Abstract: A cryptographic anonymization method, apparatus, and system are disclosed. An example apparatus includes a server configured to receive encrypted usage information and an identifier from an application operating on a user terminal and trans-cypher the encrypted usage information from a first encryption scheme to a second encryption scheme to create second encrypted usage information without decrypting the encrypted usage information. The server is also configured to convert and encrypt the identifier to an encrypted unique identifier. The server is further configured to compare the second encrypted usage information to a taxonomy of data labels using rules. For each match of at least some of the second encrypted usage information to a data label, the server is configured to add the encrypted unique identifier to the matching data label. The server uses the data labels and/or the encrypted unique identifier for serving advertisements to the user.

Abstract: This disclosure describes techniques for authentication related to verification of identity for network access. The techniques may include sending a challenge associated with authentication to a network to a mobile device. In response to sending the challenge, the techniques may include receiving a challenge response from the mobile device. The challenge response may include biometric credential information associated with a user of the mobile device. The challenge response may also include an indication of an authorization assertion associated with the authentication to the network. In some examples, the techniques may include tailoring access to the network for the mobile device based on the biometric credential information.

Abstract: Systems and methods for ensuring that data received from a virtual device is random are provided. A processing device may be used to generate, by a virtual device executing on a hypervisor, data intended for a virtual machine (VM) having a guest memory that includes one or more encrypted pages and one or more unencrypted pages. Data written to an encrypted page of the guest memory by the VM is encrypted using an encryption key assigned to the VM and information read from the encrypted page by the VM is decrypted using the encryption key. The hypervisor may write the data to the encrypted page, wherein the data is not encrypted by the encryption key assigned to the VM because it is written by the hypervisor. The VM reads the data from the encrypted page as randomized data because it cannot be properly decrypted by the encryption key.

Abstract: A method includes receiving a request to migrate a virtual machine executing on a source host computer system to a first destination host computer system. The method further includes receiving, from the virtual machine executing on the source host computer system, an encryption key specific to the virtual machine. One or more memory pages associated with the virtual machine are encrypted using the encryption key specific to the virtual machine. The method further includes causing the one or more memory pages associated with the virtual machine to be copied to the first destination host computer system.

Abstract: An integrated circuit for digital signal routing. Signal routing is achieved with a multiply-accumulate block, which takes data from one or more data sources and, after any required scaling, generates output data for a data destination. Data from a data source is buffered for an entire period of a data sample clock so that the multiply-accumulate block can retrieve the data at any point in the period, and output data of the multiply-accumulate block is buffered for an entire period of the data sample clock so that the data destination can retrieve the data at any point in the period. The multiply-accumulate block operates on a time division multiplexed basis, so that multiple signal paths can be processed within one period of the sample clock.

Abstract: A security processor includes a key generator circuit configured to randomly generate a key, an encryption circuit configured to encrypt user data based on the key, and a security manager circuit configured to receive a first user identification (ID), which uniquely corresponds to a user of a device, and determine whether to allow access to the user data by authenticating the first user ID.

Abstract: The present disclosure describes techniques of encryption and decryption. The described techniques comprise obtaining a digital code to be encrypted; obtaining at least one predetermined rule; generating an encrypted digital code by rearranging and reorganizing bits comprised in the digital code to be encrypted based on the at least one predetermined rule; and delivering the encrypted digital code to a client computing device.

Abstract: An encrypted data storage system and method based on offsite key storage are provided, comprising the system includes a key control center, an offsite key storage system, and a data encryption/decryption storage system. The offsite key storage system includes a first key control device, a key storage device, and a first quantum key distribution device. The data encryption/decryption storage system includes a second key control device, a data encryption/decryption storage device, and a second quantum key distribution device. The first quantum key distribution device is in quantum communication connection with the second quantum key distribution device. The first key control device is communicatively connected with the key storage device and the first quantum key distribution device, respectively.

Abstract: A method for verifying licenses is performed by a legacy management controller (LMC) and a non-legacy management controller (NLMC). The method includes obtaining, by the LMC, a first license installation request and a license, wherein the license comprises license data and a plurality of signatures; in response to the first license installation request: making a first determination, by the LMC, that a first signature of the plurality of signatures is valid; in response to the first determination: installing, by the LMC, the license on the LMC; obtaining, by the NLMC, a second license installation request and the license; in response to the second license installation request: making a second determination, by the NLMC, that a second signature of the plurality of signatures is valid; and in response to the second determination: installing, by the NLMC, the license on the NLMC.

Abstract: Described embodiments provide systems and methods for selecting one or more firewall rules to apply to a server based at least on identifying a service of the server. A device intermediary to a plurality of clients and a serve may identify a pattern of a firewall to apply to a response from the server to a request from a client of the plurality of clients. The pattern may be to identify a service configured on the server. The device may determine that the response from the server matches the pattern. The device may identify, responsive to the response matching the pattern, that the service is configured on the server. The device may select, based at least on the service, one or more rules for the firewall to apply to responses from the server.

Abstract: Methods, apparatus, systems and articles of manufacture are disclosed for audio equalization. Example instructions disclosed herein cause one or more processors to at least: detect an irregularity in a frequency representation of an audio signal in response to a change in volume between a set of frequency values exceeding a threshold; and adjust a volume at a first frequency value of the set of frequency values to reduce the irregularity.

Abstract: Systems, computer program products, and methods are described herein for implementing enhanced file encryption technique. The present invention is configured to receive a request from a computing device of a user to encrypt a file; encrypt the file using a local file encryption key to generate an encrypted file; transmit, via an encryption engine, a first encryption request to an encryption server to encrypt a first portion of the encrypted file; receive, from the encryption server, an encrypted first portion of the encrypted file based on at least the first encryption request, wherein the first portion of the encrypted file is encrypted by the encryption server using a first file encryption key; append the encrypted first portion of the encryption file with a remaining portion of the encrypted file to generate a final encrypted file; and store the final encrypted file in a data repository.

Abstract: Disclosed herein is a data storage device comprising a data path and an access controller. The access controller generates a recovery private key, generates encrypted authorization data based on the recovery private key, stores the encrypted authorization data, and sends the recovery private key to a manager device. When recovery is desired, access controller receives a recovery public key, calculated based on the recovery private key, from a recovery manager device, decrypts the encrypted authorization data based on the recovery public key, generates a challenge for the recovery manager device based on the decrypted authorization data, sends the challenge to the recovery manager device over the communication channel that is different from the data path, receives a response to the challenge from the recovery manager device over the communication channel, and based at least partly on the response, enables decryption of the encrypted user content data.

Abstract: Computerized methods and systems identify malware enabled by automatically generated domain names. An agent executes a malware, in a controlled environment, at a first temporal input value and a second temporal input value. A first set of domain names is generated in response to the execution at the first temporal input value. A second set of domain names is generated in response to the execution at the second temporal input value. The agent compares the first set of domain names with the second set of domain names to produce a comparison output metric.

Abstract: A privacy protecting transaction engine for a cloud provider network is described. According to some embodiments, a computer-implemented method includes receiving a request from a customer of a cloud provider network to create a customer cloud in the cloud provider network, generating the customer cloud in the cloud provider network, receiving a first request at the cloud provider network for the customer cloud that includes private information of an end customer of the customer of the cloud provider network, removing the private information from the first request by a privacy protecting transaction engine of the cloud provider network to generate a second request, and sending the second request to the customer cloud for servicing.

Abstract: An information handling system includes a general storage for storing application data of applications hosted by the information handling system. The information handling system also includes a management storage for storing management data used to manage operation of the information handling system. The information handling system further includes a management storage manager that obtains data for storage in the management storage; encrypts the data to obtain encrypted data and authentication data for the encrypted data; generates error correction code data for the encrypted data and the authentication data; and stores, as a new record, the encrypted data, the authentication data, and the error correction code data in the management storage.

Abstract: Devices and techniques are generally described for an edge computing system. In various examples, a first application executed by a first virtual machine may generate a configuration file specifying a first machine learning task and first data. The first virtual machine may send the configuration file to a second virtual machine. The second virtual machine may generate first data effective to cause the first machine learning task to be executed by a third virtual machine. In various examples, the second virtual machine may retrieve the first data. In at least some examples, the second virtual machine may send the first data and the second data to a third virtual machine configured with access to a graphical processing unit.

Abstract: Example selector derived encryption methods and systems include creating a hashed and encrypted database, as well as performing a query against the hashed and encrypted database using an encrypted selector exchange protocol to prevent the exposure of extraneous data from the hashed and encrypted database.

Abstract: A gateway device is connected via one or more networks to electronic controllers on-board a vehicle. The gateway device includes one or more memories, and circuitry that acquires firmware update information. The circuitry determines whether or not a first electronic controller satisfies a second condition based on second information about the first electronic controller, where the second information is whether the first electronic controller includes a firmware cache for performing a pre-update firmware cache operation. The circuitry also causes, when the second condition is not satisfied, the gateway device to execute a proxy process, where the gateway device requests the first electronic controller to transmit boot ROM data to the gateway device, creates updated boot ROM data with the updated firmware, and transmits the updated boot ROM data to the first electronic controller that updates the boot ROM and resets the first electronic controller with the updated firmware.

Abstract: Methods and systems for managing and/or processing a blockchain to maintain data security for confidential and/or personal data are provided. According to certain aspects, the disclosed data security techniques may enable access sharing functionality utilizing the blockchain. For example, access sharing may be utilized to share policy information. The policy information may be associated with a smart contract. Accordingly, the policy information may be encrypted using a public key for the smart contract and compiled into a block of the blockchain. In response to a request to provide access to the information to a particular node, the private key for the smart contract may be encrypted using the public key for the particular node and compiled into a block of the blockchain.

Abstract: Systems and methods are provided for reordering and/or bypassing certain informational content or menus that are conventionally presented prior to playback of media content stored on physical media discs. Upon initial use of a physical media disc, certain information content or menus may be presented to a user or viewer, for example, piracy warnings, language selection menus, etc. However, upon subsequent use of the physical media disc, such informational content or menus may be bypassed. The user or viewer is given an option to immediately begin consuming the media content stored on the physical media disc. Conventional content, such as trailers are not played prior to playback of the media content.

Abstract: A method and associated system for matching and delivering digital work metadata to one or more digital service providers, including modifying one or more digital work metadata files to remove non-critical data or segment erroneous data from the one or more digital work metadata files; reformatting the one or more digital work metadata files for compatibility with a digital service provider usage report table; performing a first matching operation, in which the one or more digital work metadata files are compared to the digital service provider usage report table on the basis of one or more data points; performing a second matching operation, the second matching operation being an artificial intelligence (AI) matching operation on one or more unmatched digital work metadata files of the one or more digital work metadata files; and transmitting output data from the matching operations to the one or more digital service providers.

Abstract: An integrated circuit (IC) includes: a storage having a storage interface and addressable bytes, the storage interface coupled to first and second sets of peripheral terminals; control circuitry having control circuitry inputs and control circuitry outputs, the control circuitry inputs coupled to the storage interface and configured to receive configuration bits provided by the storage responsive to a control circuitry update trigger, and the control circuitry outputs coupled to first and second sets of peripheral outputs; and a cyclic-redundancy check (CRC) engine coupled to the storage interface, the CRC engine configured to distinguish between purposeful updates to the data in the storage and bit errors in the data in the storage.

Abstract: A system and method for the storage within one or more virtual execution context registers private code representative of processes or other information requiring an enhanced degree of security. The storage of the private code can be performed as a function of the type of code or in response to one or more markers embedded within the code. The time-variant nature of the virtual execution context registers affords a high degree of inherent security for the private code data stored within.

Abstract: Described herein are a secure system for sharing private data and related systems and methods for incentivizing and validating private data sharing. In some embodiments, private data providers may register to selectively share private data under controlled sharing conditions. The private data may be cryptographically secured using encryption information corresponding to one or more secure execution environments. To demonstrate to the private data providers that the secure execution environment is secure and trustworthy, attestations demonstrating the security of the secure execution environment may be stored in a distributed ledger (e.g., a public blockchain). Private data users that want access to shared private data may publish applications for operating on the private data to a secure execution environment and publish, in a distributed ledger, an indication that the application is available to receive private data.

Abstract: An anti-theft protection disablement solution is provided to authorized users and authorized customer service representatives. An anti-theft protection disablement request message from a recovery application on a user device may be received via a cloud messaging service or a binary messaging service. In turn, an anti-theft protection disablement message may be transmitted to the user device via the cloud messaging service or the binary messaging service when the anti-theft protection disablement request message is authenticated. The anti-theft protection disablement message may disable an anti-theft protection function on the user device that calls for an input of an anti-theft protection authentication credential for a factory reset of the user device.

Abstract: A method for communicating between a client application and a license-governing application. The method includes receiving a request at a content application from the client application to access media content from the license-governing application, generating a message at the content application to the license-governing application to request client authentication, and receiving at the content application a client authorization token from the license-governing application. A message is generated at the content application to the client application to request user authentication, and the content application receives an authorization code from the client application.

Abstract: Techniques and mechanisms are disclosed for creating an environment for detecting malicious network traffic. A test computer network including a plurality of cloned nodes is created. The plurality of cloned nodes in the test computer network corresponds to at least some of a plurality of target nodes of a host computer network, and the test computer network has no network connectivity to the host computer network. Sensors in both the host computer network and the test computer network generate network flow records that are sent to a detection processing pipeline. The detection processing pipeline merges the records received from the sensors and uses the merged records to train at least one model used to identify instances of malicious network traffic.

Abstract: A data loss prevention device that includes a data loss prevention engine implemented by a processor. The data loss prevention engine is configured to receive data in transit to a target network device and to identify content within the data. The data loss prevention engine is configured to determine the content of the data comprises an image and to determine an image type for the image based on objects within the image, and to determine whether the image type matches a restricted image type from a set of restricted image types. The data loss prevention engine is further configured to block transmission of the data to the target network device in response to determining that the image type matches a restricted image type and forward the data to the target network device in response to determining that the image type does not match a restricted image type.

Abstract: A method for encrypting database files includes generating a mapping for a plurality of encrypted files. A first encrypted file of the plurality of encrypted files is encrypted with a first encryption key. The method includes generating a second encrypted file by re-encrypting, for a period of time, data in the first encrypted file using a second encryption key. The first encrypted file remains accessible to one or more queries during the period of time. The method includes updating the mapping to associate the second encrypted file with the first encrypted file. The mapping is updated after the second encrypted file has been generated. The method includes preventing a query from accessing the first encrypted file after the second encrypted file has been generated.

Abstract: A system white box device utilized in conjunction with an intelligent terminal is provided. The system white box device includes a controller, a memory, and an SIM unit. The controller provides support for management of the memory and call of the SIM unit. The memory provides a physical medium for storing data and an application of the intelligent terminal. The SIM unit provides security support for operation of the application and the system of the intelligent terminal.

Abstract: An electronic apparatus includes a communication interface, a memory; and a processor. The memory is configured to store a hypervisor. The processor is configured to obtain an authentication key for performing authentication of an external device. The processor is also configured to encrypt the authentication key based on a key pre-stored in the memory using the hypervisor and store the encrypted authentication key in the memory. Based on a request for information that is stored in the memory being received from the external device, the processor is configured to perform authentication of the external device using the hypervisor. Based on the authentication of the external device being completed, the processor is configured to control the communication interface to transmit the stored information to the external device.

Abstract: An application white box device utilized in conjunction with an intelligent terminal is provided. The application white box device includes a controller, a memory, and a SIM unit. The controller provides support for management of the memory and call of the SIM unit. The memory provides a physical medium for storing data and an application of the intelligent terminal. The SIM unit provides support for encryption and security authentication of the data and the application access of the intelligent terminal.

Abstract: A system and related methods for allowing a player or user to load personalized or player-created content (such as graphics, sounds, and the like) into a game on a machine specifically for gaming, including, but not limited to, gambling or casino gaming. The player creates and uploads content to a remote content server, which reviews the content for acceptability, quality, and other standards, converts and scales the content to appropriate file types or standards, and stores it for later use. The player, when accessing a compatible machine, can request that the player-created content be downloaded into or otherwise available to the machine, where it replaces some or all of the standard content for a particular game.

Abstract: The disclosed exemplary embodiments include computer-implemented apparatuses and methods that validate confidential data based privacy-preserving homomorphic computations involving encrypted data. For example, an apparatus may receive, from a first computing system, encrypted data that includes a first encrypted value representative of at least one of first account data or an element of cryptographic data. Based on the first encrypted value and on second encrypted values, the apparatus may generate encrypted residual values representative of second account data associated with one or more reference accounts, and the apparatus may request and receive a decrypted residual value associated with each of the encrypted residual values from a second computing system. The apparatus may transmit the decrypted residual values to the first computing system, which may validate the first account data based on at least the decrypted residual values and perform operations associated with the validated first account data.

Abstract: A data storage device restoring method is provided, which is adapted to a data storage device. The data storage device includes an SSD controller, a power management circuit, a non-volatile memory, and a reset circuit. The data storage device restoring method includes: the power management circuit determines whether a normal signal from the SSD controller is received within a predetermined time; if not, the power management circuit resupplies power to the data storage device but stops supplying power to the non-volatile memory, thereby the SSD controller stays in a read-only memory mode to automatically execute the data storage device restoring process.

Abstract: A system for detecting and mitigating forged authentication object attacks is provided, comprising an authentication object inspector configured to observe a new authentication object generated by an identity provider, and retrieve the new authentication object; and a hashing engine configured to retrieve the new authentication object from the authentication object inspector, calculate a cryptographic hash for the new authentication object, and store the cryptographic hash for the new authentication object in a data store; wherein subsequent access requests accompanied by authentication objects are validated by comparing hashes for each authentication object to previous generated hashes.

Abstract: A record linking platform having a computer system with a processor, multiple databases each having records, such as private health information. Each of the multiple databases are not in direct communication with one another. A control center is in communication with the different entities, the control center configured to: generate a site configuration file, a key configuration file, and a broker configuration file. A keymaster configured to: receive the key configuration file, generate a hash key, and transmit the hash key to the databases. The databases configured to: receive the site configuration file and the hash key; process the records to generate evaluation records data that conform to a data model specified in the site configuration file; and encrypt the evaluation records using the hash key. An honest broker configured to: receive the broker configuration file and the encrypted evaluation records; and link the encrypted evaluation records without decrypting.

Abstract: A method and system for characterizing application layer flood denial-of-service (DDoS) attacks are provided. The method includes receiving an indication on an on-going DDoS attack directed to a protected entity; generating a dynamic applicative signature by analyzing requests received during the on-going DDoS attack, wherein the dynamic applicative signature characterizes requests generated by an attack tool executing the on-going DDoS attack; and characterizing each incoming request based on the generated dynamic applicative signature, wherein the characterization provides an indication for each incoming request whether a request is generated by the attack tool.

Abstract: A method for encrypting data in one or more data blocks is provided. The method receives a first data block to be written to a physical storage that includes one or more physical disks. The method applies a first random tweak to data indicative of the first data block to generate a first encrypted data block, and writes the first encrypted data block and the first random tweak to a first physical block of the physical storage. The method receives a second data block to be written to the physical storage. The method then applies a second random tweak, different than the first random tweak, to data indicative of the second data block to generate a second encrypted data block, and writes the second encrypted data block and the second random tweak to a second physical block of the physical storage.

Abstract: Methods and systems for data are disclosed. A system implementation includes a data module for storing data received from an external source. The data module includes a file system for unstructured data, a database for structured data, a transform for operating upon unstructured or structured data, a data broker for receiving data having a first format and providing the data in a second format, a data network for communications within the data module, and a processing module for performing operations upon data. The processing module further includes a process broker and a process container. The process container is for providing one or more instances of processes during a runtime operation. The system further includes an inter-process network for communications within the processing module and an internal gateway for the data module to communicate with the processing module.

Abstract: Systems and methods for malware detection using multiple neural networks are provided. According to one embodiment, for each training sample, a supervised learning process is performed, including: (i) generating multiple code blocks of assembly language instructions by disassembling machine language instructions contained within the training sample; (ii) extracting dynamic features corresponding to each of the code blocks by executing each of the code blocks within a virtual environment; (iii) feeding each code block into a first neural network and the corresponding dynamic features into a second neural network; (iv) updating weights and biases of the neural networks based on whether the training sample was malware or benign; and (v) after processing a predetermined or configurable number of the training samples, the neural networks criticize each other and unify their respective weights and biases by exchanging their respective weights and biases and adjusting their respective weights and biases accordingly.

Abstract: A system for detecting and mitigating attacks using forged authentication objects within a domain is provided, comprising an authentication object inspector configured to observe a new authentication object generated by an identity provider, and retrieve the new authentication object; and a hashing engine configured to retrieve the new authentication object from the authentication object inspector, calculate a cryptographic hash for the new authentication object, and store the cryptographic hash for the new authentication object in a data store; wherein subsequent access requests accompanied by authentication objects are validated by comparing hashes for each authentication object to previous generated hashes.

Abstract: A confidentiality preserving system and method for performing a rank-ordered search and retrieval of contents of a data collection. The system includes at least one computer system including a search and retrieval algorithm using term frequency and/or similar features for rank-ordering selective contents of the data collection, and enabling secure retrieval of the selective contents based on the rank-order. The search and retrieval algorithm includes a baseline algorithm, a partially server oriented algorithm, and/or a fully server oriented algorithm. The partially and/or fully server oriented algorithms use homomorphic and/or order preserving encryption for enabling search capability from a user other than an owner of the contents of the data collection. The confidentiality preserving method includes using term frequency for rank-ordering selective contents of the data collection, and retrieving the selective contents based on the rank-order.

Abstract: A system and methods for mitigating golden ticket attacks within a domain is provided, comprising an authentication object inspector configured to observe a new authentication object generated by an identity provider, and retrieve the new authentication object; and a hashing engine configured to retrieve the new authentication object from the authentication object inspector, calculate a cryptographic hash for the new authentication object, and store the cryptographic hash for the new authentication object in a data store; wherein subsequent access requests accompanied by authentication objects are validated by comparing hashes for each authentication object to previous generated hashes.

Abstract: A technique and system protects documents at rest and in motion using declarative policies and encryption. Encryption in the system is provided transparently and can work in conjunction with policy enforcers installed at a system. A system can protect information or documents from: (i) insider theft; (ii) ensure confidentiality; and (iii) prevent data loss, while enabling collaboration both inside and outside of a company.

Abstract: Embodiments relate to a computer system, computer program product, and method to prevent unauthorized file dissemination and replication. A file parameter is defined, with the defined file parameter including a file dissemination characteristic. The file is encoded with the defined file parameter as file metadata. Dissemination and replication of the file is managed responsive to the encoded file parameter. The defined parameter is assessed along with a physical replication destination. The file is selectively replicated or transmitted responsive to the file parameter and the destination assessment.

Abstract: A compound social network site can manage complex organizational entities, such as businesses, via a compound social network graph. Nodes of the compound social network graph are connected by compound edges which correspond to multiple tiers of profile data of the organizational entities.

Abstract: Methods and systems for controlling access to secure data use a custodial TRNG disk. Source data is encrypted using first key data from a first TRNG disk to generate encrypted data which is stored at a first location by a first entity. A second TRNG disk has second key data which is stored at a second location by a second entity. A first TRNG disk copy and a second TRNG disk copy are made identical to the first TRNG disk and the second TRNG disk, respectively, and are stored at one or more locations by a custodial entity. The first key data and the second key data are encoded together, and then transmitted to one or more of the first or second entities. The first quantity of encrypted data is decryptable using the encoded first key data and the second key data.

Abstract: Described herein are systems and methods for abstracted analysis system design for a dynamic API scanning service. The disclosure provides a simplified API scanning service by abstracting underlining security scanning techniques and configurations. This presents a normalized view to users of the service. Both input parameters and scan output data is abstracted from users, and is driven based on logic in the service. By providing this simplified view, users can quickly, and without prior security scanning knowledge, use this service to measure their security exposure and mitigate as needed.