Protection At A Particular Protocol Layer Patents (Class 713/151)
  • Patent number: 11968293
    Abstract: Context information of a handshake between a source entity and a target entity is obtained at a security proxy. The context information is transmitted from the security proxy to a key manager. The key manager maintains a first private key of the security proxy. A first handshake message is received from the key manager. The first handshake message is generated at least based on the context information and signed with the first private key. The first handshake message is then transmitted to the target entity.
    Type: Grant
    Filed: November 18, 2020
    Date of Patent: April 23, 2024
    Assignee: International Business Machines Corporation
    Inventors: Wei-Hsiang Hsiung, Chun-Shuo Lin, Wei-Jie Liau, Cheng-Ta Lee
  • Patent number: 11956160
    Abstract: An apparatus includes an input interface to receive incoming packets from a first network device and an output interface to send outgoing packets to a second network device. Media access control security (MACsec) circuitry is coupled between the input interface and the output interface. Bypass flow-control (FC) circuitry is coupled between the input interface and the MACsec circuitry. The bypass FC circuitry is to detect an FC packet in the incoming packets and pass the FC packet passively to the output interface to enable end-to-end flow control directly between the first network device and the second network device.
    Type: Grant
    Filed: June 1, 2021
    Date of Patent: April 9, 2024
    Assignee: Mellanox Technologies, Ltd.
    Inventors: Zachy Haramaty, Liron Mula, Alon Singer, Eduard Kvetny, Aviv Kfir
  • Patent number: 11943347
    Abstract: In an aspect, an integrated tamper resistant device generates initial network credentials for accessing a network, wherein the initial network credentials enable the integrated tamper resistant device to be authenticated by a network solution provider before operational network credentials are provided securely by the network solution provider. The integrated tamper resistant device encrypts the initial network credentials and cryptographically signs the encrypted initial network credentials. The integrated tamper resistant device outputs the encrypted and signed initial network credentials for delivery to the network solution provider.
    Type: Grant
    Filed: March 3, 2020
    Date of Patent: March 26, 2024
    Assignee: QUALCOMM Incorporated
    Inventors: Or Elnekaveh, Ofir Alon, Shlomi Agmon
  • Patent number: 11936690
    Abstract: Techniques and mechanisms for using passively collected network data to automatically generate a fingerprint prevalence database without the need for endpoint ground truth. The process first clusters all observations with the same fingerprint string and similar source and destination context. The process then annotates each cluster with descriptive information and uses a rule-based system to derive an informative name from that descriptive information, e.g., “winnt amp client” or “cross-platform browser”. Optionally, the learned database may be augmented by a user to clarify custom process labels. Additionally, the generated database may be used to report the inferred processes in the same way as databases generated with endpoint ground truth.
    Type: Grant
    Filed: January 10, 2023
    Date of Patent: March 19, 2024
    Inventors: Blake Harrell Anderson, David Arthur McGrew
  • Patent number: 11876787
    Abstract: An apparatus for providing secure communications may include a processor; memory in electronic communication with the processor; an output in electronic communication with the processor; and instructions stored in the memory and executable by the processor to cause the apparatus to store a plurality of encryption protocols; store at least one encryption hopping protocol; select at least one encryption hopping protocol; encrypt the data according to the selected encryption hopping protocol; and transmit data from the output utilizing the selected encryption hopping protocol.
    Type: Grant
    Filed: September 25, 2021
    Date of Patent: January 16, 2024
    Inventors: Richard G. Ries, Ellen M. Mason, Nathanael J. Ries
  • Patent number: 11848961
    Abstract: This disclosure provides for a network element (in the middle) to inject enrichments into SSL connections, and for taking them out. This network element is sometimes referred to herein as a “middle box.” In the context of layered software architecture, this solution preferably is implemented by a library that operates below the SSL layer and above the TCP sockets layer at the two endpoints of the SSL connection. Preferably, the SSL enrichments are implemented as SSL/TLS records.
    Type: Grant
    Filed: February 22, 2021
    Date of Patent: December 19, 2023
    Assignee: Akamai Technologies, Inc.
    Inventor: Mangesh Kasbekar
  • Patent number: 11838428
    Abstract: According to an example aspect of the present invention, there is provided a method comprising: generating a certificate comprising an identifier of a base station, a public key of the base station, and a public key of a terminal; signing the certificate by a signature based on a private key belonging to the public key of the base station; sending the signed certificate to the terminal using an established security association; monitoring whether the base station receives a request for local authentication of the terminal, wherein the request comprises an encrypted certificate unit and a base station identifier; checking whether the base station identifier is the identifier of the base station and, if it is, decrypting the encrypted certificate unit using the private key; and using the public key of the terminal for a communication with the terminal if the certificate unit comprises the signed certificate.
    Type: Grant
    Filed: December 14, 2022
    Date of Patent: December 5, 2023
    Assignee: Nokia Technologies Oy
    Inventors: Peter Schneider, Ranganathan Mavureddi Dhanasekaran
  • Patent number: 11824644
    Abstract: Methods, systems, and devices provide control over resources electronically communicated among computing devices. In some embodiments, a management application identifies multiple entities for communicating electronic content. The management application determines that at least a subset of the entities required for communicating the electronic content is available for electronic communication. The management application authorizes communication of at least some of the electronic content among the entities in response to determining that the required subset of entities is available for electronic communication.
    Type: Grant
    Filed: February 10, 2017
    Date of Patent: November 21, 2023
    Assignee: AirWatch, LLC
    Inventors: Erich Stuntebeck, John Dirico
  • Patent number: 11818569
    Abstract: Some methods in a wireless communication network may include providing a first authentication key, and deriving a second authentication key based on the first authentication key, with the second authentication key being associated with the wireless terminal. Responsive to deriving the second authentication key, a key response message may be transmitted including the second authentication key and/or an EAP-Finish/Re-auth message. Some other methods in a wireless communication network may include receiving a key response message including a core network mobility management authentication key and an EAP-Finish/Re-auth message. Responsive to receiving the key response message, the network may initiate transmission of an EAP-Finish/Re-auth message and/or a freshness parameter used to derive the core network mobility management authentication key from the wireless communication network to the wireless terminal responsive to the key response message. Related wireless terminal methods are also discussed.
    Type: Grant
    Filed: October 10, 2017
    Date of Patent: November 14, 2023
    Inventor: Monica Wifvesson
  • Patent number: 11812257
    Abstract: This disclosure provides systems, methods, and apparatuses for wireless communication performed by a wireless communication device. An example wireless communication device includes an access point (AP) multi-link device (MLD). The AP MLD transmits a beacon frame to a wireless station (STA) MLD, the beacon frame including a plurality of AP medium access control (MAC) addresses of respective APs belonging to the AP MLD. The AP MLD receives an association request from the STA MLD, the association request including a plurality of STA MAC addresses of respective STAs belonging to the STA MLD. The AP MLD generates, during a handshake operation with the STA MLD, one or more encryption keys configured to encrypt communications between the AP MLD and the STA MLD. The AP MLD verifies the plurality of STA MAC addresses based at least in part on the one or more encryption keys.
    Type: Grant
    Filed: March 2, 2021
    Date of Patent: November 7, 2023
    Assignee: QUALCOMM Incorporated
    Inventors: Sai Yiu Duncan Ho, Jouni Kalevi Malinen, George Cherian, Alfred Asterjadhi, Abhishek Pramod Patil
  • Patent number: 11812263
    Abstract: Methods and apparatus for securely storing, using and/or updating credential information, e.g., passwords and user IDs for a user who subscribes to one or more services, e.g., video stream services or other services available through a communications network such as the Internet, are described.
    Type: Grant
    Filed: March 9, 2021
    Date of Patent: November 7, 2023
    Inventors: Mark Reimer, Douglas Melroy
  • Patent number: 11792172
    Abstract: Techniques for providing privacy features in communication systems are provided. For example, a message may be provided from user equipment to an element or function in a communication network that comprises one or more privacy indicators, where privacy features for processing the message are determined based on the privacy indicators. The message may comprise an attach request comprising a subscription identifier for a subscriber associated with the user equipment, with the privacy indicators comprising a flag indicating whether the subscription identifier in the attach request is privacy-protected. As another example, the element of function in the communication network may determine privacy features supported by the communication network and generate and send a message to user equipment comprising one or more privacy indicators selected based on the determined privacy features.
    Type: Grant
    Filed: October 26, 2017
    Date of Patent: October 17, 2023
    Inventors: Suresh P. Nair, Anja Jerichow, Annett Seefeldt
  • Patent number: 11777974
    Abstract: A network connection between a server group of a data intake and query system and each of one or more source network nodes is established. Source data at the server group is received from at least one of the one or more source network nodes via the respective network connections and transformed, by the indexer server, to timestamped data entries of machine data. A model management server detects data constraints for a security model that include a data element used by the security model and an availability requirement set. Using the timestamped data entries, the data constraints are validated, and the validation used to determine a data availability assessment of the security model.
    Type: Grant
    Filed: February 24, 2022
    Date of Patent: October 3, 2023
    Assignee: Splunk Inc.
    Inventors: Marios Iliofotou, Bo Lei, Essam Zaky, Karthik Kannan, George Apostolopoulos, Jeswanth Manikonda, Sitaram Venkatraman
  • Patent number: 11758475
    Abstract: A method for network selection on a user equipment (UE) device and the UE device are shown. The user equipment device registers on a first network in a wide area cellular network (WACN) band and receives, from a wireless local area network (WLAN), a list of WACNs that support generic access network (GAN) capabilities. The user equipment device selects the WLAN if the first network is on the list.
    Type: Grant
    Filed: April 5, 2022
    Date of Patent: September 12, 2023
    Assignee: BlackBerry Limited
    Inventors: Adrian Buckley, George Baldwin Bumiller
  • Patent number: 11743300
    Abstract: A method of establishing a secure communication channel between a first communication device and a second communication device. The secure communication channel is defined by one or more algorithm options and the one or more algorithm options are associated with one of one or more option categories. The method includes receiving a signal representing one or more selections. The method further includes, for the respective option categories, generating a sorted list of algorithm options based on the received selections and generating a security association proposal including one or more of the algorithm options from the respective sorted lists of algorithm options. The security association proposal is generated based on an order in the sorted list of algorithm options. The method further includes transmitting the security association proposal to the second communication device for establishing the secure communication channel.
    Type: Grant
    Filed: October 14, 2021
    Date of Patent: August 29, 2023
    Assignee: BlackBerry Limited
    Inventors: Chang Fung Yang, Jason Songbo Xu
  • Patent number: 11716195
    Abstract: The present application describes a method, system, and non-transitory computer-readable medium for exchanging encrypted communications using hybrid encryption. According to the present disclosure, a first device receives an encrypted communication from a second device. The encrypted communication includes a first encrypted secret, a second encrypted secret, a first signature, and a second signature. The first device verifies the first signature and the second signature, and, when the first and second signatures are valid, decrypts the first encrypted secret using a first encryption algorithm and the second encrypted secret using a second encryption algorithm. The first device combines the first decrypted secret and the second decrypted secret to recover a first communication and provides the first communication to a user of the first device.
    Type: Grant
    Filed: October 22, 2020
    Date of Patent: August 1, 2023
    Assignee: Amazon Technologies, Inc.
    Inventor: Joël Alwen
  • Patent number: 11688194
    Abstract: A method of authenticating an identity document based on an extraction, by analysis of an image acquired of the identity document, of candidate information representative of the appearance of a photograph such as depicted in the acquired image and optically readable data as depicted in the acquired image.
    Type: Grant
    Filed: April 22, 2020
    Date of Patent: June 27, 2023
    Inventor: Sébastien Bahloul
  • Patent number: 11677757
    Abstract: A method for identifying malicious encrypted network traffic associated with a malware software component communicating via a network, the method including, for the malware, a portion of network traffic including a plurality of contiguous bytes occurring at a predefined offset in a network communication of the malware; extracting the defined portion of network traffic for each of a plurality of disparate encrypted network connections for the malware; training an autoencoder based on each extracted portion of network traffic, wherein the autoencoder includes: a set of input units each for representing information from a byte of an extracted portion; output units each for storing an output of the autoencoder; and a set of hidden units smaller in number than the set of input units and each interconnecting all input and all output units with weighted interconnections, such that the autoencoder is trainable to provide an approximated reconstruction of values of the input units at the output units; selecting a set
    Type: Grant
    Filed: March 26, 2018
    Date of Patent: June 13, 2023
    Assignee: British Telecommunications Public Limited Company
    Inventors: Fadi El-Moussa, George Kallos
  • Patent number: 11665161
    Abstract: An identity server authenticates a first user identity for a user device through a first authentication exchange as part of a passwordless authentication system. The identity server registers with a relying party as an authenticator for a second user identity. The identity server initiates a second authentication exchange by obtaining from the relying party, a credential request associated with the second user identity. Responsive to a determination that the first user identity authenticated in the first authentication exchange is authorized to act as the second user identity, the identity server obtains a credential request response authenticated by the authenticator in the identity server. The identity server completes the second authentication exchange by providing the credential response to the relying party. The second authentication exchange authenticates the user device to the relying party without involving the user device.
    Type: Grant
    Filed: June 18, 2019
    Date of Patent: May 30, 2023
    Inventors: Eldridge Lee Alexander, James Leslie Barclay, Nicholas James Mooney, Mujtaba Hussain
  • Patent number: 11652647
    Abstract: In an authentication system (120) of an organization that is another organization different from a first organization that a first user belongs to, a management device (200) accepts a registration transaction for a client certificate of the first user. Then, the management device registers the client certificate of the first user in a client certificate blockchain. When the first user accesses a service of another organization from a user terminal of the first organization, an authentication device (300) authenticates the first user using the client certificate of the first user in the client certificate blockchain.
    Type: Grant
    Filed: August 11, 2020
    Date of Patent: May 16, 2023
    Assignee: Mitsubishi Electric Corporation
    Inventors: Masaya Honjo, Mitsuhiro Matsumoto
  • Patent number: 11637774
    Abstract: A service routing packet processing method, apparatus and system. The method includes obtaining, by a first service router (SR), a first service routing packet, where the first service routing packet includes path identification information and identification information of a service node (SN), and sending, by the first SR, the first service routing packet to the SN.
    Type: Grant
    Filed: November 25, 2020
    Date of Patent: April 25, 2023
    Inventor: Lehong Niu
  • Patent number: 11606390
    Abstract: In some examples, a system includes a router device and a first adapter device in communication with the router device. The first adapter device includes processing circuitry configured to: communicate with the router device, wherein the router device is incapable of communicating in accordance with the MACsec protocol. The processing circuitry is further configured to establish an encrypted connection in accordance with the MACsec protocol between the first adapter device and a remote device, determine that the encrypted connection is offline, and output a message to the router device that the encrypted connection is offline. The router device is configured to communicate with the remote device via a second adapter device configured to communicate in accordance with the MACsec protocol and bypass the first adapter device.
    Type: Grant
    Filed: March 30, 2021
    Date of Patent: March 14, 2023
    Assignee: Juniper Networks, Inc.
    Inventors: Gert Grammel, Ajay Kachrani, Hao Wang
  • Patent number: 11601716
    Abstract: A system and method for notifying client devices in a subscriber account that the account is undersubscribed and no further client devices can stream media content until other client devices are no longer actively streaming media content is disclosed herein. The method comprises receiving a request to receive and play the media content from a requesting client device, the requesting client device being one of a plurality of client devices enabled to receive media content according to a subscriber account and determining if the subscriber account is undersubscribed; if the subscriber account is not undersubscribed. If the subscriber account is not undersubscribed, initiating transmission of the media content, and if the subscriber account is undersubscribed, information is transmitted to the requesting client device, the information including data indicating the subscriber account is undersubscribed without initiating the transmission of the media content.
    Type: Grant
    Filed: March 3, 2021
    Date of Patent: March 7, 2023
    Assignee: ARRIS Enterprises LLC
    Inventors: Nithin Raj Kuyyar Ravindranath, Sandeep Guddeokoppa Suresh, Vinod Jatti, Kiran Tovinkere Srinivasan
  • Patent number: 11595444
    Abstract: A method for dynamically establishing a communication path for a requestor by assessing an authenticity of the requestor and a communication request is provided. The method may include, in response to receiving the communication request, dynamically determining whether to establish a communication path for the requestor to a destination though a communication network by assessing the requestor based on one or more authentication rules, wherein the one or more authentication rules are based on first information associated the communication network, second information about the requestor, and third information from the requestor. The method may further include, in response to determining that the requestor satisfies the one or more authentication rules, dynamically establishing the communication path for the requestor on the communication network according to one or more communication attributes associated with the requestor.
    Type: Grant
    Filed: December 3, 2020
    Date of Patent: February 28, 2023
    Assignee: International Business Machines Corporation
    Inventors: Gina Renee Howard, Charles Steven Lingafelt, John E. Moore, Jr., Andrew R. Jones
  • Patent number: 11569986
    Abstract: A device may receive client cipher information, associated with initiating a secure session, identifying at least one key exchange cipher supported by a client device associated with the secure session. The device may determine, based on the client cipher information, that a Diffie-Hellman key exchange is to be used to establish the secure session. The device may determine whether a server device, associated with the secure session, supports use of the Diffie-Hellman key exchange. The device may manage establishment of the secure session using a first decryption technique based on determining that the server device does not support the use of the Diffie-Hellman key exchange, or manage establishment of the secure session using a second decryption technique based on determining that the server device supports the use of the Diffie-Hellman key exchange or being unable to determine whether the server device supports the use of the Diffie-Hellman key exchange.
    Type: Grant
    Filed: February 12, 2018
    Date of Patent: January 31, 2023
    Assignee: Juniper Networks, Inc.
    Inventors: Rajeev Chaubey, Venkata Rama Raju Manthena
  • Patent number: 11562093
    Abstract: A method, system, and computer-readable storage medium are disclosed for identifying binary signatures in a selected set of files and assigning at least one of the binary signatures to a file format name or file format type for use in a security policy generator. In certain embodiments, the method for generating an electronic security policy for a file format type, includes: identification of a plurality of files stored in electronic memory, where the plurality of files include files having the same file format type; providing a file format name that is to be associated with the file format type; accessing the plurality of files from the electronic memory; identifying a common binary signature for the file format type included in the plurality of files; correlating the file format type with the common binary signature; and generating the security policy for the file format type using the file format name.
    Type: Grant
    Filed: March 6, 2019
    Date of Patent: January 24, 2023
    Assignee: Forcepoint LLC
    Inventor: Amit Nitzan
  • Patent number: 11563823
    Abstract: Devices and methods for device connectivity management are disclosed. According to one embodiment, a system for device connectivity management may include a plurality of client devices, each client device supporting a plurality of communication channels; and a broker in communication with each of the client devices over each supported communication channel, the broker comprising at least one computer processor. Each client may send a subscription message to the broker over each supported communication channel. The broker may send each subscribed client a keep alive message over each subscribed supported communication channel, and may broker publish a status message to each subscribed client over each subscribed supported communication channel for a non-responding client. One of the plurality of clients may execute an action in response to the status message.
    Type: Grant
    Filed: November 27, 2019
    Date of Patent: January 24, 2023
    Assignee: VERIFONE, INC.
    Inventors: Ciarán MacAonghusa, Aidan Totterdell
  • Patent number: 11546368
    Abstract: A method performed by a security system that can analyze a vulnerability or a risk applicable to a network entity to identify a cybersecurity threat and associated risk level. The security system can store indications of cybersecurity threats and risk levels in a database of a Domain Name System (DNS). The security system can monitor and resolve network traffic to determine IP addresses or URLs associated with the cybersecurity threats. The security system stores a map of the cybersecurity threats and IP addresses or URLs such that the security system can protect a network entity by processing network traffic to sources or destinations of network traffic that can harm particular network entities, and execute personalized security procedures to protect the network entities.
    Type: Grant
    Filed: September 28, 2020
    Date of Patent: January 3, 2023
    Assignee: T-Mobile USA, Inc.
    Inventor: Venson Shaw
  • Patent number: 11540336
    Abstract: A management method is described, the method implemented by a transmission device capable of communicating via a first wireless with a gateway device forming a node of a telecommunication network and configured to communicate with at least one server of the network via the gateway device. The method can include establishing a secure communication session with a terminal included in a list of terminals for which the transmission device has obtained management data. The method can also include receiving via the first communication link a request to end the management of the terminal, and removing the terminal from the list following the receipt of the request. A transmission device which can be used to implement the management method is also described.
    Type: Grant
    Filed: November 29, 2018
    Date of Patent: December 27, 2022
    Assignee: ORANGE
    Inventors: Quentin Lampin, Dominique Barthel
  • Patent number: 11533603
    Abstract: Methods, systems, and devices for wireless communications are described. A first user equipment (UE), such as a pedestrian UE, may perform a discovery procedure with a second UE in a vehicle-to-everything (V2X) wireless communications environment that includes multiple other UEs in addition to the first UE and the second UE. The second UE may, for example, be a roadside UE configured to aggregate V2X messages for the first UE. The first UE may determine, based on performing the discovery procedure, a schedule for the first UE to use to receive bundled V2X messages from the second UE. The first UE may receive, from the second UE based on the determined schedule, a message indicating bundled information from multiple V2X messages received at the second UE from the multiple UEs.
    Type: Grant
    Filed: October 8, 2020
    Date of Patent: December 20, 2022
    Assignee: Qualcomm Incorporated
    Inventors: Hong Cheng, Kapil Gulati, Junyi Li, Sudhir Kumar Baghel, Dan Vassilovski
  • Patent number: 11526633
    Abstract: A media exfiltration authorization system is provided. A computer device receives a request from an application on a remote device, wherein the request is to store data on an external storage device. The computing device validates that the application is running in protected space on the remote device and includes an established unique identifier. The computing device generates an encryption key for the external storage device based, at least in part, on the validating. The computing device sends the encryption key to the application with authorization for the application to reformat the external storage device, store the requested data on the external storage device, and encrypt the external storage device using the encryption key.
    Type: Grant
    Filed: August 27, 2020
    Date of Patent: December 13, 2022
    Assignee: Kyndryl, Inc.
    Inventors: John J. Auvenshine, Joseph Dawson Davis, III, Khwaja Jawahar Jahangir Shaik
  • Patent number: 11516106
    Abstract: A Protocol Analyzer is provided for monitoring and debugging a high-speed communications link between a local device and a remote device. The local device may include a communications protocol block for interfacing with the remote device. The Protocol Analyzer may include an embedded logic debugging circuit on the local device, where the logic debugging circuit is configured to capture link data based on user-defined events to create a corresponding database of signal capture in a local memory. The Protocol Analyzer is configured to import the database from memory and to decode the link data to display on a user interface that organizes key link sequencing events along with their timestamps to help the user more accurately and quickly debug any link bring-up issues.
    Type: Grant
    Filed: June 27, 2018
    Date of Patent: November 29, 2022
    Assignee: Intel Corporation
    Inventors: Anuj Agrawal, Chirag Bharat Thakkar
  • Patent number: 11516310
    Abstract: This application provides a method and an apparatus for invoking an application programming interface (API), to determine a target exposing function network element used to invoke an API. The method includes: A first network element obtains routing information of an API, where the routing information is used to indicate a route for invoking the API, and the API is provided by a first exposing function network element and a second exposing function network element; the first network element obtains invocation parameter information of the API, where the invocation parameter information is used to handle the API; and the first network element determines a target exposing function network element in the first exposing function network element and the second exposing function network element based on the routing information and the invocation parameter information.
    Type: Grant
    Filed: July 13, 2021
    Date of Patent: November 29, 2022
    Assignee: Huawei Technologies Co., Ltd.
    Inventors: Cuili Ge, Yanmei Yang, Yizhuang Wu
  • Patent number: 11501322
    Abstract: A service platform obtains order data of an order placed by a target user through a user interface and history data of the target user associated with one or more user interface operations for placing the order, where the history data includes page code of one or more pages of the user interface associated with the one or more user interface operations. The service platform generates, based on the history data and the order data, usage data of the target user. The service platform determines a digital digest of the usage data. The service platform sends the digital digest to a blockchain network associated with a blockchain, where the digital digest is verified by a blockchain node of the blockchain network, and where the digital digest is stored on the blockchain in response to a determination that the digital digest passes a verification.
    Type: Grant
    Filed: June 30, 2021
    Date of Patent: November 15, 2022
    Assignee: Alipay (Hangzhou) Information Technology Co., Ltd.
    Inventors: Xiangyang Huo, Yushen Ma, Tiantian Li, Longlong He, Mingli Wang
  • Patent number: 11503465
    Abstract: A novel and useful mechanism for providing security features to a wireless communications system that otherwise does not have such features. Security features including encryption and decryption of communications, secure key exchange, secure pairing, and secure re-pairing are provided. The invention is applicable to wireless communication systems such as IO-Link Wireless. The encryption/decryption mechanism uses AES-256 block cypher with counter mode to generate blocks of cypher bits used to encrypt and decrypt communications between the master and devices. Session keys are generated using a random salt and a counter value. The random salt is generated using a secure random number generator such as the CSPRNG algorithm. A master key (or device key) is also used in generating session keys. Session keys are not permanent and are used to encrypt/decrypt only a finite amount of data. Once exhausted, the session key is replaced by a new one and cypher bits are generated using the new session key.
    Type: Grant
    Filed: February 19, 2020
    Date of Patent: November 15, 2022
    Assignee: Coretigo Ltd.
    Inventors: Nir Efraim Joseph Tal, Dan Wolberg, Alex Regev
  • Patent number: 11503448
    Abstract: A radio communication device installed on a vehicle of this application comprises a radio communicator configured to perform a radio communication with a plurality of networks, a controller configured to perform location registration or a call origination via each of the plurality of networks, and a storage configured to store location registration results or call origination results for each of the plurality of networks. The controller is configured to select a network affording more favorable results than results of one of the plurality of networks based on the location registration results or call origination results stored in the storage, and perform location registration at a time of an emergency call origination by using the selected network.
    Type: Grant
    Filed: October 16, 2019
    Date of Patent: November 15, 2022
    Assignee: KYOCERA Corporation
    Inventor: Takeshi Makabe
  • Patent number: 11503016
    Abstract: A method for authenticating a client terminal by a target server. The method includes: the client terminal authenticates itself with an authentication server; the target server authenticates itself with the authentication server; the authentication server and the target server share a password for the client terminal; the authentication server transmits the password to the client terminal; the client terminal transmits the password to the target server; and the target server determines whether or not there is a correspondence between the password shared with the authentication server and the password transmitted by the client terminal, and if the correspondence between passwords exists, the client terminal is authenticated by the target server.
    Type: Grant
    Filed: December 17, 2019
    Date of Patent: November 15, 2022
    Assignee: ORANGE
    Inventor: Jean-Marc Duro
  • Patent number: 11496522
    Abstract: A method performed by a security system of a 5G network to protect against cyberattacks on a personalized basis. The security system can identify a cybersecurity threat to a wireless device based on contextual information relating to the wireless device, a user preference, or a call detail record. The security system can determine a one-time fee to charge the user in exchange for protecting the wireless device against the cybersecurity threat, generate an on-demand coupon to protect the wireless device against the cybersecurity threat, and send the on-demand coupon to the wireless device based at least in part on the contextual information relating to the wireless device and the user preference. When the security system receives an indication that the on-demand coupon was redeemed, responds by deploying a network asset to protect the wireless device against the cybersecurity threat.
    Type: Grant
    Filed: September 28, 2020
    Date of Patent: November 8, 2022
    Assignee: T-Mobile USA, Inc.
    Inventor: Venson Shaw
  • Patent number: 11483626
    Abstract: An improved backhaul protocol is provided, as well as computer-implemented systems and methods for autonomously broadcasting video data, audio data, or video and audio data during an event, wherein the broadcasting can be scheduled in advance and from a remote location (e.g., using a web browser), and wherein the video/audio data is streamed to a remote user over a network using the improved backhaul protocol.
    Type: Grant
    Filed: April 26, 2022
    Date of Patent: October 25, 2022
    Assignee: BOXCAST, LLC
    Inventors: Gordon R. Daily, Justin R. Hartman, Ronald C. Hopper, Joel S. Helbling
  • Patent number: 11477185
    Abstract: A user may securely access a remote virtual machine (RVM) by authenticating with a single sign-on portal (SSOP) connected to a request collector. The request collector is connected to a remote access helper (RAH) associated with the RVM. Upon a user request from the SSOP, a one-time password (OTP) is generated by the RVM and the RAH sends an acceptance notice to the request collector. The request collector generates a payload containing a URL which is sent to the SSOP and connects to the URL downloading a file containing the OTP. The user then connects to and accesses the RVM using the OTP contained in the file.
    Type: Grant
    Filed: February 14, 2020
    Date of Patent: October 18, 2022
    Inventors: Guido Pellizzer, Federico Simonetti
  • Patent number: 11443310
    Abstract: Encryption operations using private and public cryptographic signature keys may be used to facilitate secure and uniquely identifiable audit records relating to website content classification. Blockchain may be used to facilitate collection, storage, and sharing of encrypted audit records. Based on shared encrypted information (e.g. from the blockchain or elsewhere) a content evaluation consensus may be formed. Collections of encrypted audit records may be processed and results of the processing may also be shared via the blockchain. Subsequent operations can include sharing of the processing results.
    Type: Grant
    Filed: December 19, 2017
    Date of Patent: September 13, 2022
    Assignee: PayPal, Inc.
    Inventor: Raja Ashok Bolla
  • Patent number: 11423187
    Abstract: A security device to support secure communication via a field bus, has a connecting apparatus for the direct coupling of the security device to a network interface of a field bus subscriber, which is formed for connecting to a field bus and which is not formed for secure communication via the field bus. In the coupled state, there is a link between the security device and the field bus subscriber such that, if the link is disconnected or damaged, proper operation of the security device is reversibly or irreversibly blocked. Further, a transmitting and receiving apparatus is provided which is formed to securely transfer data coming from a directly coupled field bus participant, which is not formed for secure communication, via the field bus according to a predetermined security protocol, and which is further formed to receive data transferred via the field bus and intended for the field bus participant according to the predetermined security protocol and to deliver them to the field bus participant.
    Type: Grant
    Filed: December 21, 2017
    Date of Patent: August 23, 2022
    Assignees: Phoenix Contact GmbH & Co. KG, ABB SCHWEIZ AG
    Inventors: Guido Venema, Patrick Lessing, Michael Hotz, Stefan Bollmeyer, Ragnar Schierholz, Bernd Wansner, Marten Hinrichs
  • Patent number: 11411997
    Abstract: Methods, systems, and devices supporting active fingerprinting for transport layer security (TLS) servers are described. In some systems, a client device may transmit a same set of client hello messages to each TLS server. The client device may receive a set of server hello messages in response to the standard set of client hello messages based on the contents of each client hello message. For example, a server hello message may indicate a selected cipher suite, TLS protocol version, and set of extensions in response to the specific information included in a client hello message. The client device may generate a hash value (e.g., a fuzzy hash) based on the set of server hello messages received from a TLS server. By comparing the hash values generated for different TLS servers, the client device may determine whether the TLS configurations for the different TLS servers are the same or different.
    Type: Grant
    Filed: December 17, 2020
    Date of Patent: August 9, 2022
    Assignee: Salesforce, Inc.
    Inventors: John Brooke Althouse, Andrew Smart, Randy Nunnally, Jr., Michael Brady, Caleb Yu
  • Patent number: 11411994
    Abstract: Systems, methods, and computer-readable media for discovering trustworthy devices through attestation and authenticating devices through mutual attestation. A relying node in a network environment can receive attestation information from an attester node in the network environment as part of a unidirectional push of information from the attester node according to a unidirectional link layer communication scheme. A trustworthiness of the attester node can be verified by identifying a level of trust of the attester node from the attestation information. Further, network service access of the attester node through the relying node in the network environment can be controlled based on the level of trust of the attester node identified from the attestation information.
    Type: Grant
    Filed: April 3, 2020
    Date of Patent: August 9, 2022
    Inventors: Sujal Sheth, Shwetha Subray Bhandari, Eric Voit, William F. Sulzen, Frank Brockners
  • Patent number: 11399043
    Abstract: Embodiments of the invention are directed to the utilization of trust tokens to perform secure message transactions between two devices. A trust token transmitted in a message from one device may include first data that is digitally signed by a trust provider computer, and second data that is digitally signed by the device itself. Upon receipt of a message containing a trust token, the recipient may utilize the first data to verify with the trust provider computer that the sender of the message is a trusted party. The trust provider computer may provide the recipient device the public key of the sender. The recipient may utilize the second data and the provided public key to verify that the sender signed the message and that the message is unaltered. These techniques may increase detection of relay, replay, or other man-in-the-middle attacks, decreasing the likelihood that such attacks will be successful.
    Type: Grant
    Filed: October 22, 2019
    Date of Patent: July 26, 2022
    Assignee: Visa International Service Association
    Inventor: Quan Wang
  • Patent number: 11354395
    Abstract: An authentication method and system includes a computing device, such as a smart phone, which includes a display for presenting a graphical and interactive game board that is used for entering a user's passcode. During the authentication process, the user selects a game board (e.g. chess, checkers, poker, backgammon, etc.) and associated game pieces for presentation on the display. The user then moves one or more game pieces to locations on the game board. Together, the selected game board, selected game pieces, and the movements and/or locations which the game pieces are moved on the game board form an entered passcode. This generated passcode is then compared with a stored passcode to authenticate the user before granting access to the computing device.
    Type: Grant
    Filed: April 3, 2018
    Date of Patent: June 7, 2022
    Inventors: Philip Manning, Conor McLennan, Ye Zhu
  • Patent number: 11321055
    Abstract: The present invention provides a mechanism capable of creating, in a simplified manner, a safety program in accordance with a safety use. A program creation assistance device assists in creation of the safety program to be executed by a safety controller. The program creation assistance device selects a safety use of the safety program to be created in accordance with user input, determines, based on the safety use selected, an input block to which a safety input signal from an input device is assigned and a functional block that implements a safety function suitable for the safety use selected, the input block and the function block making up the safety program, provides an unfinished safety program in a programmable manner, the unfinished safety program including the blocks determined, and supplements the unfinished safety program to create the safety program in accordance with user input.
    Type: Grant
    Filed: October 9, 2020
    Date of Patent: May 3, 2022
    Inventor: Masashi Kawanaka
  • Patent number: 11314854
    Abstract: An image capture device for a secure industrial control system is disclosed. In an embodiment, the image capture device includes: an image sensor; a signal processor coupled to the image sensor; and a controller for managing the signal processor and transmitting data associated with processed image signals to at least one of an input/output module or a communications/control module via a communications interface that couples the controller to the at least one of the input/output module or the communications/control module, wherein the controller is configured to establish an encrypted tunnel between the controller and the at least one of the input/output module or the communications/control module based upon at least one respective security credential of the image capture device and at least one respective security credential of the at least one of the input/output module or the communications/control module.
    Type: Grant
    Filed: March 31, 2020
    Date of Patent: April 26, 2022
    Inventor: Albert Rooyakkers
  • Patent number: 11303668
    Abstract: Disclosed herein are system, method, and computer program product embodiments for restoring an electronic device. An embodiment operates by receiving a request for restoring a portion of data from a point of time onto the electronic device. Thereafter, the portion of data is scanned for a virus. Based on the detection of the virus, a determination is made on whether to proceed with restoring the electronic device with the portion of data. If the determination is made to proceed with the restoring of the electronic device, the portion of data is subsequently transmitted to the electronic device. The portion of data is stored in a backup repository remote from the electronic device.
    Type: Grant
    Filed: September 27, 2019
    Date of Patent: April 12, 2022
    Assignee: Veeam Software AG
    Inventors: Ratmir Timashev, Anton Gostev
  • Patent number: 11294417
    Abstract: This disclosure describes methods and systems to for a method for a first computing node to receive frequency information of a system clock. The first computing node receives the frequency information of the system clock from a second computing node at a physical layer of a connection between the first computing node and the second computing node. The first computing node also receives a message from the second computing node at above the physical layer of the connection between the first computing node and the second computing node. The message includes an attestation of the frequency information from which the first computing node may verify that the second computing node is a trusted source of the frequency information.
    Type: Grant
    Filed: March 10, 2020
    Date of Patent: April 5, 2022
    Assignee: Cisco Technology, Inc.
    Inventors: Niranjan M M, Nagaraj Kenchaiah