Abstract: Context information of a handshake between a source entity and a target entity is obtained at a security proxy. The context information is transmitted from the security proxy to a key manager. The key manager maintains a first private key of the security proxy. A first handshake message is received from the key manager. The first handshake message is generated at least based on the context information and signed with the first private key. The first handshake message is then transmitted to the target entity.

Abstract: An apparatus includes an input interface to receive incoming packets from a first network device and an output interface to send outgoing packets to a second network device. Media access control security (MACsec) circuitry is coupled between the input interface and the output interface. Bypass flow-control (FC) circuitry is coupled between the input interface and the MACsec circuitry. The bypass FC circuitry is to detect an FC packet in the incoming packets and pass the FC packet passively to the output interface to enable end-to-end flow control directly between the first network device and the second network device.

Abstract: In an aspect, an integrated tamper resistant device generates initial network credentials for accessing a network, wherein the initial network credentials enable the integrated tamper resistant device to be authenticated by a network solution provider before operational network credentials are provided securely by the network solution provider. The integrated tamper resistant device encrypts the initial network credentials and cryptographically signs the encrypted initial network credentials. The integrated tamper resistant device outputs the encrypted and signed initial network credentials for delivery to the network solution provider.

Abstract: Techniques and mechanisms for using passively collected network data to automatically generate a fingerprint prevalence database without the need for endpoint ground truth. The process first clusters all observations with the same fingerprint string and similar source and destination context. The process then annotates each cluster with descriptive information and uses a rule-based system to derive an informative name from that descriptive information, e.g., “winnt amp client” or “cross-platform browser”. Optionally, the learned database may be augmented by a user to clarify custom process labels. Additionally, the generated database may be used to report the inferred processes in the same way as databases generated with endpoint ground truth.

Abstract: An apparatus for providing secure communications may include a processor; memory in electronic communication with the processor; an output in electronic communication with the processor; and instructions stored in the memory and executable by the processor to cause the apparatus to store a plurality of encryption protocols; store at least one encryption hopping protocol; select at least one encryption hopping protocol; encrypt the data according to the selected encryption hopping protocol; and transmit data from the output utilizing the selected encryption hopping protocol.

Abstract: This disclosure provides for a network element (in the middle) to inject enrichments into SSL connections, and for taking them out. This network element is sometimes referred to herein as a “middle box.” In the context of layered software architecture, this solution preferably is implemented by a library that operates below the SSL layer and above the TCP sockets layer at the two endpoints of the SSL connection. Preferably, the SSL enrichments are implemented as SSL/TLS records.

Abstract: According to an example aspect of the present invention, there is provided a method comprising: generating a certificate comprising an identifier of a base station, a public key of the base station, and a public key of a terminal; signing the certificate by a signature based on a private key belonging to the public key of the base station; sending the signed certificate to the terminal using an established security association; monitoring whether the base station receives a request for local authentication of the terminal, wherein the request comprises an encrypted certificate unit and a base station identifier; checking whether the base station identifier is the identifier of the base station and, if it is, decrypting the encrypted certificate unit using the private key; and using the public key of the terminal for a communication with the terminal if the certificate unit comprises the signed certificate.

Abstract: Methods, systems, and devices provide control over resources electronically communicated among computing devices. In some embodiments, a management application identifies multiple entities for communicating electronic content. The management application determines that at least a subset of the entities required for communicating the electronic content is available for electronic communication. The management application authorizes communication of at least some of the electronic content among the entities in response to determining that the required subset of entities is available for electronic communication.

Abstract: Some methods in a wireless communication network may include providing a first authentication key, and deriving a second authentication key based on the first authentication key, with the second authentication key being associated with the wireless terminal. Responsive to deriving the second authentication key, a key response message may be transmitted including the second authentication key and/or an EAP-Finish/Re-auth message. Some other methods in a wireless communication network may include receiving a key response message including a core network mobility management authentication key and an EAP-Finish/Re-auth message. Responsive to receiving the key response message, the network may initiate transmission of an EAP-Finish/Re-auth message and/or a freshness parameter used to derive the core network mobility management authentication key from the wireless communication network to the wireless terminal responsive to the key response message. Related wireless terminal methods are also discussed.

Abstract: This disclosure provides systems, methods, and apparatuses for wireless communication performed by a wireless communication device. An example wireless communication device includes an access point (AP) multi-link device (MLD). The AP MLD transmits a beacon frame to a wireless station (STA) MLD, the beacon frame including a plurality of AP medium access control (MAC) addresses of respective APs belonging to the AP MLD. The AP MLD receives an association request from the STA MLD, the association request including a plurality of STA MAC addresses of respective STAs belonging to the STA MLD. The AP MLD generates, during a handshake operation with the STA MLD, one or more encryption keys configured to encrypt communications between the AP MLD and the STA MLD. The AP MLD verifies the plurality of STA MAC addresses based at least in part on the one or more encryption keys.

Abstract: Methods and apparatus for securely storing, using and/or updating credential information, e.g., passwords and user IDs for a user who subscribes to one or more services, e.g., video stream services or other services available through a communications network such as the Internet, are described.

Abstract: Techniques for providing privacy features in communication systems are provided. For example, a message may be provided from user equipment to an element or function in a communication network that comprises one or more privacy indicators, where privacy features for processing the message are determined based on the privacy indicators. The message may comprise an attach request comprising a subscription identifier for a subscriber associated with the user equipment, with the privacy indicators comprising a flag indicating whether the subscription identifier in the attach request is privacy-protected. As another example, the element of function in the communication network may determine privacy features supported by the communication network and generate and send a message to user equipment comprising one or more privacy indicators selected based on the determined privacy features.

Abstract: A network connection between a server group of a data intake and query system and each of one or more source network nodes is established. Source data at the server group is received from at least one of the one or more source network nodes via the respective network connections and transformed, by the indexer server, to timestamped data entries of machine data. A model management server detects data constraints for a security model that include a data element used by the security model and an availability requirement set. Using the timestamped data entries, the data constraints are validated, and the validation used to determine a data availability assessment of the security model.

Abstract: A method for network selection on a user equipment (UE) device and the UE device are shown. The user equipment device registers on a first network in a wide area cellular network (WACN) band and receives, from a wireless local area network (WLAN), a list of WACNs that support generic access network (GAN) capabilities. The user equipment device selects the WLAN if the first network is on the list.

Abstract: A method of establishing a secure communication channel between a first communication device and a second communication device. The secure communication channel is defined by one or more algorithm options and the one or more algorithm options are associated with one of one or more option categories. The method includes receiving a signal representing one or more selections. The method further includes, for the respective option categories, generating a sorted list of algorithm options based on the received selections and generating a security association proposal including one or more of the algorithm options from the respective sorted lists of algorithm options. The security association proposal is generated based on an order in the sorted list of algorithm options. The method further includes transmitting the security association proposal to the second communication device for establishing the secure communication channel.

Abstract: The present application describes a method, system, and non-transitory computer-readable medium for exchanging encrypted communications using hybrid encryption. According to the present disclosure, a first device receives an encrypted communication from a second device. The encrypted communication includes a first encrypted secret, a second encrypted secret, a first signature, and a second signature. The first device verifies the first signature and the second signature, and, when the first and second signatures are valid, decrypts the first encrypted secret using a first encryption algorithm and the second encrypted secret using a second encryption algorithm. The first device combines the first decrypted secret and the second decrypted secret to recover a first communication and provides the first communication to a user of the first device.

Abstract: A method of authenticating an identity document based on an extraction, by analysis of an image acquired of the identity document, of candidate information representative of the appearance of a photograph such as depicted in the acquired image and optically readable data as depicted in the acquired image.

Abstract: A method for identifying malicious encrypted network traffic associated with a malware software component communicating via a network, the method including, for the malware, a portion of network traffic including a plurality of contiguous bytes occurring at a predefined offset in a network communication of the malware; extracting the defined portion of network traffic for each of a plurality of disparate encrypted network connections for the malware; training an autoencoder based on each extracted portion of network traffic, wherein the autoencoder includes: a set of input units each for representing information from a byte of an extracted portion; output units each for storing an output of the autoencoder; and a set of hidden units smaller in number than the set of input units and each interconnecting all input and all output units with weighted interconnections, such that the autoencoder is trainable to provide an approximated reconstruction of values of the input units at the output units; selecting a set

Abstract: An identity server authenticates a first user identity for a user device through a first authentication exchange as part of a passwordless authentication system. The identity server registers with a relying party as an authenticator for a second user identity. The identity server initiates a second authentication exchange by obtaining from the relying party, a credential request associated with the second user identity. Responsive to a determination that the first user identity authenticated in the first authentication exchange is authorized to act as the second user identity, the identity server obtains a credential request response authenticated by the authenticator in the identity server. The identity server completes the second authentication exchange by providing the credential response to the relying party. The second authentication exchange authenticates the user device to the relying party without involving the user device.

Abstract: In an authentication system (120) of an organization that is another organization different from a first organization that a first user belongs to, a management device (200) accepts a registration transaction for a client certificate of the first user. Then, the management device registers the client certificate of the first user in a client certificate blockchain. When the first user accesses a service of another organization from a user terminal of the first organization, an authentication device (300) authenticates the first user using the client certificate of the first user in the client certificate blockchain.

Abstract: A service routing packet processing method, apparatus and system. The method includes obtaining, by a first service router (SR), a first service routing packet, where the first service routing packet includes path identification information and identification information of a service node (SN), and sending, by the first SR, the first service routing packet to the SN.

Abstract: In some examples, a system includes a router device and a first adapter device in communication with the router device. The first adapter device includes processing circuitry configured to: communicate with the router device, wherein the router device is incapable of communicating in accordance with the MACsec protocol. The processing circuitry is further configured to establish an encrypted connection in accordance with the MACsec protocol between the first adapter device and a remote device, determine that the encrypted connection is offline, and output a message to the router device that the encrypted connection is offline. The router device is configured to communicate with the remote device via a second adapter device configured to communicate in accordance with the MACsec protocol and bypass the first adapter device.

Abstract: A system and method for notifying client devices in a subscriber account that the account is undersubscribed and no further client devices can stream media content until other client devices are no longer actively streaming media content is disclosed herein. The method comprises receiving a request to receive and play the media content from a requesting client device, the requesting client device being one of a plurality of client devices enabled to receive media content according to a subscriber account and determining if the subscriber account is undersubscribed; if the subscriber account is not undersubscribed. If the subscriber account is not undersubscribed, initiating transmission of the media content, and if the subscriber account is undersubscribed, information is transmitted to the requesting client device, the information including data indicating the subscriber account is undersubscribed without initiating the transmission of the media content.

Abstract: A method for dynamically establishing a communication path for a requestor by assessing an authenticity of the requestor and a communication request is provided. The method may include, in response to receiving the communication request, dynamically determining whether to establish a communication path for the requestor to a destination though a communication network by assessing the requestor based on one or more authentication rules, wherein the one or more authentication rules are based on first information associated the communication network, second information about the requestor, and third information from the requestor. The method may further include, in response to determining that the requestor satisfies the one or more authentication rules, dynamically establishing the communication path for the requestor on the communication network according to one or more communication attributes associated with the requestor.

Abstract: A device may receive client cipher information, associated with initiating a secure session, identifying at least one key exchange cipher supported by a client device associated with the secure session. The device may determine, based on the client cipher information, that a Diffie-Hellman key exchange is to be used to establish the secure session. The device may determine whether a server device, associated with the secure session, supports use of the Diffie-Hellman key exchange. The device may manage establishment of the secure session using a first decryption technique based on determining that the server device does not support the use of the Diffie-Hellman key exchange, or manage establishment of the secure session using a second decryption technique based on determining that the server device supports the use of the Diffie-Hellman key exchange or being unable to determine whether the server device supports the use of the Diffie-Hellman key exchange.

Abstract: A method, system, and computer-readable storage medium are disclosed for identifying binary signatures in a selected set of files and assigning at least one of the binary signatures to a file format name or file format type for use in a security policy generator. In certain embodiments, the method for generating an electronic security policy for a file format type, includes: identification of a plurality of files stored in electronic memory, where the plurality of files include files having the same file format type; providing a file format name that is to be associated with the file format type; accessing the plurality of files from the electronic memory; identifying a common binary signature for the file format type included in the plurality of files; correlating the file format type with the common binary signature; and generating the security policy for the file format type using the file format name.

Abstract: Devices and methods for device connectivity management are disclosed. According to one embodiment, a system for device connectivity management may include a plurality of client devices, each client device supporting a plurality of communication channels; and a broker in communication with each of the client devices over each supported communication channel, the broker comprising at least one computer processor. Each client may send a subscription message to the broker over each supported communication channel. The broker may send each subscribed client a keep alive message over each subscribed supported communication channel, and may broker publish a status message to each subscribed client over each subscribed supported communication channel for a non-responding client. One of the plurality of clients may execute an action in response to the status message.

Abstract: A method performed by a security system that can analyze a vulnerability or a risk applicable to a network entity to identify a cybersecurity threat and associated risk level. The security system can store indications of cybersecurity threats and risk levels in a database of a Domain Name System (DNS). The security system can monitor and resolve network traffic to determine IP addresses or URLs associated with the cybersecurity threats. The security system stores a map of the cybersecurity threats and IP addresses or URLs such that the security system can protect a network entity by processing network traffic to sources or destinations of network traffic that can harm particular network entities, and execute personalized security procedures to protect the network entities.

Abstract: A management method is described, the method implemented by a transmission device capable of communicating via a first wireless with a gateway device forming a node of a telecommunication network and configured to communicate with at least one server of the network via the gateway device. The method can include establishing a secure communication session with a terminal included in a list of terminals for which the transmission device has obtained management data. The method can also include receiving via the first communication link a request to end the management of the terminal, and removing the terminal from the list following the receipt of the request. A transmission device which can be used to implement the management method is also described.

Abstract: Methods, systems, and devices for wireless communications are described. A first user equipment (UE), such as a pedestrian UE, may perform a discovery procedure with a second UE in a vehicle-to-everything (V2X) wireless communications environment that includes multiple other UEs in addition to the first UE and the second UE. The second UE may, for example, be a roadside UE configured to aggregate V2X messages for the first UE. The first UE may determine, based on performing the discovery procedure, a schedule for the first UE to use to receive bundled V2X messages from the second UE. The first UE may receive, from the second UE based on the determined schedule, a message indicating bundled information from multiple V2X messages received at the second UE from the multiple UEs.

Abstract: A media exfiltration authorization system is provided. A computer device receives a request from an application on a remote device, wherein the request is to store data on an external storage device. The computing device validates that the application is running in protected space on the remote device and includes an established unique identifier. The computing device generates an encryption key for the external storage device based, at least in part, on the validating. The computing device sends the encryption key to the application with authorization for the application to reformat the external storage device, store the requested data on the external storage device, and encrypt the external storage device using the encryption key.

Abstract: A Protocol Analyzer is provided for monitoring and debugging a high-speed communications link between a local device and a remote device. The local device may include a communications protocol block for interfacing with the remote device. The Protocol Analyzer may include an embedded logic debugging circuit on the local device, where the logic debugging circuit is configured to capture link data based on user-defined events to create a corresponding database of signal capture in a local memory. The Protocol Analyzer is configured to import the database from memory and to decode the link data to display on a user interface that organizes key link sequencing events along with their timestamps to help the user more accurately and quickly debug any link bring-up issues.

Abstract: This application provides a method and an apparatus for invoking an application programming interface (API), to determine a target exposing function network element used to invoke an API. The method includes: A first network element obtains routing information of an API, where the routing information is used to indicate a route for invoking the API, and the API is provided by a first exposing function network element and a second exposing function network element; the first network element obtains invocation parameter information of the API, where the invocation parameter information is used to handle the API; and the first network element determines a target exposing function network element in the first exposing function network element and the second exposing function network element based on the routing information and the invocation parameter information.

Abstract: A service platform obtains order data of an order placed by a target user through a user interface and history data of the target user associated with one or more user interface operations for placing the order, where the history data includes page code of one or more pages of the user interface associated with the one or more user interface operations. The service platform generates, based on the history data and the order data, usage data of the target user. The service platform determines a digital digest of the usage data. The service platform sends the digital digest to a blockchain network associated with a blockchain, where the digital digest is verified by a blockchain node of the blockchain network, and where the digital digest is stored on the blockchain in response to a determination that the digital digest passes a verification.

Abstract: A novel and useful mechanism for providing security features to a wireless communications system that otherwise does not have such features. Security features including encryption and decryption of communications, secure key exchange, secure pairing, and secure re-pairing are provided. The invention is applicable to wireless communication systems such as IO-Link Wireless. The encryption/decryption mechanism uses AES-256 block cypher with counter mode to generate blocks of cypher bits used to encrypt and decrypt communications between the master and devices. Session keys are generated using a random salt and a counter value. The random salt is generated using a secure random number generator such as the CSPRNG algorithm. A master key (or device key) is also used in generating session keys. Session keys are not permanent and are used to encrypt/decrypt only a finite amount of data. Once exhausted, the session key is replaced by a new one and cypher bits are generated using the new session key.

Abstract: A radio communication device installed on a vehicle of this application comprises a radio communicator configured to perform a radio communication with a plurality of networks, a controller configured to perform location registration or a call origination via each of the plurality of networks, and a storage configured to store location registration results or call origination results for each of the plurality of networks. The controller is configured to select a network affording more favorable results than results of one of the plurality of networks based on the location registration results or call origination results stored in the storage, and perform location registration at a time of an emergency call origination by using the selected network.

Abstract: A method for authenticating a client terminal by a target server. The method includes: the client terminal authenticates itself with an authentication server; the target server authenticates itself with the authentication server; the authentication server and the target server share a password for the client terminal; the authentication server transmits the password to the client terminal; the client terminal transmits the password to the target server; and the target server determines whether or not there is a correspondence between the password shared with the authentication server and the password transmitted by the client terminal, and if the correspondence between passwords exists, the client terminal is authenticated by the target server.

Abstract: A method performed by a security system of a 5G network to protect against cyberattacks on a personalized basis. The security system can identify a cybersecurity threat to a wireless device based on contextual information relating to the wireless device, a user preference, or a call detail record. The security system can determine a one-time fee to charge the user in exchange for protecting the wireless device against the cybersecurity threat, generate an on-demand coupon to protect the wireless device against the cybersecurity threat, and send the on-demand coupon to the wireless device based at least in part on the contextual information relating to the wireless device and the user preference. When the security system receives an indication that the on-demand coupon was redeemed, responds by deploying a network asset to protect the wireless device against the cybersecurity threat.

Abstract: An improved backhaul protocol is provided, as well as computer-implemented systems and methods for autonomously broadcasting video data, audio data, or video and audio data during an event, wherein the broadcasting can be scheduled in advance and from a remote location (e.g., using a web browser), and wherein the video/audio data is streamed to a remote user over a network using the improved backhaul protocol.

Abstract: A user may securely access a remote virtual machine (RVM) by authenticating with a single sign-on portal (SSOP) connected to a request collector. The request collector is connected to a remote access helper (RAH) associated with the RVM. Upon a user request from the SSOP, a one-time password (OTP) is generated by the RVM and the RAH sends an acceptance notice to the request collector. The request collector generates a payload containing a URL which is sent to the SSOP and connects to the URL downloading a file containing the OTP. The user then connects to and accesses the RVM using the OTP contained in the file.

Abstract: Encryption operations using private and public cryptographic signature keys may be used to facilitate secure and uniquely identifiable audit records relating to website content classification. Blockchain may be used to facilitate collection, storage, and sharing of encrypted audit records. Based on shared encrypted information (e.g. from the blockchain or elsewhere) a content evaluation consensus may be formed. Collections of encrypted audit records may be processed and results of the processing may also be shared via the blockchain. Subsequent operations can include sharing of the processing results.

Abstract: A security device to support secure communication via a field bus, has a connecting apparatus for the direct coupling of the security device to a network interface of a field bus subscriber, which is formed for connecting to a field bus and which is not formed for secure communication via the field bus. In the coupled state, there is a link between the security device and the field bus subscriber such that, if the link is disconnected or damaged, proper operation of the security device is reversibly or irreversibly blocked. Further, a transmitting and receiving apparatus is provided which is formed to securely transfer data coming from a directly coupled field bus participant, which is not formed for secure communication, via the field bus according to a predetermined security protocol, and which is further formed to receive data transferred via the field bus and intended for the field bus participant according to the predetermined security protocol and to deliver them to the field bus participant.

Abstract: Methods, systems, and devices supporting active fingerprinting for transport layer security (TLS) servers are described. In some systems, a client device may transmit a same set of client hello messages to each TLS server. The client device may receive a set of server hello messages in response to the standard set of client hello messages based on the contents of each client hello message. For example, a server hello message may indicate a selected cipher suite, TLS protocol version, and set of extensions in response to the specific information included in a client hello message. The client device may generate a hash value (e.g., a fuzzy hash) based on the set of server hello messages received from a TLS server. By comparing the hash values generated for different TLS servers, the client device may determine whether the TLS configurations for the different TLS servers are the same or different.

Abstract: Systems, methods, and computer-readable media for discovering trustworthy devices through attestation and authenticating devices through mutual attestation. A relying node in a network environment can receive attestation information from an attester node in the network environment as part of a unidirectional push of information from the attester node according to a unidirectional link layer communication scheme. A trustworthiness of the attester node can be verified by identifying a level of trust of the attester node from the attestation information. Further, network service access of the attester node through the relying node in the network environment can be controlled based on the level of trust of the attester node identified from the attestation information.

Abstract: Embodiments of the invention are directed to the utilization of trust tokens to perform secure message transactions between two devices. A trust token transmitted in a message from one device may include first data that is digitally signed by a trust provider computer, and second data that is digitally signed by the device itself. Upon receipt of a message containing a trust token, the recipient may utilize the first data to verify with the trust provider computer that the sender of the message is a trusted party. The trust provider computer may provide the recipient device the public key of the sender. The recipient may utilize the second data and the provided public key to verify that the sender signed the message and that the message is unaltered. These techniques may increase detection of relay, replay, or other man-in-the-middle attacks, decreasing the likelihood that such attacks will be successful.

Abstract: An authentication method and system includes a computing device, such as a smart phone, which includes a display for presenting a graphical and interactive game board that is used for entering a user's passcode. During the authentication process, the user selects a game board (e.g. chess, checkers, poker, backgammon, etc.) and associated game pieces for presentation on the display. The user then moves one or more game pieces to locations on the game board. Together, the selected game board, selected game pieces, and the movements and/or locations which the game pieces are moved on the game board form an entered passcode. This generated passcode is then compared with a stored passcode to authenticate the user before granting access to the computing device.

Abstract: The present invention provides a mechanism capable of creating, in a simplified manner, a safety program in accordance with a safety use. A program creation assistance device assists in creation of the safety program to be executed by a safety controller. The program creation assistance device selects a safety use of the safety program to be created in accordance with user input, determines, based on the safety use selected, an input block to which a safety input signal from an input device is assigned and a functional block that implements a safety function suitable for the safety use selected, the input block and the function block making up the safety program, provides an unfinished safety program in a programmable manner, the unfinished safety program including the blocks determined, and supplements the unfinished safety program to create the safety program in accordance with user input.

Abstract: An image capture device for a secure industrial control system is disclosed. In an embodiment, the image capture device includes: an image sensor; a signal processor coupled to the image sensor; and a controller for managing the signal processor and transmitting data associated with processed image signals to at least one of an input/output module or a communications/control module via a communications interface that couples the controller to the at least one of the input/output module or the communications/control module, wherein the controller is configured to establish an encrypted tunnel between the controller and the at least one of the input/output module or the communications/control module based upon at least one respective security credential of the image capture device and at least one respective security credential of the at least one of the input/output module or the communications/control module.

Abstract: Disclosed herein are system, method, and computer program product embodiments for restoring an electronic device. An embodiment operates by receiving a request for restoring a portion of data from a point of time onto the electronic device. Thereafter, the portion of data is scanned for a virus. Based on the detection of the virus, a determination is made on whether to proceed with restoring the electronic device with the portion of data. If the determination is made to proceed with the restoring of the electronic device, the portion of data is subsequently transmitted to the electronic device. The portion of data is stored in a backup repository remote from the electronic device.

Abstract: This disclosure describes methods and systems to for a method for a first computing node to receive frequency information of a system clock. The first computing node receives the frequency information of the system clock from a second computing node at a physical layer of a connection between the first computing node and the second computing node. The first computing node also receives a message from the second computing node at above the physical layer of the connection between the first computing node and the second computing node. The message includes an attestation of the frequency information from which the first computing node may verify that the second computing node is a trusted source of the frequency information.