Abstract: A disposable set of components for an organ perfusion system comprising a fluid supply duct for supplying fluid to the organ, a fluid removal duct for removing fluid from the organ, and a surrogate organ removably connected between the fluid supply duct and the fluid removal duct so as to form a fluid circuit, so that fluid can be circulated in the circuit in preparation for connection of the organ.

Abstract: A disclosed method includes operations of a control computer and interceptor computer. The control computer creates a certificate request and sends it to a certificate issuer, the certificate request created with an encrypted blob including a service private key S-PrK encrypted with an escrow server public key E-PuK. The control computer receives the certificate from the certificate issuer and provisions it to the service server along with S-PRK for use in secured communications with clients. The interceptor computer monitors session-establishment communications, e.g. a TLS handshake, between the service server and client to obtain the digital certificate, and retrieves the encrypted blob from the certificate and sends it to the escrow server. The escrow computer retrieves S-PrK by decrypting the encrypted blob using the escrow private key E-PrK, and returns S-PrK to the interceptor, where it is used to decrypt secure-session communications between the client and service server.

Abstract: A computerized device and a process protect against denial-of-service (DoS) attacks by using a memory-time hard problem that a client (e.g., IoT device or mobile app) solves as part of a request such as an initial registration process. The process may use parameters obtained from a public source of randomness. The problem is designed such that all memory allocated for the algorithm is used in a random manner, making it difficult for attackers to use FPGA/ASIC approaches. The client provides a proof-of-work (PoW) value to a server, which performs a more directed version of the calculation done by the client to confirm that the PoW value is correct. When confirmation is not obtained, the server can refrain from further processing of the client request, thwarting DoS attacks.

Abstract: Embodiments are directed to techniques to automatically propagate password updates onto other devices that use a shared password to protect respective secure keys or other secrets. This may be done by calculating update data using a new password and an old password entered onto one device as part of a password change operation, and sending the update data to the other devices for use in updating the password on those devices.

Abstract: A computer-implemented method of protecting digital data includes applying a key derivation function to a first value to generate a first derived key, the first value being equal to or derived from a first input password. The first derived key is combined with the digital data to generate a protected record stored in the computer. Subsequently, the key derivation function is applied to a second value to generate a second derived key, the second value being equal to or derived from a second input password. The protected record is processed using the second derived key to permit access to the digital data when the second derived key matches the first derived key. The key derivation function includes iterations of a two-stage hashing operation creating and using an array of memory blocks whose size is specified independently of the number of iterations to decouple processing and memory requirements.

Abstract: In an encrypted storage system employing data deduplication, encrypted data units are stored with the respective keyed data digests. A secure equivalence process is performed to determine whether an encrypted data unit on one storage unit is a duplicate of an encrypted data unit on another storage unit. The process includes an exchange phase and a testing phase in which no sensitive information is exposed outside the storage units. If duplication is detected then the duplicate data unit is deleted from one of the storage units and replaced with a mapping to the encrypted data unit as stored on the other storage unit. The mapping is used at the one storage unit when the corresponding logical data unit is accessed there.

Abstract: Methods, computer program products, and systems are provided for using a single shared secured connection among all servers in a cluster by efficiently establishing and securely disseminating a shared key between the servers. In particular, this is done by using a Diffie-Hellman key agreement scheme among the servers using an ordered list of servers generated on-the-fly.

Abstract: A method, integrated circuit chip, and computer program product for cryptographically processing an input value with Elliptic Curve Cryptography (ECC) using ECC scalar multiplication are provided. The ECC scalar multiplication is performed with the use of an enhanced acceleration table (EAT). The EAT uses multiple running totals with multiples above 2. The EAT, in some embodiments, uses reference values other than 0 and 2^window size.

Abstract: A method, integrated circuit chip, and computer program product for cryptographically processing an input value with Elliptic Curve Cryptography (ECC) using ECC scalar multiplication are provided. The ECC scalar multiplication is performed with the use of an enhanced acceleration table (EAT). The EAT uses multiple running totals, at least one of which has a multiplier above 2.

Abstract: A computer program product and method are provided for optimizing the size of an Elliptic Curve Cryptography (ECC) scalar multiplication table. Steps include (a) receiving, from a user interface, a set of integer multipliers, (b) choosing a subset of a given set of target integers, the chosen subset defining an index set, such that elements of the index set generate all elements of the given set of target integers using a target generation function, and (c) modifying the index set by removing an element from the index set which is not necessary to generate an element of the given set of target integers using the target generation function. Additional steps are also included depending on the embodiment.

Abstract: An improved technique involves dynamic generation of at least a portion of an acceleration table for use in elliptic curve cryptography. Such dynamic generation is capable of providing savings with regard to carrying out elliptic curve cryptography without an acceleration table. Furthermore, once the portion of the acceleration table is dynamically generated and stored (e.g., in a high speed cache), the portion of the acceleration table is capable of being used on subsequent elliptic curve cryptography operations as well thus enabling the cost of dynamically generating the acceleration table to be amortized across multiple elliptic curve cryptography operations.