Security can be provided for data stored using resources that are deployed in an environment managed by a third party. Physical and logical detection mechanisms can be used to monitor various security aspects, and the resulting security data can be used to identify potential threats to these resources. In some embodiments, suspicious activity can cause resources such as data servers to be automatically and remotely rebooted such that keys stored in volatile memory on those data servers will be lost from those servers, such that an attacker will be unable to decrypt data stored on those servers. Once a determination of safety is made, the keys can be provided to the respective data servers such that data operations can resume.

According to one embodiment, a system receives, at a host channel manager (HCM) of a host system, a request from an application to establish a secure channel with a data processing (DP) accelerator, where the DP accelerator is coupled to the host system over a bus. In response to the request, the system generates a first session key for the secure channel based on a first private key of a first key pair associated with the HCM and a second public key of a second key pair associated with the DP accelerator. In response to a first data associated with the application to be sent to the DP accelerator, the system encrypts the first data using the first session key. The system then transmits the encrypted first data to the DP accelerator via the secure channel over the bus.

A vehicle control apparatus and a control method thereof are provided. A vehicle control apparatus includes a processor including a host core and a hardware security module (HSM) core. The processor generates a first private key and a first public key, receives a second public key from a diagnostic device, generates a shared key based on the first private key and the second public key, receives a security data transmission request from the diagnostic device, and encodes data based on the shared key and transmits the encoded data to the diagnostic device.

Systems and methods for encrypted storage device telemetry data are described. Storage device telemetry data may be collected for a telemetry message, such as a non-volatile memory express (NVMe) telemetry command, and encrypted using a first encryption key. The first encryption key may be encrypted using one or multiple second encryption keys and the encrypted first encryption key may be added to the telemetry message. A client system may receive the telemetry message, decrypt the encrypted first encryption key, and use the first encryption key to decrypt the encrypted storage device telemetry data.

Methods and systems for automating execution of a workflow by integrating security applications of a distributed system into the workflow are provided. In embodiments, a system includes an application server in a first cloud, configured to receive a trigger to execute the workflow. The workflow includes tasks to be executed in a device of a second cloud. The application server sends a request to process the task to a task queue module. The task queue module places the task request in a queue, and a worker hosted in the device of the second cloud retrieves the task request from the queue and processes the task request by invoking a plugin. The plugin interacts with a security application of the device of the second cloud to execute the task, which yields task results. The task results are provided to the application server, via the worker and the task queue module.

There is provided a system and method for controlling a plurality of endpoint devices. Multiple connection requests, each connection request originating from an endpoint device are received by a server. Each endpoint device has a client interface thereat that generates the connection request as an outbound connection request from the endpoint device to the server computer. A persistent data communication session is established between the server computer and the client interface of each endpoint device. Command data is received to control one or more of the endpoint devices. The server computer generates a data packet including the command data and transmits the data packet via the persistent data communication session to the endpoint device, to enable the endpoint device instructions to be carried out by the endpoint device, and result data is then received by the server once the instructions are carried out.

Methods and systems are provided for supporting efficient and secure “Machine-to-Machine” (M2M) communications using a module, a server, and an application. A module can communicate with the server by accessing the Internet, and the module can include a sensor and/or an actuator. The module, server, and application can utilize public key infrastructure (PKI) such as public keys and private keys. The module can internally derive pairs of private/public keys using cryptographic algorithms and a first set of parameters. A server can authenticate the submission of derived public keys and an associated module identity. The server can use a first server private key and a second set of parameters to (i) send module data to the application and (ii) receive module instructions from the application. The server can use a second server private key and the first set of parameters to communicate with the module.

Systems and methods for providing data privacy in a private distributed ledger are disclosed. According to another embodiment a distributed ledger network may include a first node comprising a first node computer processor and hosting a central ledger comprising a plurality of entries for public transactions and private transactions, wherein the entries for public transactions comprise transaction payloads for the respective public transaction, and the entries for private transactions comprise a cryptographic hash digest of a transaction payload for the respective private transaction; and a plurality of second nodes each comprising a second node computer processor and hosting a public database comprising the public transactions, and a private database comprising transaction payloads for the private transactions to which the node is a party.

A method for the cryptographically protected unidirectional data transmission of payload data, wherein one or more data packets includes the payload data are transmitted on an end-to-end data transmission link from a first communication unit in a first network via a one-way communication unit, which is arranged between the first network and a second network, to a second communication unit in the second network, is provided.

Technologies for managing network traffic through heterogeneous fog network segments of a fog network include a fog node deployed in a fog network segment. The fog node is configured to receive a fog frame that includes control instructions. The fog node is further configured to perform a route selection action to identify a preferred target fog node based on the control instructions, perform action(s) based on the control instructions and network characteristic(s) of the fog network segment relative to corresponding network characteristic(s) of the different fog network segment, and generate updated control instructions based on at least one network characteristic of the different fog network segment. Additionally, the fog node is configured to replace the original control instructions of the received fog frame with the updated control instructions and transmit the received fog frame with the updated control instructions to the preferred target fog node. Other embodiments are described and claimed.