Abstract: In some implementations, a system may receive interaction data based on an interaction of a user with a terminal, wherein the interaction data indicates a location of the terminal. The system may determine a plurality of entities having a corresponding plurality of locations that are within a geographic area that includes the location of the terminal. The system may determine, based on the plurality of entities, one or more categories for categorizing a purpose associated with the interaction of the user with the terminal. The system may transmit, to a user device of the user, information that identifies the one or more categories. The system may receive, from the user device, information that identifies one or more user-specified categories of the one or more categories. The system may store, in the database, a record that includes the information that identifies the one or more user-specified categories.

Abstract: Techniques for presenting a search result with an improved user interface. A computer system can receive, from a user device, a request for a content item. Additionally, the system can select, based on the request, a first content item from a plurality of content items. The first content item can be associated with an organization image and an organization name of an organization. Moreover, the system can process, using one or more machine-learned model, the organization image to determine whether the organization image is acceptable to be presented in the search result. Subsequently, the system can transmit, to the user device, the first content item and the organization image to be presented in the search result.

Abstract: A method for associating a link to web content with a multimedia content element are provided. The method includes identifying at least one multimedia content element in a web-page; generating, by a signature generator system, a signature for the at least one multimedia content element, wherein the signature generator system includes a plurality of computational cores enabled to receive the multimedia content element and to generate a signature for at least a portion of the multimedia content element, each computational core having properties that are at least partly statistically independent of the other computational cores; matching the generated signature to signatures of web content existing on at least one web server to determine matching web content; determining a link to the matching web content; and modifying the at least one multimedia content by adding the link.

Abstract: A method renders photorealistic images in a web browser. The method is performed at a computing device having a general purpose processor and a graphics processing unit (GPU). The method includes obtaining an environment map and images of an input scene. The method also includes computing textures for the input scene including by encoding an acceleration structure of the input scene. The method further includes transmitting the textures to shaders executing on a GPU. The method includes generating samples of the input scene, by performing at least one path tracing algorithm on the GPU, according to the textures. The method also includes lighting or illuminating a sample of the input scene using the environment map, to obtain a lighted scene, and tone mapping the lighted scene. The method includes drawing output on a canvas, in the web browser, based on the tone-mapped scene to render the input scene.

Abstract: A method for generating a content feed includes receiving, from a content provider, a target content item and a policy for the target content item, specifying a prohibited classification of the content that cannot be published adjacent to the target content item. The method also includes identifying a slot in a content feed including multiple content items. A machine learning model is then accessed and applied to two adjacent content items that are adjacent to the slot to determine whether each of the adjacent content items is the prohibited classification. Responsive to determining that the adjacent content items are not the prohibited classification, the target content item is placed in the slot, and the content feed including the target content item is sent for display to a viewing user.

Abstract: Method of generating frustration score starts with processor receiving data associated with interactions by users with website including webpages displayed during sessions. Processor generates page view scores based on page view experience indicators and zone experience indicators associated with the webpages, generates session scores based on the page view scores and session experience indicators, and generates webpage scores based on page view scores. Processor identifies the webpage associated with highest level of frustration based on page view and webpage scores and identifies the session that is associated with highest level of frustration based on the session scores. Processor causes a user interface to be displayed on a display device that includes a visualization of interactions by a user with the website associated with the session with the highest level of frustration and an identification of the webpage associated with the highest level of frustration. Other embodiments are described herein.

Abstract: A computational microscope and a method for its operation are disclosed. In some embodiments, the microscope maps points on a sample to point in an intensity pattern on a one-to-many basis. The microscope utilizes illumination angle coding, polarization coding, amplitude coding, and phase coding to capture more information than prior art computational microscopes. Although the resulting intensity patterns are not human-interpretable images of the sample, they contain more information about the sample, by virtue of the aforementioned coding techniques, than is captured by prior-art microscopes. Machine-learning algorithms, such as neural networks, are used to analyze the intensity patterns and extract useful information, such as cellular events or cell behavior.

Abstract: A method, an electronic device, and a computer program product for processing data is disclosed. The method includes training a classification model based on a plurality of reference documents describing different objects, the trained classification model respectively associating the plurality of reference documents with the described objects. The method further includes determining from the individual words identification information that can identify the objects based on contributions of individual words in the reference documents to the association. Identification information that can identify objects in documents describing the objects may be determined, so that an identification information data set is automatically generated for training a machine learning model that is used to determine the identification information.

Abstract: A computerized-method for scaling automatic deployment of a machine-learning detection model in a cloud-based managed analytics service by knowledge sharing to overcome an imbalanced dataset learning problem. The computerized-method includes: sending the received data to machine-learning models to synthesize patterns of the received data to yield a differential privacy data; maintaining in the database the differential privacy data of one or more on-prem cloud-based managed analytics services to generate a consortium shared synthetic data lake; operating phases of machine-learning detection model based on the received data and data in the database to create a packaged model. The data in the database is aggregated and used during the operating phases of the machine-learning detection model to create a packaged model for other on-prem cloud-based managed analytics services, thus overcoming imbalanced dataset learning thereof, and after the packaged model is created it is automatically deployed on-prem.

Abstract: Disclosed herein is an improvement to prior art feature pyramids for general object detection that inserts a simple norm calibration (NC) operation between the feature pyramids and detection head to alleviate and balance the norm bias caused by feature pyramid network (FPN) and which leverages an enhanced multi-feature selective strategy (MS) during training to assign the ground-truth to one or more levels of the feature pyramid.

Abstract: One embodiment of the present invention provides a computer implemented method for generating a training set to train a convolutional neural network comprising the steps of providing prediction space data to a General Logic Gate Module (GLGM). Prediction space expert judgement is also provided to the GLGM and to a sensitivity and importance module. The GLGM determines or outputs state possibilities. The state possibilities are provided to the sensitivity and importance module and to the feature extraction module. Feature extraction algorithms are applied to the state possibilities within the feature extraction module to produce a training possibility set that is a virtual training possibility set. The training possibility set is provided to a state inferential module and to a final training set.

Abstract: Systems and methods described herein provide an online constraint optimizing service that evaluates user requests and inquiries for telecommunications services in the context of a real-time constraint-based analysis. According to an implementation, a network device receives a function for an analytic event and a constraint. The function applies different user attributes for a telecommunications network. The network device generates a training data set using offline constrained optimization of the function. The network device develops a predictive model for utilization of network resources in the telecommunications network using the training data set. The network device receives a user request that corresponds to the analytic event addressed by the predictive model and conducts an online prescriptive analysis using the predictive model. The network device optimizes allocation of the network resources to the user based on the prescriptive analysis.

Abstract: A computer-implemented method is for providing radiomics-related information. In an embodiment, the computer-implemented method includes receiving radiomics-related data; determining, based on the radiomics-related data and an assistance algorithm, a function for processing the radiomics-related data; calculating, based on the radiomics-related data and the function for processing the radiomics-related data, the radiomics-related information; and providing the radiomics-related information.

Abstract: Provided herein is a system and method to fuse data from sensors. The system includes sensors configured to capture data associated with one or more targets, the data including timestamps indicating originating times, one or more processors, and a memory storing instructions that, when executed by the one or more processors, causes the system to perform obtaining, at a filter, transmitted data associated with the one or more targets from the plurality of sensors, from the obtained data, identifying an unsequenced measurement having a timestamp before a second timestamp of a second measurement but obtained at the filter after the second measurement was obtained at the filter, updating a state of the filter according to the unsequenced measurement, based on a nonlinear measurement model and a nonlinear process model.

Abstract: Sensor fusion is performed for efficient deep learning processing. A camera image is received from an image sensor and supplemental sensor data is received from one or more supplemental sensors, the camera image and the supplemental sensor data including imaging of a cabin of a vehicle. Regions of interest in the camera image are determined based on one or more of the camera image or the supplemental sensor data, the regions of interest including areas of the camera image flagged for further image analysis. A machine-learning model is utilized to perform object detection on the regions of interest of the camera image to identify one or more objects in the camera image. The objects are placed into seating zones of the vehicle.

Abstract: A method for managing hardware resources includes obtaining, by a local virtual hardware license manager, a license request from an application instance, in response to the license request: sending a virtual hardware license request to a license management system, wherein the virtual hardware license request comprises a hardware resource list, making a first determination that a response to the virtual hardware license request validates the virtual hardware license request, and in response to the first determination: providing, based on the hardware resource list, a signed hardware resource document to a hardware resource manager managing a hardware resource, wherein the hardware resource list specifies the hardware resource, updating a hardware resource access repository to specify enabled access of the hardware resource by the application instance, and initiating access to the hardware resource by the application instance.

Abstract: A cloud management server comprises processing circuitry configured to access a device database storing information identifying a storage device in association with information identifying an owner thereof; access a license database storing license information of a license for a cloud storage, information identifying a license subscriber of the license, and information identifying a license sharer; receive setting information about a first license from a first license subscriber; refer to the device database to acquire information identifying a first storage device; set an update authority of the setting information to at least one of the first license subscriber and a first license sharer; and receive update instructions of the setting information, to refer to the update authority of the setting information, to confirm that the update instructions are given by the first license subscriber or the first license sharer having the update authority, and update the setting information.

Abstract: A method and system to manage application package installation in a multi-tenant system is provided. The method includes accessing metadata of an application package for distribution in the multi-tenant system, selecting a component of the application package with a permission guard in the metadata, evaluating permission guard logic to determine wither a target tenant in the multi-tenant system can install the component, and compiling and installing the component in response to the permission guard logic indicating the tenant of the multi-tenant system has met conditions to utilize the component.

Abstract: Disclosed is a system and method for the monitoring and authorization of an optimization device in a network. In exemplary embodiments, an optimization device transmits an authorization request message to a portal to receive authorization to operate. The portal transmits an authorization response message to the optimization device with capability parameters for operation of the device, including at least one expiration parameter for the authorization. The optimization device sends updated authorization request messages to the portal with its device usage information, such that the portal can dynamically monitor the optimization device and continue to authorize its operation.

Abstract: Techniques for preventing rendering content from content delivery network (CDN) to unauthorized users are described herein. In accordance with various embodiments, a CDN includes one or more processors and a non-transitory memory. The CDN receives a request from a client device for a media content item, where the request indicates an identifier of a client. The CDN further provisions an encrypted media content item corresponding to the media content item for the client, where at least a portion of the encrypted media content item is encrypted using at least one personalized key assigned to the client. The CDN also facilitates obtaining a manifest corresponding to the encrypted media content item, where the manifest specifies encryption metadata for retrieving the at least one personalized key by the client. The CDN additionally sends the encrypted media content item and the manifest to the client device.

Abstract: A data privacy protection tool operates on behalf of a user to effectuate countermeasures and protections for selected portions of their privacy data as provided to a digital service provider (DSP) sites/apps. The countermeasure can be tailored to increase and/or incentivize compliance by DSPs with distribution or access rules for the user data.

Abstract: Aspects described herein may relate to techniques for detecting login activity to a financial account during a knowledge-based authentication process. The login activity may be related to access to an online interface for the financial account. The detection of login activity during the authentication process my indicate that the integrity of the authentication process is compromised as login access may provide an individual with transaction data that may be used to answer transaction-based authentication questions. As a result of detecting login activity, an alternative authentication process may be initiated or an authentication request related to the financial account may be denied.

Abstract: An automated teller machine comprising a sensor, a network interface, and a processor configured to receive, during a transaction at the automated teller machine, user data from the sensor configured to monitor user movement information during the transaction, receive, via the network interface, user data from a mobile device, determine a risk of a fraudulent transaction based on a comparison of the user movement information from the sensor and the user data from the mobile device to expected parameters, determine that the risk of a fraudulent transaction is below a threshold, and allow access to a secure resource at the automated teller machine.

Abstract: A method and system of authenticating a user logon builds a user logon profile with a plurality of user logon features gathered during at least one successful attempted user logon, determines a logon feature novelty score for each feature, receives a user logon request for authentication and extracts current user logon features, retrieves corresponding logon feature novelty scores, determines a first distance function score for the corresponding logon feature novelty scores of the current user logon features, builds a failed logon attempt database, determines a failed logon feature novelty score, extracts the failed logon feature novelty scores corresponding to current user logon features, determines a second distance function score for the corresponding failed logon feature novelty scores of the current user logon features, and determining to one of allow or deny the user logon request based on at least one of the first distance function score and the second distance function score.

Abstract: Biometric information is obtained from a user. A determination is made that the obtained biometric information matches at least one entry in a biometric database. In response to determining that the obtained biometric information matches the at least one entry in the biometric database, non-biometric verification information is obtained. A determination is made as to whether at least a portion of the non-biometric verification information matches at least a portion of preset non-biometric verification information associated with the user. In response to determining that the at least a portion of the non-biometric verification information matches, a determination is made that an identity of the user is verified. In response to determining that the at least a portion of the non-biometric verification information does not match, a determination is made that the identity of the user is not verified.

Abstract: System and method of performing identity authentication based on de-identified data, with receiving of at least one data item from a user, creating at least one de-identified data item and a corresponding authentication key, based on the received at least one data item, storing the at least one de-identified data item in a database, receiving at least one new data item for authentication, retrieving the authentication key corresponding to the user, generating at least one new de-identified data item based on the received at least one new data item, and comparing the at least one new de-identified data item with the stored at least one de-identified data item to authenticate the identity of the user.

Abstract: Methods, systems, and apparatuses are described herein for improving computer authentication processes using vocal confidence processing. A request for access to an account may be received. An authentication question may be provided to a user. Voice data indicating one or more vocal utterances by the user in response to the authentication question may be received. The voice data may be processed, and a first confidence score that indicates a degree of confidence of the user when answering the authentication question may be determined. An overall confidence score may be modified based on the first confidence score. Based on determining that the overall confidence score satisfies a threshold, data preventing the authentication question from being used in future authentication processes may be stored. The data may be removed when a time period expires.

Abstract: Computer system for performing biometric matching in a way that balances accuracy level required in the biometric matching against computing resources (for example, processor cycles) that will be needed to match authentication requesters with profiles of authorized users. In some embodiments, this is achieved by controlling the number of clusters and/or the number of clusters to be searched pursuant to an authentication request.

Abstract: Embodiments described herein disclose methods and systems for encryption and decryption of data. In some implementations, an encryption and decryption system can protect private information of a user in documents with an artificial reality device. The encryption and decryption system can determine the portion of a document containing private information and encrypt that portion of the document. In some implementations, the encryption and decryption system can receive a document and identify the protected (e.g., encrypted) portion of the document. In some cases, the protected portion of the document can contain a security token that the encryption and decryption system can extract. The system can compare the security token to an authentication token associated with the user and determine whether the security and authentication token match. If the tokens match, the system can decrypt the protected portion of the document and display the decrypted data as a virtual object.

Abstract: A computer system is provided for protecting access to one or more hardware devices with a hardware device password that is invisible to a user, the system comprising a mobile device and the hardware device, the mobile device including: a memory, the memory storing one or more invisible passwords; an application in the memory; a wireless interface for communicating with the hardware device; and a processor coupled to the memory, the application and the wireless interface, the hardware device including: a memory; a wireless interface for communicating with the mobile device; and a processor coupled to the memory and the wireless interface; wherein the processor in the mobile device is configured to receive a hardware device identifier from the processor in the hardware device; wherein the application in the mobile device is configured to select, based upon the hardware device identifier, the invisible password for the hardware device; and the processor in the hardware device is configured to authenticate the a

Abstract: Method of mutual authentication of a controllable electronic device (DE) and of its user (USER) able to control it so that it procures him a service (DS), the device (DE) containing sensitive or confidential data (DA) and being arranged so as to—in an operational phase (OP) including a preliminary step of authentication of the user (UAP)—, execute an operation (SO) so as to procure the service (DS), including, furthermore, a prior phase of authentication of the device (SDAP), in which the authenticity of the device (DE) is verified, so that if on completion of the prior phase of authentication of the device (SDAP), the device (DE) is confirmed to be authentic, the user (USER) can execute the operational phase (OP), whilst if the device (DE) is not confirmed to be authentic, the user (USER) can prevent the execution of the operational phase (OP).

Abstract: A user may conduct a plurality of access requests with a plurality of resource provider computers. A processor server computer may determine whether resource provider computers store access data associated with the user in various ways, including detecting patterns in sets of a plurality of access requests conducted between the user and each of the plurality of resource provider computers. Upon detecting that access data has changed, the processor server computer may automatically send the updated access data to each of the identified resource provider computer.

Abstract: System and method for creating and managing trusted execution environments (TEEs) using different underlying hardware TEE mechanisms use a virtual secure enclave device which runs in a virtualized environment in a computer system. The device enables an enclave command transmitted to the virtual secure enclave device to be retrieved and parsed to extract an enclave operation to be executed. A TEE backend module is used to interact with a particular hardware TEE mechanism among those available in the computer system. The module ensures the enclave operation for the software process is executed by the particular hardware TEE mechanism, or the TEE scheme based on a particular hardware TEE mechanism.

Abstract: A machine learning model is scanned to detect actual or potential threats. The threats can be detected before execution of the machine learning model or during an isolated execution environment. The threat detection may include performing a machine learning file format check, vulnerability check, tamper check, and stenography check. The machine learning model may also be monitored in an isolated environment during an execution or runtime session. After performing a scan, the system can generate a signature based on actual, potential, or absence of detected threats.

Abstract: A control information processing method is provided. The method includes: simulating a controller on a first device based on a target drive file of the first device; receiving control information sent by a second device, the control information being used for controlling the first device to perform a corresponding operation; storing the control information as input information of the controller into a storage space of the target drive file; and obtaining the control information from the storage space of the target drive file in response to receiving a data read instruction that instructs to obtain the input information of the controller.

Abstract: The present disclosure describes systems, apparatuses, and methods for obfuscation-based intellectual property (IP) watermark labeling. One such method comprises identifying, by one or more computing processors, a specific net within an integrated circuit design that is likely to be used in a malicious attack; and adding additional nets to the integrated circuit design that add additional logic states to a finite state machine present in the integrated circuit design. The additional logic states comprise watermarking states for performing authentication of the integrated circuit design, in which a watermark digest can be captured upon application of secret key inputs to the additional nets. Other methods, systems, and apparatuses are also presented.

Abstract: In some implementations, a system may receive a shell script associated with a computing device. The system may generate a character frequency feature vector based on the shell script. The system may input text of the shell script to a convolutional neural network (CNN) branch of a trained deep learning model. The system may input the character frequency feature vector to a feedforward neural network (FNN) branch of the trained deep learning model. The system may determine using the trained deep learning model, a respective probability score for each of a plurality of obfuscation types for the shell script based on a combined output of the CNN branch and the FNN branch. The system may detect whether the shell script is obfuscated based on the respective probability score for each of the plurality of obfuscation types determined for the shell script.

Abstract: Methods and devices for determining whether a mobile device has been compromised. The mobile device has a managed portion of memory and an unmanaged portion of memory, a managed profile and an unmanaged profile, and the managed profile includes files stored in the managed portion of memory and the unmanaged profile includes files stored in the unmanaged portion of memory. The managed profile is governed by a device policy set by a remote administrator. File tree structure information for the unmanaged profile of the mobile device is obtained that details at least a portion of a tree-based structure of folders and files in the unmanaged portion of memory. It is determined from the file tree structure information that the mobile device has been compromised and, based on that determination, an action is taken.

Abstract: Embodiments of the present invention disclose an AI processing method and an AI processing apparatus. The method is applied to the AI processing apparatus. An AI processor has at least two working modes, and security of the at least two working modes is different. The method includes: processing, by the AI processor, an AI processing request in a target mode. The target mode is one of the at least two working modes, and the target mode is a working mode determined based on the AI processing request. The AI processor has at least two working modes with different security, and may switch between different working modes.

Abstract: A method for securing an electronic control unit (ECU). The method may include generating a granular security control adjustment authorization ticket (G-SCAAT) for securing the ECU according to a plurality of security parameters determined based on to a role selected for a corresponding user. The G-SCAAT may include security values to be used in controlling the ECU to operate according to the security parameters.

Abstract: Systems, methods, and devices securely boot processors and nonvolatile memories. Methods include implementing, using a controller of a secured nonvolatile memory, a validation operation on a first portion of code stored in a first secured storage region of the secured nonvolatile memory, the validation operation comprising computing a validation value. Methods also include retrieving a second portion of code from a second secured storage region, the second portion of code comprising a pre-computed validation value, the first and second portion of code being associated with booting a processor, and implementing a comparison operation of the validation value and the pre-computed validation value. Methods further include generating, using the controller, a signal based on a result of the comparison operation, the signal being provided to the processor via an interface of the secured nonvolatile memory, and the signal enabling booting of the processor in response to a matching comparison operation.

Abstract: A system and method are disclosed for delegating, by a resource-constrained device, a privilege to a basic input/output system, wherein the privilege allows the basic input/output system to authenticate an endpoint device on behalf of the resource-constrained device. The system and method also includes generating an asymmetric security key that includes a private key and a public key and transmitting the public key to the basic input/output system, wherein the public key is included in a proxy certificate generated by the basic input/output system. In addition, the system and method includes establishing a secure session between the basic input/output system and the endpoint device using the private key and the proxy certificate, wherein the secure session is used by the basic input/output system to authenticate and verify that the endpoint device is authorized to perform an operation.

Abstract: A method for a system for security evaluation includes working one state at a time; identifying primitives of interest and systematically applying relevant attacks for the system; starting at chip level, working through states, and then expanding a system boundary and repeating; following a sequence of: chip>circuit card>subsystem>system>platform for a product solution under analysis; determining if a system definition has sufficient detail, or is too abstract; for a chip with a native secure boot protocol, determining if all players are represented; representing attacks as vectors made up of measurements of the following attributes: Dollars, days, Probability of success, Probability of destruction, technology node, and number of samples; and representing countermeasures as vectors made up of scaling factors for each of attack attributes.

Abstract: The present invention includes an embodiment that may determine an access level within an organization. The embodiment may generate a simulated scenario based on the access level. The embodiment may identify responses of the user to the generated simulated scenario. The embodiment may capture one or more input frames. The embodiment may analyze the responses and the one or more input frames and generate education for the user based on the responses and the one or more input frames.

Abstract: A hierarchical health index evaluation method for an intelligent substation includes: obtaining a basic health index of a device based on static information and dynamic information of the device; obtaining a device correlation based on a communication connection relationship between the device and another device, and correcting the basic health index of the device based on the device correlation to obtain a health index of the device; obtaining a layer-based health index of a layer based on a device health index and a device importance weight of the layer; obtaining a whole-station health index of an intelligent substation based on a layer-based health index of each layer and a sum of device importance weights of each layer; and regulating the intelligent substation based on a health index of each device in the intelligent substation, the layer-based health index of each layer, and the whole-station health index.

Abstract: A computer program component configured to collect configuration item data from information technology resources of an air-gapped network for an information technology configuration management database is provided. Configuration item data collected from the information technology resources of the air-gapped network is obtained using the provided computer program component, wherein the obtained configuration item data is physically transferred between a device within the air-gapped network and a device outside the air-gapped network at least in part via a portable physical storage medium, and the collected configuration item data has been reviewed and filtered within the air-gapped network prior to being physically transferred via the portable physical storage medium. The obtained configuration item data is imported to the information technology configuration management database outside the air-gapped network.

Abstract: A method and apparatus for secured, peer-to-peer transfer of data rights over a computer network, the method being accomplished by a distributed computing system including a distributed ledger platform. Root rights are defined and delegated to wallets in a multilevel manner to thereby isolate wallets associated with the root right from cyber risk.

Abstract: A system may receive a string of characters, identify two or more sub-strings of the string, compare the two or more sub-strings to one or more reserve values from a database of reserve values, identify a first sub-string of the two or more sub-strings that contains one of the one or more reserve values, identify a second sub-string of the two or more sub-strings with a sensitive value, and obfuscate the second sub-string and not obfuscating the first sub-string.

Abstract: Methods and systems for managing and/or processing a blockchain to maintain data security for confidential and/or personal data are provided. According to certain aspects, the disclosed data security techniques may enable access sharing functionality utilizing the blockchain. For example, access sharing may be utilized to share policy information. The policy information may be associated with a smart contract. Accordingly, the policy information may be encrypted using a public key for the smart contract and compiled into a block of the blockchain. In response to a request to provide access to the information to a particular node, the private key for the smart contract may be encrypted using the public key for the particular node and compiled into a block of the blockchain.

Abstract: A system comprises a server system including at least one processor. The at least one processor is configured to receive a request to generate a digital secured document, generate a unique identifier of the digital secured document, and embed a plurality of security data in at least one of the one or more defined areas of the digital secured document. The plurality of security data includes a scannable code. The scannable code has embedded therein an encrypted message that, when decrypted by the server system, validates an authenticity of the digital secured document. The at least one processor is also configured to mint the digital secured document on a blockchain, including generate metadata on the blockchain associated with the digital secured document, and store the metadata and one or more images associated with the digital secured document permanently with an on-chain permaweb protocol.