g., labels, key-value pairs, or metadata) to resources can be digitally signed by the entity making the request, such that the source can be verified and an authorization determination made for each tag. For a request involving multiple services (or entities) that can each add tags, any tag added by a service can be included in the request and digitally signed by that service. Each service processing the request can also digitally sign the request before forwarding, so that each service signs a version of the request, which includes elements signed by other services earlier in the request chain. When the request is received to a tagging service, the service ensures that every tag was digitally signed by the appropriate authorized entity or service, and validates the signatures to ensure that no data was modified or omitted, before adding the tags to the designated resource(s).

Abstract: Example methods, apparatus, systems and articles of manufacture (e.g., physical storage media) to implement contextual key management for data encryption are disclosed. Example apparatus disclosed herein to perform contextual encryption key management, which are also referred to herein as contextual key managers, include an example context discoverer to discover context information associated with a request to access first encrypted data. Such disclosed example apparatus also include an example contextual key mapper to identify a combination of context rules associated with a key that is to provide access to the first encrypted data, validate the context information associated with the request based on the combination of context rules associated with the key to determine whether the request to access the first encrypted data is valid, and obtain the key from a key management service when the request to access the first encrypted data is valid.

Abstract: A wearable device may store a biometric token associated with a wearer of the wearable device, the wearable device including: a wireless communications interface; a processing circuitry; a memory configured to store a biometric token associated with a wearer of the wearable device, the biometric token including a device identifier that is associated with the wearable device, a biometric template for each of one or more biometric scans of the wearer of the wearable device, and an indication of whether or not the biometric token is valid, wherein the biometric token, if valid, establishes a trust that wearer identifying information, linked to the biometric token, is associated with the wearer; an invalidating event detector configured to determine if an invalidating event has occurred; wherein the processing circuitry is configured to invalidate the biometric token in response to detecting that an invalidating event has occurred for the biometric token.

Abstract: A threat actor identification system that obtains domain data for a set of domains, generates domain clusters, determines whether the domain clusters are associated with threat actors, and presents domain data for the clusters that are associated with threat actors to brand owners that are associated with the threat actors. The clusters may be generated based on similarities in web page content, domain registration information, and/or domain infrastructure information. For each cluster, a clustering engine determines whether the cluster is associated with a threat actor, and for clusters that are associated with threat actors, corresponding domain information is stored for presentation to brand owners to whom the threat actor poses a threat.

Abstract: Apparatus, system and method useful for machine to machine (M2M) communication cyber-attack detection and prevention, are provided. An embedded security bridge (ESB), operatively connected to at least one proximal machine and at least one M2M module. The M2M module is in communication with at least one remote machine, and configured to enable communication between at least one remote machine and at least one proximal machine through the ESB. The ESB includes: one or more inspection units, configured for communication analysis for identifying communication and/or content suspicious as malicious, and, one or more decision units operatively connected to the inspection unit. The decision unit is configured to perform at least one action based on analysis of at least one inspection unit. The ESB is configured to detect by means of the inspection unit and prevent by means of the decision unit cyber-attacks on the proximal machine, the remote machine, or both.

Abstract: A method for securing D2D communications may comprise: encrypting communication data based at least in part on a security policy associated with at least one of a general trust evaluation and a local trust evaluation; and sending the encrypted communication data from a first user equipment to one or more second user equipments, wherein the second user equipment of which at least one of a general trust evaluation result and a local trust evaluation result satisfies the security policy set by the first user equipment is eligible to access the encrypted communication data.