Abstract: A method for Remote Direct Memory Access (RDMA) of a memory of a processor. An address translation unit comprises an address translator and a signer. The address translator is configured to translate a received virtual address in a real address of the memory. The signer is configured to cryptographically sign the real address.

Abstract: An apparatus and method for establishing a communication connection between a first party and a second party using a secured communication connection object are provided. With the apparatus and method, a first party generates the secured communication connection object by setting parameters identifying and limiting the use of the secured communication connection object for establishing communication connections with the first party. These parameters are encapsulated with contact information for the first party such that the contact information is encrypted. The resulting secured communication connection object is then transmitted to a second party's communication device.

Abstract: When exchanging communication parameter setting information on a wireless network, a communications apparatus selects between a first operation mode in which communications parameter information is exchanged with a specific communications apparatus and a second operation mode in which communications parameter information is exchanged with an unspecified number of communications apparatus. Depending on the selected operation mode, the communications apparatus control security upon holding the communications parameter information exchanged with the specific communications apparatus and the communications parameter information exchanged with the unspecified number of communications apparatus.

Abstract: The present invention provides a system, method and apparatus for troubleshooting one or more communications between a first device and a second device. A monitoring device disposed between the first device and the second device receives a message associated with the communication(s), analyzes the received message and stores the analyzed message whenever the analyzed message satisfies one or more troubleshooting criteria. The one or more troubleshooting criteria may include one or more data element criteria, one or more event-based criteria, one or more time-based criteria, one or more logical operators or a combination thereof. The method can be implemented using a computer program embodied on a computer readable medium having one or more code segments to perform the method steps.

Abstract: An RFID system includes an RFID tag, an RFID reader, and a server. The RFID tag communicates to the server via encrypted information. The information may be encrypted with synchronized encryption keys. In this manner, the reader need not decrypt the information from the RFID tag. The effectiveness of malicious readers is thereby reduced, resulting in improved RFID tag security.

Abstract: Methods for dynamic management of security associations in a network are provided. According to one method, a security key management entity determines whether to apply a new security key as an active security key based on an existing active security key. Each of the new security key and the existing active security key are associated with a same home agent, and the existing active security key serves as a basis for an existing security association between the home agent and at least one other network element.

Abstract: A computerized system and method for processing network content in accordance with at least one content processing rule. In accordance with the inventive method, the network content is received at a first interface. The inventive system identifies a transmission protocol information of the received network content and uses the identified transmission protocol information to intercept at least a portion of the received network content formatted in accordance with a transmission protocol. The intercepted portion of the network content is redirected to a proxy, which buffers the redirected portion of network content. The buffered network content is scanned in accordance with a scanning criterion and processed in accordance with the at least one content processing rule based on the result of the scanning. The processed portion of network content may be forwarded using the second interface.

Abstract: A method and a detection system are provided for detecting encrypted peer-to-peer (EP2P) sessions associated with a particular EP2P network. Seed data associated with the EP2P network is extracted from a selected packet, and an encryption seed is obtained from the seed data. An encryption key is obtained from the encryption seed by using a key function associated with the EP2P network, and a cipher associated with the EP2P network is initialized with the encryption key. A portion or whole of the packet is decrypted, and checksum data associated with the EP2P network is extracted. A checksum is obtained from the checksum data, and the obtained checksum is compared with a reference checksum associated with the EP2P network. If the obtained checksum matches the reference checksum, a session including the packet is determined to be an EP2P session associated with the EP2P network.

Abstract: A solution that enables the exchange of information in a secure manner over an insecure text messaging infrastructure provides part of the exchange as cryptographic material to be used to secure subsequent communications. The exchange of the cryptographic material is protected from malicious and nefarious parties. Systems and methods for the exchange of cryptographic material enable the parties involved in the exchange to have confidence that the material received was communicated from the originating party. Once the cryptographic material is successfully exchanged between cooperating peers, it can be used by smartphones, tablets, feature phones, or special purpose machine to machine devices for private communications, such as command and control, location services, etc. over insecure voice or data communication paths, such as SMS.

Abstract: Methods, devices, and computer program products for transmitting and receiving discovery and paging messages in a wireless communication device are described herein. In one aspect, a wireless apparatus operable in a wireless communication system comprises a processor configured to obfuscate a medium access control address of a frame by generating a random number and a transient address obfuscation key including a first transient key, wherein the transient address obfuscation key is a function of an address obfuscation key and the random number; including the random number in an address obfuscation header field of the frame; and replacing an original first address in an address field of the frame with a new first address that is a function of the original first address and the first transient key. The processor is further configured to include an indication of the obfuscation in a first field of the frame.

Abstract: A method, device, and system for securely migrating and provisioning a virtual machine image to a host device of a cloud service provider environment (CSPE) is disclosed. A customer device encrypts a virtual machine image (VMI) and stores the VMI in the CSPE. The host device retrieves the encrypted VMI from the object store and sends host trust data (including a symmetric key extracted from the encrypted VMI, the symmetric key being encrypted with the customer public key) to a key management server for trust attestation. If the key management server successfully attests the host device, the key management server decrypts the encrypted symmetric key using the customer private key and re-encrypts the symmetric key using the host public key. The host device receives the re-encrypted symmetric key from the key management server, decrypts it using the host private key, and decrypts the encrypted VMI using the symmetric key.

Abstract: A method for encrypting print jobs that includes receiving output data, encrypting the output data with a randomly-generated symmetric session key, generating a session key header by encrypting the randomly-generated symmetric session key using an asymmetric user public key, and encrypting the session key header using a server public key.

Abstract: An intermediary device may be used to connect a telecommunications device to an existing secure network that is accessed by a computing device. The intermediary device may simplify connections to the secure network by connecting to the secure network without setting up a new connection to the secure network. The telecommunications device may connect to the computing device, via the intermediary device, using a secondary network, which enables the telecommunications device to access the secure network through the computing device. In some instances, the computing device may operate to bridge a connection with the telecommunications device and perform some or all of the functions of the intermediary device.

Abstract: A network authentication system authenticates a connection-request based on a manner that the connection-request traverses the network. In client-server terminology, a server authenticates a client request for connection by examining one or more sequences of network entities (or network nodes) that form entity-patterns. The client pseudo-randomly selects entities of the network to be redirectors that redirect a received connection-request to further redirectors and/or the server. The client generates a different connection-request for each of the redirectors, and each redirector does the same for each of the further redirectors. This results in substantially unique connection-requests transmitted by each entity of the network in connection with the user request. Thus, redirector patterns are substantially unique and may be used for authentication.

Abstract: A plurality of user terminals or sensors transmit data encrypted by individual cryptographic key, a server receives the encrypted data items, and executes a data process according to a program defining a decryption process sequence. Bit slice expression data is generated by performing a bit slice process with respect to the plurality of encrypted data items which are decryption target, bit slice expression key based on the cryptographic key of each encrypted data item is generated, round key is generated based on a bit slice expression key, a decryption process including operation and movement processes of a block unit of the bit slice expression data, and an operation using the round key is executed, and a plurality of plain text data items corresponding to the plurality of encrypted data items are generated by a reverse conversion of the data with respect to the decryption process results.

Abstract: Embodiments of methods and network devices for securing data within a network are generally described herein. One such method includes a key aggregation server receiving a request for an encryption key to secure the data. The server may query a plurality of network devices for a respective key from each queried network device. The server may then receive the respective key from each of the plurality of network devices and select a key element from each of the plurality of keys. An encryption key may be constructed from the key elements and transmitted to a client.

Abstract: Systems and methods for performing adaptive bitrate streaming using alternative streams of protected content in accordance with embodiments of the invention are described. One embodiment includes a processor, and non-volatile storage containing an encoding application. In addition, the encoding application configures the processor to: receive source content; obtain common cryptographic information; encode the source content as a plurality of streams including a plurality of alternative streams of content; and protect the plurality of alternative streams of content using the common cryptographic information.

Abstract: A system and method for securely storing, retrieving and sharing data using PCs and mobile devices and for controlling and tracking the movement of data to and from a variety of computing and storage devices.

Abstract: A telecommunication system is arranged between a trusted automated interactive system and a non-secure agent. The trusted automated interactive portion is operable for bidirectional communications with a caller. The agent portion is arranged to be bridged onto a communication connection between the caller (or network chat user) and the trusted interactive system under certain conditions. Sensitive data transmitted between the system and a calling user may be blocked from being communicated to the agent even while the agent is bridged onto the connection. In one embodiment, information (such as a verification of authenticity of the caller) pertaining to the sensitive data (but not the sensitive data itself) is communicated to the agent.

Abstract: The invention relates to a system for exchanging data between at least one sender and one receiver, such as a central server, by means of a data transmission network of Internet type, this system comprising means for encrypting/decrypting the data exchanged. The senders and the receiver comprise generators of encryption/decryption keys, which generators are synchronized to generate new keys for message encryption/decryption with each dispatching of a new message from the sender to the receiver.

Abstract: A key management and node authentication method for a sensor network is disclosed. The method comprises the following steps of: 1) keys pre-distribution: before deploying the network, communication keys for establishing security connection between nodes are pre-distributed to all of nodes by a deployment server. 2) Keys establishment: after deploying the network, a pair key for the security connection is established between nodes, which includes the following steps of: 2.1) establishment of shared keys: the pair key is established between neighbor nodes in which the shared keys are existed; 2.2) path keys establishment: the pair key is established between the nodes in which there is no shared keys but there is a multi-hop security connection. 3) Node identity (ID) authentication: before formally communicating between nodes, the identity is authenticated so as to determine the legality and the validity of the identity of the other.

Abstract: A computer method, computer system, and article for enabling digital signature auditing. The method includes the steps of: receiving at least one signature request issued by at least one application, forwarding a first data corresponding to the received at least one signature request to at least one signing entity for subsequent signature of the first data, storing an updated system state that is computed using a function of: i) a reference system state and ii) a second data corresponding to the received at least one signature request, where the reference system state and the updated system state attest to the at least one signature request, and repeating the above steps, using the updated system state as a new reference system state, where the steps of the method are executed at a server of a computerized system.

Abstract: A method, hybrid server system, and computer program product, support multiple users in an out-of-core processing environment. At least one accelerator system in a plurality of accelerator systems is partitioned into a plurality of virtualized accelerator systems. A private client cache is configured on each virtualized accelerator system in the plurality of virtualized accelerator systems. The private client cache of each virtualized accelerator system stores data that is one of accessible by only the private client cache and accessible by other private client caches associated with a common data set. Each user in a plurality of users is assigned to a virtualized accelerator system from the plurality of virtualized accelerator systems.

Abstract: A technique for secure computation obfuscates program execution such that observers cannot detect what instructions are being run at any given time. Rather, program execution and memory access patterns are made to appear uniform. A processor operates based on encrypted inputs and produces encrypted outputs. In various examples, obfuscation is achieved by exercising computational circuits in a similar way for a wide range of instructions, such that all such instructions, regardless of their operational differences, affect the processor's power dissipation and processing time substantially uniformly. Obfuscation is further achieved by limiting memory accesses to predetermined time intervals, with memory interface circuits exercised regardless of whether a running program requires a memory access or not. The resulting processor thus reduces leakage of any meaningful information relating to the program or its inputs, which could otherwise be detectable to observers.

Abstract: Disclosed is a system and method for receiving, by a wireless gateway device from a user computing device, a request for network access. In an embodiment, the request is formatted to comply with a different communication protocol, and transmitted to a authentication computing device. The gateway device receives a reply from the authentication computing device that grants the request. The reply is transmitted by the wireless gateway device and to the user computing device. A first communication pathway is established between the authentication computing device and the user computing device, and a request for access to at least one other computing device is received by the authentication device. The request is forwarded, and a reply granting the request is received and forwarded to the user computing device.

Abstract: Embodiments of the present invention provide a method and an apparatus for inputting data. The present invention relates to the communications field and aims to improve security of input information. The method includes: acquiring, by a virtual machine manager, input data; performing, by the virtual machine manager, encryption processing on the input data according to an encryption rule of a security connection to obtain encrypted data, where the security connection refers to a connection that is established between an application interface and a server and used for data transmission; and sending, by the virtual machine manager, the encrypted data to the server. The present invention is applicable to a data input scenario.

Abstract: Content is securely shared between communication devices in an ad-hoc manner by employing common sensing context to establish pairing between the communication devices. In one aspect, the communication devices are within a specified distance from each other and sense common signals from their environment over a specified time period. The common signals are analyzed to determine an initialization or session key, which is utilized to secure content transfer between the communication devices. Additionally or alternatively, the key is utilized to provide access to virtual (e.g., digital content) and/or physical (e.g., buildings) resources.

Abstract: Systems and methods for providing additional security for data being transmitted across a wireless connection that has been established using a known wireless protocol (e.g. Bluetooth) are described. An encryption key is exchanged between a computing device (e.g. a mobile device) and a wireless peripheral device (e.g. a keyboard, a printer). In some embodiments, the encryption key is generated at one of the two devices. Data associated with the encryption key is output at the one device, which can be input by the user at the other device. The encryption key is then recovered at the other device from the input, thereby completing the key exchange. The encryption key can then be used to encrypt and decrypt data transmitted over the established wireless connection, providing additional security.

Abstract: A method, system and program product for using access-control lists to control access to categorized computer files. Two or more computer files are each associated with one of a set of possible classifications that fall within a single category and an access-control list associates a user with a subset of these classifications. In response to the user's request for access to one of these files, where the request specifies the requested file but does not specify the category of the requested file, the processor identifies the requested file's category based on that file's associated classifications, checks the access-control list to determine that the user is authorized to access files of the identified category, and then grants the requesting user access to the requested file.

Abstract: A method for distributing a nominal audiovisual stream to a recipient device including modifying, in the nominal audiovisual stream, at least one nominal coefficient among the nominal coefficients to generate a modified main stream; generating complementary information such that the nominal audiovisual stream may be implemented based from the complementary information and on the modified main stream, applying a plurality of methods for protecting the complementary information to generate multiple protected complementary information, each of the protected complementary information enabling the nominal stream of the main stream to be implemented upon application of an access method compatible with the protection method which has been used to protect it; and transmitting to the recipient device the modified main stream and the multiple protected complementary information.

Abstract: Described are a secure geo-location obscurity network and ingress nodes, transit nodes and egress nodes used in such a network. In particular, a novel device is provided and comprises: a node for a network, the node comprising: a private portion for allowing high bandwidth secure private traffic to be received and transmitted by the node on a private pathway through the node; and a public portion for allowing low bandwidth secure public traffic to be received and transmitted by the node on a plurality of public pathways through the node.

Abstract: Methods and systems for secure client-side communication between multiple domains is provided. Such methods and systems can provide for decreased communication latency particularly effective for dynamic multi-domain and/or multi-tenant environments while allowing for granular security or specific security of messages and operations with regard to users, user sessions, groups, organizations, permissions sets, applications, or any other logical delineation. Such methods and systems may involve a variety of security components, for example, at least one set of instructions including a plurality of defined instruction to be utilized by users of the set of instructions to communicate, and cryptographic construct data in order to verify the data integrity and the authenticity of messages sent and received using the secure client-side communication between multiple domains.

Abstract: A system for connecting a first network device and a second network device includes one or more servers. The servers are configured to: (a) receive, from the first network device, a request to look up a network address of the second network device based on an identifier associated with the second network device; (b) determine, in response to the request, whether the second network device is available for a secure communications service; and (c) initiate a virtual private network communication link between the first network device and the second network device based on a determination that the second network device is available for the secure communications service, wherein the secure communications service uses the virtual private network communication link.

Abstract: An authentication server and method are provided for generating tokens for use by a mobile electronic device for accessing a service. Communications between the device and the authentication server are through a relay. A memory stores a secret shared with a service server from which the service is provided. A processor is configured to generate the token using the shared secret and based on a reliance on the relay to ensure that the device has authorization to access the service. One or more computer readable medium having computer readable instructions stored thereon that cause the device to obtain proof of authorization to access the service is also provided. The instructions implement a method comprising: outputting via a wireless connection to a relay a request addressed to an authentication server for a token and receiving the token from the authentication server via the relay.

Abstract: An apparatus comprising a processor configured to monitor at a recurring interval a plurality of message queues and a plurality of server sessions that access the message queues, determine, at each occurrence of the interval, an appropriate number of server sessions per queue that achieves acceptable load balance, and redistribute the server sessions among the message queues to match the appropriate number of server session per queue upon determining the appropriate number of server sessions and prior to a subsequent occurrence of the interval.

Abstract: A computer-implemented method is provided for controlling use of a file on a user device. The method includes transmitting authentication information to a system and downloading the file from the system over the network upon successful authentication by the system. The method also includes limiting access of the file to a client application of the user device and preventing altering of the file, printing of the file and opening of the file outside of the client application. Notes corresponding to the file can be stored in a local storage area.

Abstract: A combination-based broadcast encryption method includes: assigning by a server a base group of different combinations to each user; producing and sending secret information for each user by using as a base the base group allocated to each user; producing and sending an inverse-base parameter value through calculations with integers used to produce the base group and key value information of one or more privileged users; and deriving a group key by using the key value information of the privileged users, encrypting a session key by using the derived group key, and sending the encrypted session key to each user. Accordingly, each user is assigned a different base through a combination, thereby having security against collusion attacks.

Abstract: When being triggered by a call setting request that has been made, dummy information that is different from information to be transmitted and is information used for creating a path on which encrypted communication is to be performed is generated. The path on which the encrypted communication is to be performed is established by using the generated dummy information. A responding process of responding to the call setting request is performed after the path on which the encrypted communication is to be performed has been established. Thus, in the case where information that is obtained after the responding process of responding to the call setting request is encrypted and transmitted, it is possible to transmit the information while maintaining the real-time characteristics of the information to be transmitted.

Abstract: Systems and methods for wireless communications are provided. These include data deciphering components, interrupt processing components, adaptive aggregations methods, optimized data path processing, buffer pool processing, application processing where data is formatted in a suitable format for a destination process, and Keystream bank processing among other hardware acceleration features. Such systems and methods are provided to simplify logic designs and mitigate processing steps during wireless network data processing.

Abstract: A system, related methods and computer readable memory device for delivering a presentation are provided. In one example, a method includes establishing a wireless network access point that creates a closed wireless network. An encrypted communication session is established via the closed wireless network with a plurality of client computing devices that each comprise a display. Each of the client computing devices is communicatively coupled to a virtual network server on the host computing device. Frame buffer data is retrieved from a storage subsystem of the host computing device. The frame buffer data is sent to each of the client computing devices to modify the display of the devices.

Abstract: Techniques are provided for securely upgrading a field programmable circuit, e.g., a Field Programmable Gate Array (FPGA), in a device that has been deployed to a customer site. A plurality of keys is stored in the device, e.g., public, private, and/or symmetric keys. The keys are used to authenticate and decrypt a newly received FPGA software image upgrade. The image upgrade is re-encrypted using one of the stored keys and stored in the computing device. The device is booted and the encrypted image upgrade is loaded into the field programmable circuit. The encrypted image upgrade is decrypted to obtain the image upgrade for execution on the field programmable circuit.

Abstract: A data storage and retrieval system suitable for use by law enforcement/criminal justice personnel and their designees. The invention creates secure connectivity over communications channels, such as the Internet, which are not considered secure under the mandate of the FBI's security policies. All of the communications are processed via a secure cloud, which processes, verifies and audits all data that passes through the system. The audited data is made available, immediately upon request by the FBI or other authorized agency.

Abstract: A computer-implemented system processes secure electronic documents from one or more content providers in accordance with subscriber instructions has a processor and modules operative within the processor. A monitoring module obtains a provider GUID, a subscriber GUID, and a transaction ID from public metadata associated with a transaction received from a particular content provider. A determination module determines any designees of the subscriber and contact information one or more of the subscriber and any designees. A transaction module distributes a transaction addressed to at least one of the subscriber and any designees. Each distributed transaction includes data that is used for management, tracking, and alerting. Also described is a station for constructing transactions for distribution to subscribers through such a system, and management of local-advertising to users of such a system. An end-to-end system and method are described.

Abstract: An information processing system includes: a client executing acquisition and reproduction of contents; a management server providing the client with content selection information applied for acquisition of contents; and a content providing server receiving the content selection information from the client and providing the content selected in accordance with the content selection information, wherein the content selection information includes content identifiers as identifiers of encrypted contents respectively encrypted by different encryption keys and range information indicating data areas of range data which is configuration data of respective encrypted contents, and the content providing server provides the client with an encrypted content formed by combining range data as partial data of the encrypted contents specified by the content identifiers and the range information.

Abstract: Systems and methods for authentication generate keys from secret credentials shared between authenticating parties and authenticators. Generation of the keys may involve utilizing specialized information in the form of parameters that are used to specialize keys. Keys and/or information derived from keys held by multiple authorities may be used to generate other keys such that signatures requiring such keys and/or information can be verified without access to the keys. Keys may also be derived to form a hierarchy of keys that are distributed such that a key holder's ability to decrypt data depends on the key's position in the hierarchy relative to the position of a key used to encrypt the data. Key hierarchies may also be used to distribute key sets to content processing devices to enable the devices to decrypt content such that sources or potential sources of unauthorized content are identifiable from the decrypted content.

Abstract: A system and method for obtaining an authorization key to use a product utilizes a secured product identification code, which includes a serial number and at least one code that is generated based on a cryptographic algorithm.

Abstract: A secure cloud storage and synchronization system and method is described that provides, among other things: (1) local password recovery, including a mechanism by which the user of the system can recover their password without having stored it on a remote server; (2) secure, private versioning of files, including a mechanism to privately store a version history of files on one or more remote servers in such a way that it is technically infeasible for anyone other than the legitimate owner to access any component of the file history; (3) secure, private de-duplication of files stored on one or more remote servers that reduces storage requirements by allowing for the storage of a single file when there are duplicates, even across users; and (4) secure, private sharing of files between users of the system that allows one user to share a file on the “cloud” with another user without deciphering or transporting the file.

Abstract: Systems and methods of restricting access to mobile platform location information may involve receiving, via a link, location information for a mobile platform at a processor of the mobile platform, and preventing unauthorized access to the location information by an operating system associated with the mobile platform.

Abstract: Secure function evaluation SFE) with input consistency verification is performed by two parties to evaluate a function. For each execution, the first party computes a garbled circuit corresponding to the function and uses an Oblivious Transfer protocol to provide wire secrets that are an encrypted version ki of the input xi of the second party. The second party stores the encrypted version ki of the input xi of the second party for the plurality of executions. The second party receives the garbled circuit for computation of an output, which is sent to the first party. To verify the inputs of the second party for two executions, the first party computes a check garbled circuit corresponding to a verification function based on the input keys of the garbled circuits being verified; and sends the check garbled circuit to the second party for computation of a verification output. The verification output is computed by applying the stored encrypted versions ki for the two executions to the check garbled circuit.

Abstract: A client computer runs a communicator employed to connect to a server computer in a cloud. The communicator is updated on a regular basis to update its algorithms for processing raw data into secured data. The server computer receives and validates the secured data, and attempts to update the communicator if the secured data is invalid. The server computer may deem the client computer as being infected when the update is reinitiated a predetermined number of times. The raw data may be restructured, or encrypted using an encryption scheme where the key used for the encryption is not provided to the receiver of the data. The algorithm for data restructuring and encryption may be included in the update to the communicator. Communication between the client computer and the server computer may be on a dynamically selected channel indicated in a previous communication.