Abstract: Systems and methods that may be used to provide multitenant key derivation and management using a unique protocol in which key derivation may be executed between the server that holds the root key and a client that holds the derivation data and obtains an encryption key. In one or more embodiments, the derivation data may be hashed. The disclosed protocol ensures that the server does not get access to or learn anything about the client's derived key, while the client does not get access to or learn anything about the server's root key.

Abstract: A system and method are provided for identifying a browser instance in a browser session between a server hosting a web domain and the browser instance executing on a user computing device. The method conducted at the browser instance includes obtaining a private key and a public key of a key pair unique to a combination of a web domain and the browser instance being used to access the web domain. The method includes obtaining a browser certificate issued for the key pair and storing the private key at a storage provided by the browser instance for use by the browser instance during an active browser session with the web domain. The private key is stored as unextractable from the storage and with configuration for use by the browser instance during an active browser session with the web domain in signing or cryptographic operations without the private key being revealed.

Abstract: The present invention relates to data rights management and more particularly to a secured system and methodology and production system and methodology related thereto and to apparatus and methodology for production side systems and are consumer side systems for securely utilizing protected electronic data files of content (protected content), and further relates to controlled distribution, and regulating usage of the respective content on a recipient device (computing system) to be limited strictly to defined permitted uses, in accordance with usage rights (associated with the respective content to control usage of that respective content), on specifically restricted to a specific one particular recipient device (for a plurality of specific particular recipient devices), or usage on some or any authorized recipient device without restriction to any one in specific, to control use of the respective content as an application software program, exporting, modifying, executing as an application program, viewing,

Abstract: A system includes a centralized repository for tracking rule content and managing subscriptions to rule content by organizations and providers utilizing the system; a rule-evaluation server for receiving requests for rule-evaluations for specific patients, wherein the server determines content needing to be evaluated and retrieves the content to be used; a rule engine for performing the evaluations, wherein content, patient data, and rule evaluation parameters are provided to the engine, and the engine returns recommendations triggered by the evaluation, if any; an aggregator for aggregating recommendations from multiple sources, detecting and coordinating related recommendations, and applying configuration settings based on the patient and/or provider in context; and a client component for coordinating communication between an electronic health records system, the server, and the aggregator.

Abstract: Computing environments can enable user initiation of wire-transfer application functionalities according to some aspects described herein. For example, a selection by a user of an option in a graphical user interface can be detected. The option can be for initiating a selected functionality of a wire-transfer application in a computing environment, and the user may not be authorized in the computing environment to interact with the wire-transfer application outside of the graphical user interface. In response, a text file can be generated that includes data identifying the selected functionality. The text file can be stored in a predefined storage location that is monitored by the execution service. The execution service can automatically detect a presence of the text file in the predefined storage location. In response, the execution service can automatically issue a command to the wire-transfer application for causing the wire-transfer application to execute the selected functionality.

Abstract: A method for automatic pairing of two devices for wireless communication includes detecting, by a first device, that a second device is in a communicable range of the first device, where the first device has not been paired with the second device for wireless communication. The method may include determining, by the first device, by communicating with a third device, that the second device is paired with the third device. The first device and the third device are also paired previously. The method may include transmitting, by the third device, a key material to the second device. The method may include confirming, by the first device and by the second device, that the key material matches. The method may include establishing, by the first device, a communication link with the second device for wireless communication in response to the key material being a match.

Abstract: A method of processing a transaction between a customer and a merchant includes receiving from a mobile device of the customer or from another device of the customer an indication of consent to perform a cardless payment transaction with the merchant, receiving from the mobile device an indication that the customer is within a predetermined distance of the merchant, after receiving both the indication of consent and the indication that the customer is within the predetermined distance, sending to a computer system of the merchant an indication of the presence of the customer and personal identifying information for the customer, receiving data indicating a transaction between the customer and the merchant, and submitting the transaction to a financial service for authorization.

Abstract: A method comprises one or more of measuring metrics of a node during boot up, storing the metrics, generating a signature record from the stored metrics, and broadcasting the signature record when said node initializes a network connection.

Abstract: This disclosure relates to systems and methods for performing cryptographic operations in connection with the management of electronic content using multiple license services. In some circumstances, a content service may not wish to share unencrypted content keys with a single license service for a variety of security reasons. Embodiments of the disclosed systems and methods may use multi-party cryptographic methods in connection with the management of protected content keys and/or associated licenses and/or the distribution of content keys and/or licenses to authorized users and/or devices. In various embodiments, a content service may split a content key into a plurality of key shares and may transmit the key shares to a plurality of different license services. The license services may coordinate operations to generate a protected content key without revealing unencrypted content key to any of the participating license services.

Abstract: An apparatus includes a memory configured to store labels of virtual private networks (VPNs) in a first local label space. The apparatus also includes a processor to assign a first label block identifier (LBI) to a first block of labels in the first local label space and assign a first tuple to a first VPN. The first tuple includes the first LBI and a first label index (LI) that indicates a location of a first label of the first VPN within the first block of labels. The apparatus also includes a transceiver configured to provide the first tuple to routers that allocate second blocks of labels from second local label spaces based on the first tuple. The second routers store the first label at locations in the second label spaces indicated by the first LI.

Abstract: A computing system that is configured to receive requests to send computer executable programs to a data owner system associated with a data source for execution of the computer executable program by the data owner system. The data owner system may store to a blockchain a permitted list of programming functions, function libraries, function syntax definitions, and execution environment requirements. The computing system may be further configured to retrieve the permitted lists. The computing system may be further configured to evaluate the computer executable program using the permitted lists to determine if the computer executable program may be executed by the data owner system. The evaluation may be performed by generating an abstract syntax tree of the computer executable program. The computing system may be further configured to send the computer executable program to the data owner system if the computer executable program satisfies the conditions of the permitted lists.

Abstract: A system and method for checking the sanction status of an entity to determine whether the entity is prohibited from engaging in transactions with an organization. The system and method include receiving a request to form an agreement between an organization and an entity and maintaining, in a sanctioned entity blacklist, associations between a plurality of entities and a plurality of identifiers. Each identifier of the plurality of identifiers indicates that a respective entity of the plurality of entities has sanctioned entity status prohibiting the respective entity from engaging in a transaction with one or more organizations. The system and method include determining a sanctioned entity status associated with the entity based on a digital certificate and the sanctioned entity blacklist. The system and method include generating, responsive to determining the sanctioned entity status associated with the entity, an error condition indicating that the digital certificate failed validation.

Abstract: A carrier network may provide for asymmetric key exchange for end to end encryption between user equipment utilizing capability upload and discovery messages of the carrier network. For example, a carrier network may receive a capability upload message from a first user equipment. The carrier network may determine that the capability upload message includes a key bundle for end to end (E2E) encryption of communications. In response, the carrier network may store the key bundle in a key distribution center (KDC). The carrier network may also receive, from a second user equipment, a capability discovery message requesting capability information for the first user equipment. In response, the carrier network may request and receive the key bundle from the KDC and transmit the key bundle to the second user equipment.

Abstract: An exchange processing system may include multiple exchange components that are respectively included in multiple computing systems. A central exchange component may receive a request to enable access to secured data, the request having identity data encrypted via an identity encryption module and inquiry data encrypted via a first request encryption module. The central exchange component may decrypt the identity data via the identity encryption module, and decrypt the inquiry data via the first request encryption module. Response data may be generated from secured data that is selected based on the identity and inquiry data. The central exchange component may encrypt the response data via a second request encryption module and re-encrypt the identity data via the identity encryption module. The encrypted identity and response data may be provided to a second remote exchange module.

Abstract: Example embodiments relate to transaction authentication using biometric inputs from multiple users. The biometric inputs are input via a single computing entity simultaneously or within a configurable time period. The biometric inputs can be used to generate a transaction authentication record to authenticate the transaction.

Abstract: A cryptographic communication system includes: a first cryptographic communication apparatus including a first tamper-resistant device configured to store a first key generation function and a first storage unit configured to store first individual information; and a second cryptographic communication apparatus including a second tamper-resistant device configured to store a second key generation function and a second storage unit configured to store second individual information. The first cryptographic communication apparatus generates a twelfth shared key using the first key generation function and the second individual information. The second cryptographic communication apparatus generates a twenty first shared key using the second key generation function and the first individual information.

Abstract: Techniques and structures to provide secure data transfer between entities in a multi-user on-demand computing environment. An electronic device may comprise at least one physical memory device, one or more processors coupled with the at least one physical memory device, the one or more processors configurable to create a scratch organization within the computing environment, receive, via a user interface, a metadata selection comprising a plurality of metadata resources which define a set of components for a service implemented in an origin organization of the multi-user, on demand computing environment, extract the plurality of metadata resources from the origin organization within the computing environment into a metadata bundle, and deploy the metadata bundle in the scratch organization. Additional subject matter may be described and claimed.

Abstract: Techniques and structures to provide secure data transfer between entities in a multi-user on-demand computing environment. An electronic device may comprise at least one physical memory device, one or more processors coupled with the at least one physical memory device, the one or more processors configurable to create a scratch destination organization within the computing environment, receive, via a user interface, a metadata selection comprising a plurality of metadata resources, extract the plurality of metadata resources from an origin organization within the computing environment into a metadata bundle, and deploy the metadata bundle in the scratch organization. Additional subject matter may be described and claimed.

Abstract: Systems, methods, and articles of manufacture to securely share data stored in a blockchain. A contactless card may receive a request to provide a data element from a device. An applet of the contactless card may encrypt the data element and a wallet address. The applet may generate a signature for the request, and transmit, to a mobile device, the signature and the encrypted data. The mobile device may transmit, to a verification service, the signature and encrypted data. The verification service may verify the signature based on a public key. A node in a blockchain may generate a block in the blockchain, the block comprising indications of the verification of the signature, the requested data element, and the wallet address. An encrypted data element corresponding to the data element may be decrypted using a public key. The device may receive the decrypted data element from the wallet address.

Abstract: A communication device may: comprise an output unit configured to output first information obtained by using a first public key in a memory in a case where a predetermined instruction is inputted to the communication device; after the first information has been outputted, receive an authentication request in which the first public key is used from a terminal device; send an authentication response to the terminal device; establish a wireless connection between the communication device and an external device; and in a case where a predetermined condition is satisfied after the first information has been outputted, create a second public key different from the first public key and store the second public key in the memory. In a case where the predetermined instruction is inputted to the communication device again, the output unit may be configured to output second information obtained by using the second public key in the memory.

Abstract: A system and method is provided to allow access to centralized patient data captured from a medical device across an open network to a third party. The system and method receives the request based upon patient-specific information, checks the request and allows access if the request matches stored information.

Abstract: A secure multi-party computation implements real number arithmetic using modular integer representation on the backend. As part of the implementation, a secret shared value jointly stored by multiple parties in a first modular representation is cast into a second modular representation having a larger most significant bit. The parties use a secret shared masking value in the first representation, the range of which is divided into two halves, to mask and reveal a sum of the secret shared value and the secret shared masking value. The parties use a secret shared bit that identifies the half of the range that contains the masking value, along with the sum to collaboratively construct a set of secret shares representing the secret shared value in the second modular format. In contrast with previous work, the disclosed solution eliminates a non-zero probability of error without sacrificing efficiency or security.

Abstract: Disclosed is a computer-implemented method for establishing a secure connection between two electronic computing devices which are located in a network environment, the two electronic computing devices being a first computing device offering the connection and a second computing device designated to accept the connection, the method comprising executing, by at least one processor of at least one computer, a connection-establishing application for exchanging an information packet between the first computing device and the second computing device comprising a secret usable for establishing the connection, and evaluating a response from the second computing device for establishing the secure connection.

Abstract: A method and apparatus for secured, multi-lateral, assured data transfer over a computer network for the assured exchange of data between counterparties related to qualifying transactions, the method being accomplished by a distributed computing system including a distributed ledger platform and an off-chain data host platform. On-chain authorization tokens are used to track data access rights, enforce access policies, and control distribution of encryption keys.

Abstract: A method for key agreement between a first party and a second party over a public communications channel, the method including selecting, by the first party, from a semigroup, a first value “a”; multiplying the first value “a” by a second value “b” to create a third value “d”, the second value “b” being selected from the semigroup; sending the third value “d” to the second party; receiving, from the second party, a fourth value “e”, the fourth value comprising the second value “b” multiplied by a fifth value “c” selected by the second party from the semigroup; and creating a shared secret by multiplying the first value “a” with the fourth value “e”, wherein the shared secret matches the third value “d” multiplied by the fifth value “c”.

Abstract: A system and method for granting access to network resources through access credentials given to an agent process running on each computer or machine where resource requesters reside. The system extends a traditional token-granting authorization system to the agent processes, where each agent has administrative access to machine information. The agent uses that access to acquire detailed information about resource requesters. Requester qualifications defined by the system limit requester access to resources, and are enforced both by the agent and by the central system on the network resource server. Resource requesters ask for a token for resource use from the agent, not the central system. The agent uses its credentials to get a token from the central system and then return the token to qualified requesters.

Abstract: A public-key scheme of Homomorphic Encryption (HE) in the framework Quotient Algebra Partition (QAP) comprises: encryption, computation and decryption. With the data receiver choosing a partition or a QAP, [n, k, C], a public key Keypub=(VQen, Gen?) and a private key Keypriv=†P† are produced, where VQen is the product of an n-qubit permutation V and an n-qubit encoding operator Qen, Gen? an error generator randomly provides a dressed operator ?=V†EV spinor error E of [n, k, C]. Then, by Keypub, the sender can encode his k-qubit plaintext Ix) into an n-qubit ciphertext |?en, which is transmitted to the cloud. The receiver prepares the instruction of encoded computation Uen=PV†Qen† for a given k-qubit action M and sends to cloud, where is the error-correction operator of [n, k, C], =I2n?k?M the tensor product of the (n?k)-qubit identity I2n?k and M , and V†Q†en and P the complex-transposes of VQen and †P† respectively.

Abstract: In an example, a method of encryption is described to include generation of a content encryption key and a key encryption key. In that example, the content encryption key is wrapped based on a key wrap operation using the key encryption key and the wrapped content encryption key is encrypted using a policy encryption key. Further in that example, the policy encryption key is encrypted using a public key corresponding to a print apparatus. In an example, a method of decryption is described. The example method of decryption performs recovery of a policy object using a private key corresponding to a print apparatus. In that example, the policy object includes a wrapped key that is unwrapped using a key encryption key to recover a content encryption key usable to decrypt an encrypted electronic document.

Abstract: Embodiments relate to systems, apparatuses, and methods for performing transaction signing utilizing asymmetric cryptography and a private ledger. A transaction data is signed by a user device using a private key, and may be utilized in an authorization request message without including a real credential of the user. A transaction verification and accounting module (TVAM) can verify the signed transaction data and can continue processing the transaction.

Abstract: Disclosed are methods for utilizing a memory device as a security token. In one embodiment, a method includes receiving a request to perform an operation; transmitting a nonce to a memory device; receiving a second nonce from the memory device, the second nonce encrypted using a private key of the memory device; verifying the second nonce using a public key of the device, held by the host system; and executing the operation upon successfully verifying the second nonce.

Abstract: The present invention relates in particular to a pairing method between a multimedia unit and one operator having an operator identifier, the multimedia unit having a multimedia unit identifier and receiving conditional access data from said operator, the method being characterized in that: receiving by the multimedia unit a multimedia unit key formed by applying a first cryptographically function to a personalization key and to the multimedia unit identifier; receiving by the operator an operator key formed by applying a second cryptographically function to said personalization key and to the operator identifier; said multimedia unit further having a function of the multimedia unit and said operator further having a function of the operator, these functions being such that the result of the application of the function of the operator to said operator key and to said multimedia unit identifier is equal to the result of the application of the function of the multimedia unit to said multimedia unit key a

Abstract: Set of two or more dongles for providing a digital signature, wherein each dongle holds a secret key, wherein each dongle is configured to receive a message, to compute a digital signature of the received message using the secret key, and to transmit the computed digital signature, wherein at least one of the dongles is configured to, before computing the digital signature, verify the presence of at least one other dongle belonging to the set, and to compute the digital signature only upon successful verification of the presence of one or more other dongles.

Abstract: A tool for providing a user configured one-time password. Responsive to receiving a request for a one-time password, the tool sends the one-time password, based at least in part, on a user configured one time password rule. The tool receives a user configured one-time password return value for the one time password. The tool determines whether the user configured one-time password return value satisfies the user configured one-time password rule when applied to the one-time password. Responsive to a determination that the user configured one-time password return value satisfies the user configured one time password rule, the tool accepts the user configured one-time password return value and granting access to the application.

Abstract: Systems and methods that may be used to provide multitenant key derivation and management using a unique protocol in which key derivation may be executed between the server that holds the root key and a client that holds the derivation data and obtains an encryption key. In one or more embodiments, the derivation data may be hashed. The disclosed protocol ensures that the server does not get access to or learn anything about the client's derived key, while the client does not get access to or learn anything about the server's root key.

Abstract: A system and method for deploying software is disclosed. The system includes an architecture for deploying simulation software as a service. The architecture includes a client layer. The client layer includes an edge device, a resource manager, an update framework, a firewall, and a key management system. The architecture further includes a control layer communicatively coupled to the client layer, wherein a portion of the control layer is configured within a server. The control layer includes an application programming interface, one or more containers, wherein at least one of the one or more containers is a simulation processing container. The control layer further includes an orchestration node, a continuous integration tool, one or more processors, and a content delivery network module. The architecture further includes a data layer communicatively coupled to the one or more containers.

Abstract: A secure communication method and a secure communications apparatus related to the field of communications technologies and applied to a terminal. The terminal has a first security context and a second security context, the first security context is used by the terminal to communicate with a first network, the second security context is used by the terminal to communicate with a second network, and the first security context and the second security context include different first information.

Abstract: According to one aspect of the present invention, there is provided a method for managing a medical information platform using a blockchain, the method comprising the steps of: dynamically calculating an exchange ratio between tokens and points, with reference to at least one of an amount of points that a user intends to exchange for tokens on a medical information platform, an amount of tokens that the user intends to exchange for points on the medical information platform, an amount of tokens present in a token pool managed by the medical information platform, and an amount of points previously exchanged for tokens on the medical information platform; and providing the user with the tokens or points exchanged with reference to the calculated exchange ratio.

Abstract: Systems and methods for securing encrypted data wherein a sending computer encrypts data to be transmitted with an encryption key. The encryption key itself is not sent, but can be derived from a second key and third key. The second key is modified such that an incomplete portion of the second key is sent along with the message to a recipient computer. The third key is sent separately to the recipient computer. The recipient computer obtains the remainder of the second key, reconstructs the complete second key and then uses it with the third key to derive a decryption key to decrypt the message.

Abstract: A processor-implemented system and method for dynamically retrieving an attribute value of an identity claim for a user using a digitally signed access token that is digitally signed by a user device, at a relying party device associated with a relying party. The method includes (i) making an API call to retrieve at least one identity claim for the user, (ii) processing each identity claim of the user, with the relying party device, to identify if at least one by-reference identity claim that includes a URL of an endpoint, (iii) obtaining the digitally signed access token that is digitally signed by the user device, (iv) invoking the URL of the endpoint with the at least one by-reference identity claim and the digitally signed access token, and (v) dynamically retrieving the attribute value from the URL of the endpoint from an issuing party device associated with an issuing party.

Abstract: An arithmetic apparatus includes an interface and a circuity. The interface is connected to an information processing apparatus that is connected to a client apparatus and that processes data in an encrypted state. The circuitry acquires, from the information processing apparatus, encryption input data or encryption target data encrypted with a first encryption key. The circuitry decrypts the acquired, encryption input data or encryption target data with a first decryption key. Then, the circuitry executes a predetermined arithmetic operation on the decrypted arithmetic operation target data, encrypts data of an arithmetic operation result obtained by the predetermined arithmetic operation with the first encryption to key, and outputs the encrypted data of the arithmetic operation result to the information processing apparatus.

Abstract: Identity management is disclosed that allows authentication of a user for a third party by way of an encrypted token. A biometric signature can be requested for a user of a user device. In response, an encrypted token can be generated based at least in part on the biometric signature. The encrypted token can then be provided back to the user device, which can save the encrypted token to a secure location on the user device accessible by biometric authentication of the user on the user device. An authentication request can be provided from a third party which includes an encrypted token. A determination can be made regarding whether user identity can be confirmed based on the encrypted token. An indication of whether the user identity was confirmed or unconfirmed can then be communicated in response to the authentication request.

Abstract: A storage apparatus sends a request for a key encryption key to a key management server using a storage apparatus ID as a parameter, acquires the key encryption key, for which a request has been sent to the key management server, and its attribute information, and stores the key encryption key and its attribute information in a key encryption key list while eliminating the key encryption key that is duplicated. Then, in the order listed in the key encryption key list, decryption of the encryption key is attempted by the key encryption key stored in the key encryption key list, and the success or failure of the decryption of the encryption key is determined. When the decryption of the encryption key using the key encryption key fails, the decryption of the encryption key is attempted using a key encryption key, which has not been attempted yet, in the key encryption key list.

Abstract: A method for analyzing software with pointer analysis may include obtaining a software program, and determining a first independent program slice of the software program describing a first code segment of the software program. The method may further include determining, using a first pointer analysis objective, a first result from performing a first pointer analysis on the first independent program slice, and determining, using the first result, a first dependent program slice of the software program. The method may further include determining, using a second pointer analysis objective, a second result from performing a second pointer analysis on the first dependent program slice. The method may further include generating a report, using these results, indicating whether the software program satisfies a predetermined criterion.

Abstract: A method, system and computer-usable medium for using pseudonyms to identify entities and their corresponding security risk factors is disclosed. In certain embodiments, a computer-implemented method for identifying security risks associated with a plurality of different entities is disclosed, wherein the method comprises: receiving a stream of events, the stream of events comprising a plurality of events associated with the plurality of different entities; pseudonymizing events of the plurality of events by replacing entity names in the plurality of events with corresponding entity pseudonyms to thereby provide a plurality of pseudonymized events; executing security analytics operations on the plurality of pseudonymized events to identify user behaviors presenting security risks; and using the entity pseudonyms to anonymously identify entities engaging in security risk related behaviors.

Abstract: A method comprising receiving first data representative of a query. A representation of the query is generated using an encoder neural network and the first data. Words for a rephrased version of the query are selected from a set of words comprising a first subset of words comprising words of the query and a second subset of words comprising words absent from the query. Second data representative of the rephrased version of the query is generated.

Abstract: A method for transferring digital multimedia rights, the method including but not limited to requesting permission from the destination end user to transfer the digital multimedia rights to the destination end user device; and if the permission is received from the destination end user, canceling the source set of digital multimedia rights associated with the source end user and transferring the source set of digital multimedia rights associated with the source end user to the destination end user device. A system and computer program product are disclosed for performing the method.

Abstract: A system and method is disclosed for assuring that networked communications between parties playing a game on a network (e.g., the Internet) are not tampered with by either of the parties for illicitly gaining an advantage over the other party. An initial sequence of tokens (e.g., card representations) for playing the game are doubly encrypted using an encryption key from each of the parties. Accordingly, during play of the game neither party can modify the initial sequence of game tokens during the game. At termination of the game, at least one of the parties can fully decrypt the initial sequence of tokens, and thereby, if desired, compare the played token sequence with the corresponding the initial token sequence.

Abstract: The present disclosure provides systems and methods for electronically providing each of a plurality of content distributors with access to a library of content items, facilitating the selection of a combination of the content items, creating a unique set of links for each recipient-distributor combination, and distributing the selected content and unique links via one or more distribution channels to a plurality of recipients. As each link is associated with both a recipient and a distributor, conversion actions stemming from the selection of a link by a recipient are attributed to the proper distributor. Distributors can create content distribution approaches that can be shared with other distributors.

Abstract: Disclosed is a method of registering a new optical network unit (ONU) to be performed by an optical line terminal (OLT). The method includes transmitting a ranging notification message to a centralized unit (CU)/distributed unit (DU) to register the new ONU, receiving scheduling information for registering the new ONU from the CU/DU in response to the ranging notification message, transmitting a serial number request message to a service region in which ONUs are present based on the received scheduling information, and when the serial number response message is received from the new ONU in response to the serial number request message, registering the new ONU that transmits a serial number request message. The transmitting of the serial number request message is performed through a multi-quiet zone of a short period.

Abstract: Example embodiments relate to transaction authentication using biometric inputs from multiple users. The biometric inputs are input via a single computing entity simultaneously or within a configurable time period. The biometric inputs can be used to generate a transaction authentication record to authenticate the transaction.