Abstract: A server receives a request from a client to establish a secure session. The server analyzes the request to determine a set of one or more properties of the request. The server selects, based at least in part on the determined set of properties, one of multiple certificates for a hostname of the server, where each of the certificates is signed using a different signature and hash algorithm pair. The server returns the selected certificate to the client.

Abstract: A server establishes a secure session with a client device where a private key used in the handshake when establishing the secure session is stored in a different server. During the handshake procedure, the server receives a premaster secret that has been encrypted using a public key bound with a domain for which the client device is attempting to establish a secure session with. The server transmits the encrypted premaster secret to the different server for decryption along with other information necessary to compute a master secret. The different server decrypts the encrypted premaster secret, generates the master secret, and transmits the master secret to the server. The server receives the master secret and continues with the handshake procedure including generating one or more session keys that are used in the secure session for encrypting and decrypting communication between the client device and the server.

Abstract: Managing private key access in multiple nodes is described. A piece of data (e.g., a private key) is encrypted using identity-based broadcast encryption and identity-based revocation encryption so that only certain servers in a distributed network of servers can decrypt the piece of data. The piece of data is encrypted with a key encryption key (KEK). The KEK is split into two pieces. The first piece is encrypted using identity-based broadcast encryption with a first set of identities as input such that only servers of the first set of identities can decrypt the first piece, and the second piece is encrypted using identity-based revocation encryption so that all servers except those that have the second set of identities can decrypt the second piece. The keys are transmitted to the servers.

Abstract: A server receives a piece of data for encryption. The server encrypts the piece of data such that no single key can decrypt the encrypted piece of data and any combination of a first multiple of unique keys taken a second multiple at a time are capable of decrypting the encrypted piece of data. Each of the first multiple of unique keys is tied to account credentials of a different user. The second multiple is less than or equal to the first multiple. The encrypted piece of data is returned.

Abstract: Systems and methods for rapidly verifying income are disclosed.

Abstract: Methods and apparatuses for identifying a domain of a command and control server of a botnet are described. Upon receipt of a request to register a domain for a service that includes a proxy server, where the proxy server is to receive and process traffic for that domain if registration is successful, a determination of whether the domain was generated by a domain generation algorithm (DGA) is performed. Responsive to determining that the domain was generated by the DGA, accepting registration of the domain for the service and causing the proxy server to monitor communications received to and from the domain.

Abstract: A method and apparatus for enabling an HSTS policy for a subdomain of a domain is described. A request for content at a subdomain of a domain is received at a proxy server from a client device over a secure transport. The proxy server determines whether the subdomain is associated with a rule indicating that Hypertext Transport Protocol Strict Transport Security (HSTS) is to be enabled for the subdomain of the domain. Responsive to determining that the subdomain is associated with the rule, the proxy server transmits, to the client device, a first response that includes an HSTS header and which instructs the client device to communicate only over the secure transport for requests for content at the subdomain, wherein the first response includes the HSTS header regardless of whether HSTS has been enabled for the subdomain at an origin server.

Abstract: Managing private key access in multiple nodes is described. A piece of data (e.g., a private key) is encrypted using identity-based broadcast encryption and identity-based revocation encryption so that only certain servers in a distributed network of servers can decrypt the piece of data. The piece of data is encrypted with a key encryption key (KEK). The KEK is split into two pieces. The first piece is encrypted using identity-based broadcast encryption with an identified location as input such that only servers of the identified location can decrypt the first piece, and the second piece is encrypted using identity-based revocation encryption so that certain identified servers of the identified location cannot decrypt cannot decrypt the second piece. The keys are transmitted to the servers.

Abstract: A tread wear indicator for a tire is provided. The tire includes a pair of sidewalls and a tread and the tread includes a plurality of circumferential grooves and a plurality of lateral grooves. The tread wear indicator is formed in a selected one of the lateral grooves adjacent a selected one of the circumferential grooves. The indicator includes a plurality of step elements descending from a radially outward surface of the tread toward the base of the selected one of the lateral grooves. Each step element includes an axially-extending surface that is approximately parallel to and is radially inward of the radially outward surface of the selected one of the tread elements, and a radially-extending surface that extends approximately perpendicular to the axially-extending surface. The axially-extending surface of each step element is formed with indicia visible to a user of the tire.

Abstract: A first server establishes a secure session with a client device where a private key used in the handshake when establishing the secure session is stored in a different, second, server. The first server transmits messages between the client device and the second server where the second server has access to a private key that is not available on the first server. The first server receives from the second server a set of session key(s) used in the secure session for encrypting/decrypting communication between the client device and the first server. The session key(s) are generated using a master secret that is generated using a premaster secret generated using Diffie-Hellman public values selected by the client device and the second server. The first server uses the session key(s) to encrypt/decrypt communication with the client device.

Abstract: Components are disclosed which include a first component section and a second component section joined to form a hollow structure defining a plenum having an interior surface, wherein the component sections each include mating ridges joined together along the length of the plenum, and a corrosion-resistant cladding layer including a corrosion-resistant material overlaying the interior surface of the plenum. In one embodiment, the component is a gas turbine combustor fuel manifold. A method of forming the components includes applying corrosion-resistant segments including a corrosion-resistant material to each of the surfaces of the component sections, and joining the component sections to form the component, wherein joining the component sections includes fusing the corrosion-resistant segments into the corrosion-resistant cladding layer, and joining the mating ridges of the component sections.

Abstract: A non-volatile memory system may include a write task queue that queues write commands and a garbage collection module that analyzes information about pending write commands in the write task queue in order to perform garbage collection. Based on its analysis of the write task queue, the garbage collection module performs discouraging actions to discourage itself from selecting certain blocks in a candidate list to be source blocks for garbage collection. In addition or alternatively, the garbage collection module performs encouraging actions to encourage itself to select blocks storing current valid data associated with a write command as source blocks for garbage collection. Write amplification may be reduced as a result of the discouraging and encouraging actions.

Abstract: Methods and apparatuses for identifying a domain of a command and control server of a botnet are described. Upon receipt of a request to register a domain for a service that includes a proxy server, where the proxy server is to receive and process traffic for that domain if registration is successful, a determination of whether the domain was generated by a domain generation algorithm (DGA) is performed.

Abstract: A DNS server receives, from a client device, a DNS query for a resource record type at a domain name. The DNS server determines that the resource record type does not exist at the domain name and generates an answer that indicates that the queried resource record type does not exist at the domain name and also indicates that a plurality of other resource record types exist at the domain name regardless of whether those plurality of other resource record types actually exist at the domain name. The DNS server transmits the generated answer to the client device.