Abstract: A secure cartridge-based storage system includes a set of read/write control electronics on a shared controller adapted to removably couple with each of a plurality of storage cartridges. Data blocks within primary non-volatile memory of the cartridge-based storage system collectively comprise a main store with information-theoretic security. The shared controller incorporates various controls for providing selective data access to individual data magazines and/or cartridges as well as for partitioning user data and writing the partitioned data according to an information-theoretic security scheme and reading the partitioned data and reconstructing the user data from the partitioned data.

Abstract: In one embodiment, a device obtains one or more packets of a traffic session in a network. The device determines, for a particular packet of the one or more packets that match a filter, a fingerprint for the particular packet. The device identifies a plurality of traffic sessions whose packets match the fingerprint, wherein each of the plurality of traffic sessions is associated with at least one process. The device updates a process with the traffic session by applying a classifier to the plurality of traffic sessions.

Abstract: Some embodiments of the invention provide a novel method for specifying firewall rules. In some embodiments, the method provides the ability to specify for a particular firewall rule, a set of network nodes (also called a set of enforcement points below) at which the particular firewall should be enforced. To provide this ability, the method of some embodiments adds an extra tuple (referred to below as the AppliedTo tuple) to a firewall rule. This added AppliedTo tuple lists the set of enforcement points at which the firewall rule has to be applied (i.e., enforced).

Abstract: A middleware system and corresponding methods are described whereby data communications, either inter-device or intra-device, are coordinated using a set of cryptographic identifiers that correspond to computing elements, such as interfaces, methods, parameters, classes, among others, the identifiers used for authentication against an access control list to determine whether an originator device is permitted to use a computational element. The cryptographic identifiers are coupled to data messages being sent across the middleware system.

Abstract: A middleware system and corresponding methods are described whereby data communications, either inter-device or intra-device, are coordinated using a set of cryptographic identifiers that correspond to computing elements, such as interfaces, methods, parameters, classes, among others. The cryptographic identifiers are coupled to data messages being sent across the middleware system and processed to indicate adherence to protocol standards and/or to cause transformation of the data messages such that the receiver receives a data message adhering to their acceptable protocol standards.

Abstract: A center device includes: a consent request unit that is configured to make a consent request to a plurality of devices for data distribution to a vehicle; a consent determination unit that is configured to judge a consent response from each of the plurality of devices; a distribution control unit that is configured to control the data distribution to the vehicle according to a determination result by the consent determination unit; and a necessity determination unit that is configured to determine whether the consent request to the plurality of devices is needed before the consent request are made to the plurality of devices. The consent request unit is further configured to determine whether to make the consent request to the plurality of devices according to a determination result by the necessity determination unit.

Abstract: The described technology is generally directed towards an automated security hangar for private cellular networks. In response to detecting that a user equipment is departing a geographic area served by a private cellular network, the user equipment can encrypt its data and send it to a private cellular network server. The server can receive and securely store the encrypted data, and the server can provide a code to the user equipment. The user equipment can store the code, disconnect from the private cellular network, and depart the geographic area. When the user equipment returns to the geographic area and reconnects to the private cellular network, the user equipment can present the code to the server. The server can validate the code, the user equipment, and/or the operator of the user equipment, and the server can return the encrypted data to the user equipment.

Abstract: The technology disclosed herein enables generation of effective permissions between principals and resources from access policies. In a particular embodiment, a method includes, in an effective permissions service, retrieving one or more access policies that define access permissions between a principal and a resource of the plurality of resources. The method also includes determining an effective permission defining the access of the principal to the resource based on the access policies and defining the effective permission in a canonical format. The method further includes storing the effective permission for reference when the principal attempts to access the resource.

Abstract: Embodiments include a system, method, and computer program product that enable secure access to cameras in smart buildings. Some embodiments control outbound video from an environment such as a local network through an intelligent on-event video pushing mechanism. The local intelligent on-event video pushing mechanism hides the IP address of a source video camera, transcodes the video to a reduced size for wide area distribution, and pushes video to a recipient upon an event triggered received within the local environment (e.g., the local network.) Embodiments enable a remote video client on the far-side of the local network firewall to view the video streams of cameras on the near-side of the local network firewall when an event or trigger occurs.

Abstract: Aspects of the current subject matter are directed to performing privacy-preserving analytics over sensitive data without sharing plaintext data and without requiring a trusted third party. Implementations provide for utilizing a trusted execution environment within a server to compute the privacy-preserving result. Data owners via user devices send their encrypted data directly to an enclave managed by a trusted execution environment, without the server and the cloud service provider for the server seeing the plaintext data. The enclave computes the analytics directly on the data and releases the privacy-preserving result that can be ensured by code analysis and remote attestation from all parties.

Abstract: A system and related methods that generate encryption keys using two inputs. The first input is random data measured or supplied at the time the encryption keys are created. The second input is predetermined data held by the server and device. Given knowledge of the predetermined data and the random data, the UxS will be able to regenerate its previous encryption keys and also to re-establish communication by the server and device.

Abstract: In general, embodiments of the invention relate to a method and system for managing a storage system. In many traditional implementations host bus adapter (HBA) manages the storage device, however frequently the HBA cannot implement the necessary methods to secure a self-encrypting drive (SED). One or more embodiments of the invention use a baseboard management controller (BMC) to manage the security of the SEDs as well as the security life cycle of the SEDs, while the HBA acts as a passthrough conduit between the SED and BMC.

Abstract: A device including a registration unit, access permission unit, and an access prohibition unit. The registration unit registers a surveillance camera that is a work target. The access permission unit permits access from a worker terminal to an image captured by the registered surveillance camera via a surveillance network to which the surveillance camera is connected. The access prohibition unit configured to prohibits the access in response to work on the surveillance camera being completed. Security of the image captured by the surveillance camera is thereby enhanced.

Abstract: Methods and systems are provided for identifying the true identity of senders of messages, for example based on hardware identifiers and other information, such as timestamps and/or register-transfer level licenses. In some cases, a hyper ledger provides a protocol for combining information such as hardware identifiers (for example silicon identification information) with other information and logic instructions to generate ledger identifications. Embodiments can be used to authorize transmission of messages, such as SMS or RCS messages, and to provide an archive or message information. In some cases, messages from certain domains can be aggregated for routing.

Abstract: A method of facilitating generation of a verifiable and immutable record. The method comprises, at a user device, obtaining a data file, generating an audit file for the data file, and separately hashing the data file and the audit file. The method further comprises storing the data file, the audit file and the hash values in a secure memory location, access to which is controlled, and preventing changes to the stored data by a user. When access is available to a remote server system, the stored data is sent to the remote server system and, in response, a notification received over confirming that the remote server system has verified the data file and the audit file and has created an immutable record of both. The user is then permitted to change the stored data file and or audit file in the secure memory location.

Abstract: A secure programming system and method for provisioning and programming a target payload into a programmable device mounted in a programmer. The programmable devices are provisioned with a job package created by a user on a host system and deployed on a device programmer. The secure programming system supports a hardware security module on the host system that can be accessed remotely from the device programmer using coordinated sets of template and mechanism dictionaries linked to a security API coupled to the hardware security module.

Abstract: Embodiments of the present disclosure provide techniques for associating use case data with data listings in a structured manner, thereby allowing for data listings to be organized and/filtered based on use case information. A processing device may provide a listing creation interface that is used to assign a set of use cases to a first data listing and publish the data listing on a data exchange. The data listing is one of a plurality of data listings published on the data exchange and the processing device may provide a data listing interface for displaying the plurality of data listings and an interactable menu including a selectable indication of each of the plurality of use cases. In response to receiving a selection of one or more of the plurality of use cases via the interactable menu, the processing device may display in the data listing interface, each of the plurality of data listings that have been assigned any of the selected one or more use cases.

Abstract: A system for telemedicine diagnostics through remote sensing includes a computing device configured to initiate a communication interface between the computing device and a client device operated by a human subject, wherein the secure communication interface includes an audiovisual streaming protocol, receive, from at least a remote sensor at the human subject, a plurality of current physiological data, generate a clinical measurement approximation as a function of the change of a first discrete and a second discrete set of current physiological data, wherein generating further comprises receiving approximation training data correlating physiological data with clinical measurement data, training a measurement approximation model as a function of the training data and a machine-learning process, and generating the clinical measurement approximation as a function of the current physiological data and the measurement approximation model, and presenting the clinical measurement approximation to a user of the comp

Abstract: In one aspect the present invention disclose system for recording and handling media for use as evidence in legal proceeding. In one other aspect the present invention discloses a device for recording media for use as evidence in legal proceedings. In another aspect the present disclosure provides a server also referred to herein as an evidence vault or vault for handling media from a media recording device for use as evidence in legal proceedings. The all three aspects the invention benefit from a double layer symmetrical and asymmetrical encryption method to protect the media recordings of the device, the server and the system as a whole as well as the transmission of media between different components.

Abstract: Cloud delivered access may be provided. A network device may provide a client device with a pre-authentication virtual network and a pre-authentication address. Next, a policy may be received in response to the client device authenticating. The client device may then be moved to a post-authentication virtual network based on the policy. A post-authentication address may then be obtained for the client device in response to moving the client device to a post-authentication virtual network. Traffic for the client device may then be translated to the post-authentication address.