Abstract: A reconnaissance engine gathers data about a client's computer network from the client, from devices and systems on the client's network, and from the Internet regarding various aspects of cybersecurity. Each of these aspects is evaluated independently, weighted, and cross-referenced to generate a cybersecurity score by aggregating individual vulnerability and risk factors together to provide a comprehensive characterization of cybersecurity risk using a transparent and traceable methodology. The scoring system itself can be used as a state machine with the cybersecurity score acting as a feedback mechanism, in which a cybersecurity score can be set at a level appropriate for a given organization, and data from clients or groups of clients with more extensive reporting can be used to supplement data for clients or groups of clients with less extensive reporting to enhance cybersecurity analysis and scoring.

Abstract: A method of establishing a secure communication channel between a first communication device and a second communication device. The secure communication channel is defined by one or more algorithm options and the one or more algorithm options are associated with one of one or more option categories. The method includes receiving a signal representing one or more selections. The method further includes, for the respective option categories, generating a sorted list of algorithm options based on the received selections and generating a security association proposal including one or more of the algorithm options from the respective sorted lists of algorithm options. The security association proposal is generated based on an order in the sorted list of algorithm options. The method further includes transmitting the security association proposal to the second communication device for establishing the secure communication channel.

Abstract: Systems and methods which provide a new application security assessment framework that allows auditing and testing systems to automatically perform security and compliance audits, detect technical security vulnerabilities, and illustrate the associated security risks affecting business-critical applications.

Abstract: In one embodiment, a first device in a network receives a quantum computing power metric indicative of a maximum available compute power of quantum computers. The first device receives, from a second device in the network, a listing of cryptographic suites available on the second device. The first device selects, based on the quantum computing power metric, a particular cryptographic suite from among the listing of cryptographic suites available on the second device. The first device sends, to the second device via the network, an indication that the particular cryptographic suite is to be used to encrypt and decrypt traffic exchanged between the first device and the second device.

Abstract: In an embodiment, an HSM may provide a cryptographic signature service. The HSM may maintain key/token pairs for various users/entities and for a first entity for which signature may be desired. The HSM may ensure that the requirements for the entity's signature are met, and then may apply the entity's signature. In an embodiment, the HSM may augment the private token for the first entity with the public keys of users/entities which are to approve the entity's signature. As the approvals are received, the HSM may record the approvals and may apply the signature once the approvals are received.

Abstract: Programming video data to different portions of memory is described herein. An example system includes a host interface, a memory device having a first portion and a second portion, and a controller coupled to the host interface and the memory device. The controller can be configured to program video data received via the host interface to the first portion of the memory device, and program video data received via the host interface to the second portion of the memory device instead of to the first portion of the memory device in response to receiving a signal that a trigger event has occurred.

Abstract: A device may transmit a packet for communicating via a tunnel. The packet may be associated with a protocol. The device may determine that the packet has been dropped by a security device. The device may selectively encrypt, after determining that the packet has been dropped, the packet using a null encryption for transport layer security (TLS) or a combination of encryption associated with the protocol and TLS encryption to generate an encrypted packet. The device may transmit the encrypted packet for communicating via the tunnel.

Abstract: A first network device sends a request packet to a second network device or a network management device, where the request packet is used to request to confirm whether the second network device has an iFIT capability; and the first network device receives a confirmation packet sent by the second network device or the network management device, where the confirmation packet includes confirmation information used to confirm whether the second network device has the iFIT capability.

Abstract: Examples of scheduled and on-demand volume encryption suspension are described. A management service can identify multi-volume encryption rules for local volumes of a client device including the operating system volume as well as non-operating-system volumes. The encryption rules can be transmitted to the client device. Volume encryption samples for the client device can be received, and a console user interface can be generated to indicate compliance status information for the multi-volume encryption rules for local volumes of a client device.

Abstract: The method provides for dynamic retrieval of certificates, with remote, secure, and scalable lifecycle management. It enables configuring, generating, issuing, and sending client certificates by a certificate broker service to client applications, sending client certificates by client applications to server applications, and verifying of client certificates by server applications for host address, network address, network mash, network scope, and IP address pool-based authorization. It is an agentless method to achieve device protection, application security, and data protection with data authenticity and confidentiality in intra-device, inter-device, device-to-edge, and device-to-cloud secure communications. It helps Transport Layer Security and Internet Key Exchange enabled applications retrieve leaf certificates and the associated private key, and verify certificates, programmatically for certificate-based authentication during protocol handshake, with host and network address-based authorization policies.

Abstract: There is provided an apparatus configured to protect security of communication in roaming scenarios between a first network and a second network, the apparatus being a first apparatus residing in the first network and comprising means for in response to a selection of transport layer security as a security capability mechanism, transmitting, to a second apparatus residing in the second network and configured to protect security of communication in roaming scenarios between the first network and the second network, a request to terminate connections over a forwarding interface between the first apparatus and the second apparatus.

Abstract: A communication system is described. The communication system includes 5g base stations (gNodeB) which are communicatively coupled to a user equipment (UE) by a multiple radio access technology (multi-RAT) dual connectivity. A first of the gNodeBs is a master gNodeB which relays control signaling from a 5G network core to a secondary gNodeB. To avoid spectral interference of the control signals between the master gNodeB and the secondary gNodeB, the control signals are transmitted according to a tactical waveform protocol selected from the Department of Defense (DoD) Communication Waveform Inventory (2020), such as a common data link (CDL) protocol.

Abstract: According to an embodiment, an electronic device may include: a communication module comprising communication circuitry configured to operate in Bluetooth low energy (BLE), a memory, and at least one processor operatively coupled to the communication module and the memory. The at least one processor may be configured to: receive authentication information about each function from an external electronic device via BLE, the authentication information about each function including information about data for the function and information about an access right level of the function, store the received authentication information about each function in the memory, and control the communication module to transmit an authentication index of each function corresponding to the authentication information about the function to the external electronic device by BLE.

Abstract: Approaches for remotely controlling a robotic surgery system located at a patient-side location are disclosed. Disclosed approaches reduce transmission delay and ensure reliable transmission for controlling a robotic surgery system from a remote location, which may be in a different city, state, or country. For surgeons, remote surgery facilitates optimal utilization of their time and provides access to a sufficient volume of patients to perfect their skills. For patients, remote surgery creates ample access to the right surgeon and the right care at an affordable price, decreases the need for travel, and reduces delayed care.

Abstract: A method performed by a security system that can analyze a vulnerability or a risk applicable to a network entity to identify a cybersecurity threat and associated risk level. The security system can store indications of cybersecurity threats and risk levels in a database of a Domain Name System (DNS). The security system can monitor and resolve network traffic to determine IP addresses or URLs associated with the cybersecurity threats. The security system stores a map of the cybersecurity threats and IP addresses or URLs such that the security system can protect a network entity by processing network traffic to sources or destinations of network traffic that can harm particular network entities, and execute personalized security procedures to protect the network entities.

Abstract: A low number of available Internet Protocol (IP) addresses is detected in an IP pool that available for lease from the Dynamic Host Configuration Protocol (DHCP) server. A neighbor table from a gateway device behind a firewall that blocks Internet Control Message Protocol (ICMP) echo requests from the DHCP server. The gateway device is triggered to broadcast an Address Resolution Protocol (ARP) request to network devices of the neighbor table behind the firewall to determine whether a specific IP address is in use. Responsive to an ARP response not being received, the control module releasing a lease for the specific IP thereby returning to the IP pool available for lease in the DHCP server.

Abstract: A computing system and method that can be used for a video conferencing system including a watchdog to ensure that all data associated with the video conference is encrypted from end-to-end. In particular, aspects of the present disclosure provide a secure and private approach to conducting remote meetings. For example, the watchdog can monitor the data associated with the video conference, ranging from call setup data to video image and audio data transmitted from one or more client computing devices. In particular, the present disclosure provides a method for ensuring that the video conference data is protected by using multiple steps and monitoring the video conference data while the video conference is ongoing such that remedial measures can be taken immediately when a breach in security is determined.

Abstract: Techniques are described herein that are capable of using entity name mapping for routing network traffic having encrypted SNI headers. A name resolution request that specifies an entity name is intercepted. Translation of the entity name to a representation of an IP address associated with the entity name is caused. A mapping that cross-references the representation of the IP address to the entity name is stored. A data transfer request that requests establishment of a connection to a destination corresponding to the representation of the IP address is intercepted. The data transfer request includes an encrypted SNI header and a payload. Establishment of the connection to the destination is initiated by providing the encrypted SNI header, the payload, and metadata toward the destination. The metadata includes the entity name based on the mapping.

Abstract: The present technology relates to a reception device, a transmission device, and a data processing method that enable a flexible operation of a service using an application that accompanies content. A reception device includes: a reception unit that receives content; an acquisition unit that acquires an application in accordance with acquisition source information indicating an acquisition source of the application accompanying the content, the acquisition source information being included in control information transmitted together with the content; and a control unit that instantly starts the acquired application. The present technology can be applied to a television set capable of receiving digital broadcasts, for example.

Abstract: The present disclosure proposes method and systems for establishing secure communication session (s) between a first device and a second device, where the first device operates in a user network and implements a first key exchange protocol for secure communication. The second device is capable of communicating with the first device over a wireless communication network. The second device implements a second key exchange protocol that is different to the first key exchange protocol for secure communication. A proxy entity configured for implementing the first and the second key exchange protocols for secure communication is provided. The proxy entity is configured for generating and/or provisioning one or more session keys for the first and the second devices using the key exchange protocols specific to each device for establishing secure communication between the first and second device based on the generated session key(s).

Abstract: Methods, systems, and devices supporting active fingerprinting for transport layer security (TLS) servers are described. In some systems, a client device may transmit a same set of client hello messages to each TLS server. The client device may receive a set of server hello messages in response to the standard set of client hello messages based on the contents of each client hello message. For example, a server hello message may indicate a selected cipher suite, TLS protocol version, and set of extensions in response to the specific information included in a client hello message. The client device may generate a hash value (e.g., a fuzzy hash) based on the set of server hello messages received from a TLS server. By comparing the hash values generated for different TLS servers, the client device may determine whether the TLS configurations for the different TLS servers are the same or different.

Abstract: An example method performed by one or more processing devices includes: generating encrypted content at a sender device using one or more first keys that are available from a key provider; and outputting the encrypted content to a recipient device over one or more channels; where the key provider enables access, following authorization, by the recipient device to one or more second keys for decrypting the encrypted content; and where an entity that enables the channel is unaffiliated with the key provider.

Abstract: The method provides for dynamic retrieval of certificates, with remote, secure, and scalable lifecycle management. It enables importing, creating, renewing, rekeying, and retrieving leaf certificates and associated private keys, assigning to registered devices, and acquiring by applications executing on registered devices with device two-factor authentication. It is an agentless method to achieve device protection, application security, and data protection with data authenticity and confidentiality in intra-device, inter-device, device-to-edge, and device-to-cloud secure communications. It helps Transport Layer Security and Internet Key Exchange enabled applications retrieve leaf certificates and the associated private key, and verify certificates, programmatically for certificate-based authentication during protocol handshake, with policy-based authorization of trusted applications.

Abstract: A system and method for self-adjusting cybersecurity analysis and score generation, wherein a reconnaissance engine gathers data about a client's computer network from the client, from devices and systems on the client's network, and from the Internet regarding various aspects of cybersecurity. Each of these aspects is evaluated independently, weighted, and cross-referenced to generate a cybersecurity score by aggregating individual vulnerability and risk factors together to provide a comprehensive characterization of cybersecurity risk using a transparent and traceable methodology. The scoring system itself can be used as a state machine with the cybersecurity score acting as a feedback mechanism, in which a cybersecurity score can be set at a level appropriate for a given organization, and data from clients or groups of clients with more extensive reporting can be used to supplement data for clients or groups of clients with less extensive reporting to enhance cybersecurity analysis and scoring.

Abstract: A system and method for self-adjusting cybersecurity analysis and score generation, wherein a reconnaissance engine gathers data about a client's computer network from the client, from devices and systems on the client's network, and from the Internet regarding various aspects of cybersecurity. Each of these aspects is evaluated independently, weighted, and cross-referenced to generate a cybersecurity score by aggregating individual vulnerability and risk factors together to provide a comprehensive characterization of cybersecurity risk using a transparent and traceable methodology. The scoring system itself can be used as a state machine with the cybersecurity score acting as a feedback mechanism, in which a cybersecurity score can be set at a level appropriate for a given organization, and data from clients or groups of clients with more extensive reporting can be used to supplement data for clients or groups of clients with less extensive reporting to enhance cybersecurity analysis and scoring.

Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media for containment of sensitive data within a communication platform. The system displays a communication interface including a first input section for receiving an input message associated with a sending user account, and a display section for displaying message information received by the sending user account from other user accounts. The system determines a requirement to input sensitive information. The system then displays a sensitive data user interface including second input section for receiving a sensitive message, and an interface control for setting an expiration time value for the sensitive message.

Abstract: Context information of a handshake between a source entity and a target entity is obtained at a security proxy. The context information is transmitted from the security proxy to a key manager. The key manager maintains a first private key of the security proxy. A first handshake message is received from the key manager. The first handshake message is generated at least based on the context information and signed with the first private key. The first handshake message is then transmitted to the target entity.

Abstract: An apparatus includes an input interface to receive incoming packets from a first network device and an output interface to send outgoing packets to a second network device. Media access control security (MACsec) circuitry is coupled between the input interface and the output interface. Bypass flow-control (FC) circuitry is coupled between the input interface and the MACsec circuitry. The bypass FC circuitry is to detect an FC packet in the incoming packets and pass the FC packet passively to the output interface to enable end-to-end flow control directly between the first network device and the second network device.

Abstract: In an aspect, an integrated tamper resistant device generates initial network credentials for accessing a network, wherein the initial network credentials enable the integrated tamper resistant device to be authenticated by a network solution provider before operational network credentials are provided securely by the network solution provider. The integrated tamper resistant device encrypts the initial network credentials and cryptographically signs the encrypted initial network credentials. The integrated tamper resistant device outputs the encrypted and signed initial network credentials for delivery to the network solution provider.

Abstract: Techniques and mechanisms for using passively collected network data to automatically generate a fingerprint prevalence database without the need for endpoint ground truth. The process first clusters all observations with the same fingerprint string and similar source and destination context. The process then annotates each cluster with descriptive information and uses a rule-based system to derive an informative name from that descriptive information, e.g., “winnt amp client” or “cross-platform browser”. Optionally, the learned database may be augmented by a user to clarify custom process labels. Additionally, the generated database may be used to report the inferred processes in the same way as databases generated with endpoint ground truth.

Abstract: An apparatus for providing secure communications may include a processor; memory in electronic communication with the processor; an output in electronic communication with the processor; and instructions stored in the memory and executable by the processor to cause the apparatus to store a plurality of encryption protocols; store at least one encryption hopping protocol; select at least one encryption hopping protocol; encrypt the data according to the selected encryption hopping protocol; and transmit data from the output utilizing the selected encryption hopping protocol.

Abstract: This disclosure provides for a network element (in the middle) to inject enrichments into SSL connections, and for taking them out. This network element is sometimes referred to herein as a “middle box.” In the context of layered software architecture, this solution preferably is implemented by a library that operates below the SSL layer and above the TCP sockets layer at the two endpoints of the SSL connection. Preferably, the SSL enrichments are implemented as SSL/TLS records.

Abstract: According to an example aspect of the present invention, there is provided a method comprising: generating a certificate comprising an identifier of a base station, a public key of the base station, and a public key of a terminal; signing the certificate by a signature based on a private key belonging to the public key of the base station; sending the signed certificate to the terminal using an established security association; monitoring whether the base station receives a request for local authentication of the terminal, wherein the request comprises an encrypted certificate unit and a base station identifier; checking whether the base station identifier is the identifier of the base station and, if it is, decrypting the encrypted certificate unit using the private key; and using the public key of the terminal for a communication with the terminal if the certificate unit comprises the signed certificate.

Abstract: Methods, systems, and devices provide control over resources electronically communicated among computing devices. In some embodiments, a management application identifies multiple entities for communicating electronic content. The management application determines that at least a subset of the entities required for communicating the electronic content is available for electronic communication. The management application authorizes communication of at least some of the electronic content among the entities in response to determining that the required subset of entities is available for electronic communication.

Abstract: Some methods in a wireless communication network may include providing a first authentication key, and deriving a second authentication key based on the first authentication key, with the second authentication key being associated with the wireless terminal. Responsive to deriving the second authentication key, a key response message may be transmitted including the second authentication key and/or an EAP-Finish/Re-auth message. Some other methods in a wireless communication network may include receiving a key response message including a core network mobility management authentication key and an EAP-Finish/Re-auth message. Responsive to receiving the key response message, the network may initiate transmission of an EAP-Finish/Re-auth message and/or a freshness parameter used to derive the core network mobility management authentication key from the wireless communication network to the wireless terminal responsive to the key response message. Related wireless terminal methods are also discussed.

Abstract: This disclosure provides systems, methods, and apparatuses for wireless communication performed by a wireless communication device. An example wireless communication device includes an access point (AP) multi-link device (MLD). The AP MLD transmits a beacon frame to a wireless station (STA) MLD, the beacon frame including a plurality of AP medium access control (MAC) addresses of respective APs belonging to the AP MLD. The AP MLD receives an association request from the STA MLD, the association request including a plurality of STA MAC addresses of respective STAs belonging to the STA MLD. The AP MLD generates, during a handshake operation with the STA MLD, one or more encryption keys configured to encrypt communications between the AP MLD and the STA MLD. The AP MLD verifies the plurality of STA MAC addresses based at least in part on the one or more encryption keys.

Abstract: Methods and apparatus for securely storing, using and/or updating credential information, e.g., passwords and user IDs for a user who subscribes to one or more services, e.g., video stream services or other services available through a communications network such as the Internet, are described.

Abstract: Techniques for providing privacy features in communication systems are provided. For example, a message may be provided from user equipment to an element or function in a communication network that comprises one or more privacy indicators, where privacy features for processing the message are determined based on the privacy indicators. The message may comprise an attach request comprising a subscription identifier for a subscriber associated with the user equipment, with the privacy indicators comprising a flag indicating whether the subscription identifier in the attach request is privacy-protected. As another example, the element of function in the communication network may determine privacy features supported by the communication network and generate and send a message to user equipment comprising one or more privacy indicators selected based on the determined privacy features.

Abstract: A network connection between a server group of a data intake and query system and each of one or more source network nodes is established. Source data at the server group is received from at least one of the one or more source network nodes via the respective network connections and transformed, by the indexer server, to timestamped data entries of machine data. A model management server detects data constraints for a security model that include a data element used by the security model and an availability requirement set. Using the timestamped data entries, the data constraints are validated, and the validation used to determine a data availability assessment of the security model.

Abstract: A method for network selection on a user equipment (UE) device and the UE device are shown. The user equipment device registers on a first network in a wide area cellular network (WACN) band and receives, from a wireless local area network (WLAN), a list of WACNs that support generic access network (GAN) capabilities. The user equipment device selects the WLAN if the first network is on the list.

Abstract: A method of establishing a secure communication channel between a first communication device and a second communication device. The secure communication channel is defined by one or more algorithm options and the one or more algorithm options are associated with one of one or more option categories. The method includes receiving a signal representing one or more selections. The method further includes, for the respective option categories, generating a sorted list of algorithm options based on the received selections and generating a security association proposal including one or more of the algorithm options from the respective sorted lists of algorithm options. The security association proposal is generated based on an order in the sorted list of algorithm options. The method further includes transmitting the security association proposal to the second communication device for establishing the secure communication channel.

Abstract: The present application describes a method, system, and non-transitory computer-readable medium for exchanging encrypted communications using hybrid encryption. According to the present disclosure, a first device receives an encrypted communication from a second device. The encrypted communication includes a first encrypted secret, a second encrypted secret, a first signature, and a second signature. The first device verifies the first signature and the second signature, and, when the first and second signatures are valid, decrypts the first encrypted secret using a first encryption algorithm and the second encrypted secret using a second encryption algorithm. The first device combines the first decrypted secret and the second decrypted secret to recover a first communication and provides the first communication to a user of the first device.

Abstract: A method of authenticating an identity document based on an extraction, by analysis of an image acquired of the identity document, of candidate information representative of the appearance of a photograph such as depicted in the acquired image and optically readable data as depicted in the acquired image.

Abstract: A method for identifying malicious encrypted network traffic associated with a malware software component communicating via a network, the method including, for the malware, a portion of network traffic including a plurality of contiguous bytes occurring at a predefined offset in a network communication of the malware; extracting the defined portion of network traffic for each of a plurality of disparate encrypted network connections for the malware; training an autoencoder based on each extracted portion of network traffic, wherein the autoencoder includes: a set of input units each for representing information from a byte of an extracted portion; output units each for storing an output of the autoencoder; and a set of hidden units smaller in number than the set of input units and each interconnecting all input and all output units with weighted interconnections, such that the autoencoder is trainable to provide an approximated reconstruction of values of the input units at the output units; selecting a set

Abstract: An identity server authenticates a first user identity for a user device through a first authentication exchange as part of a passwordless authentication system. The identity server registers with a relying party as an authenticator for a second user identity. The identity server initiates a second authentication exchange by obtaining from the relying party, a credential request associated with the second user identity. Responsive to a determination that the first user identity authenticated in the first authentication exchange is authorized to act as the second user identity, the identity server obtains a credential request response authenticated by the authenticator in the identity server. The identity server completes the second authentication exchange by providing the credential response to the relying party. The second authentication exchange authenticates the user device to the relying party without involving the user device.

Abstract: In an authentication system (120) of an organization that is another organization different from a first organization that a first user belongs to, a management device (200) accepts a registration transaction for a client certificate of the first user. Then, the management device registers the client certificate of the first user in a client certificate blockchain. When the first user accesses a service of another organization from a user terminal of the first organization, an authentication device (300) authenticates the first user using the client certificate of the first user in the client certificate blockchain.

Abstract: A service routing packet processing method, apparatus and system. The method includes obtaining, by a first service router (SR), a first service routing packet, where the first service routing packet includes path identification information and identification information of a service node (SN), and sending, by the first SR, the first service routing packet to the SN.

Abstract: In some examples, a system includes a router device and a first adapter device in communication with the router device. The first adapter device includes processing circuitry configured to: communicate with the router device, wherein the router device is incapable of communicating in accordance with the MACsec protocol. The processing circuitry is further configured to establish an encrypted connection in accordance with the MACsec protocol between the first adapter device and a remote device, determine that the encrypted connection is offline, and output a message to the router device that the encrypted connection is offline. The router device is configured to communicate with the remote device via a second adapter device configured to communicate in accordance with the MACsec protocol and bypass the first adapter device.

Abstract: A system and method for notifying client devices in a subscriber account that the account is undersubscribed and no further client devices can stream media content until other client devices are no longer actively streaming media content is disclosed herein. The method comprises receiving a request to receive and play the media content from a requesting client device, the requesting client device being one of a plurality of client devices enabled to receive media content according to a subscriber account and determining if the subscriber account is undersubscribed; if the subscriber account is not undersubscribed. If the subscriber account is not undersubscribed, initiating transmission of the media content, and if the subscriber account is undersubscribed, information is transmitted to the requesting client device, the information including data indicating the subscriber account is undersubscribed without initiating the transmission of the media content.

Abstract: A method for dynamically establishing a communication path for a requestor by assessing an authenticity of the requestor and a communication request is provided. The method may include, in response to receiving the communication request, dynamically determining whether to establish a communication path for the requestor to a destination though a communication network by assessing the requestor based on one or more authentication rules, wherein the one or more authentication rules are based on first information associated the communication network, second information about the requestor, and third information from the requestor. The method may further include, in response to determining that the requestor satisfies the one or more authentication rules, dynamically establishing the communication path for the requestor on the communication network according to one or more communication attributes associated with the requestor.