Abstract: Policy enforcement previously available for web proxy access methods is extended and applied to layer 3 packets flowing through VPN channels. With these extensions, a common security policy is possible that is enforceable between VPN proxied access and VPN tunneled access. Equivalent security policy to tunnel based VPN access without comprising the inherent performance, scalability and application compatibility advantages tunne based VPNs have over their proxy based VPN counterparts.

Abstract: Exemplary embodiments provide adapted components that may be used by a computer program under different execution contexts. The adapted components may include platform independent source code which may be executed regardless of the execution context in which the component is deployed. Adaptation logic may wrap the execution context independent component in a wrapper. The wrapper may perform data marshaling between the execution context independent component and a computer program invoking the execution context independent component, or the host system on which the computer program is deployed. The execution context independent component may be adapted to a new execution context dynamically the first time that the execution context independent component is invoked in the execution context. Thereafter, the execution context independent component may be invoked statically without the need to re-adapt the component.

Abstract: Techniques are described for anonymous peer storage. In one example, techniques include invoking an action of backing up one or more files utilizing distributed storage for a node Ni in a multi-node network; encrypting the one or more files into a combined encrypted file with a private key required to decrypt the combined encrypted file; splitting the combined encrypted file into Pi portions (P1, P2 . . . Pn) and associating a file identifier Fi to each Pi; anonymously distributing the Pi portions and associated identifier Fi to other nodes Nj and Nk wherein each of j and k is different from i; retaining a look up file containing for the each Pi, the (Nj, Nk) pairs, the Fi, and the private key for future retrieval and decryption; and responsive to receiving an anonymous request containing the Fi by one of the Nj and the Nk, returning the Pi.

Abstract: A computer-implemented system and method for secure electronic message exchange including coupling a control platform to a workstation of a plurality of workstations via a communications medium, where the control platform includes one or more apparatuses for monitoring, controlling, conversion, and billing, related to messages exchanged between a plurality of local users and a plurality of remote users. The system prevents forwarding or copying of a message sent by a local user of the plurality of local users and received by a remote user of the plurality of remote users, to another party by the control platform. The system and method also provides for authenticating the remote user with the control platform.

Abstract: From a log of a machine, an entry is selected relating to providing a subservice in processing a service request from a requestor associated with a key. The log entry includes a subsequence of machines used and a cost of providing the subservice. A set of entries is selected from the log, an entry including the subsequence and a second cost of providing the subservice but in processing a different service request from a different requestor associated with a different key. A distance is computed between the cost and the second cost. A number of occurrences of the subsequence with the key is determined. Using the number and the distance for the subsequence, a value pair is computed. Responsive to an aggregate number in the value pair not exceeding a threshold count. The processing of the service request is output as a suspect for using an improper sequence of machines.

Abstract: The subject matter of this specification can be embodied in, among other things, a method that includes receiving, by one or more servers associated with an application marketplace, a policy that includes data that identifies one or more users, and a restricted permission. A request is received, by the servers associated with the application marketplace, to access one or more applications that are distributed through the application marketplace, wherein the request includes data that identifies a particular one of the users. One or more of the applications that are associated with the restricted permission are identified by the servers associated with the application marketplace, and access by the particular user to the applications that are associated with the restricted permission is restricted by the servers associated with the application marketplace.

Abstract: A first collection including a pattern of life (POL) feature vector and a Q&A feature vector is constructed. A second collection is constructed from the first collection by inserting noise in at least one of the vectors. A third collection is constructed by crossing over at least one of vectors of the second collection with a corresponding vector of a fourth collection, migrating at least one of the vectors of the second collection with a corresponding vector of a fifth collection. Using a forecasting configuration, a POL feature vector of the third collection is aged to generate a changed POL feature vector containing POL feature values expected at a future time. The changed POL feature vector is input into a trained neural network to predict a probability of the cyber-attack occurring at the future time.

Abstract: An anonymized biometric representation of a target individual is used in a computer based security system. A detailed input biometric signal associated with a target individual is obtained. A weakened biometric representation of the detailed biometric signal is constructed such that the weakened biometric representation is designed to identify a plurality of individuals including the target individual. The target individual is enrolled in a data store associated with the computer based security system wherein the weakened biometric representation is included in a record for the target individual. In another aspect of the invention, a detailed input biometric signal from a screening candidate individual is obtained. The detailed biometric signal of the screening candidate is matched against the weakened biometric representation included in the record for the target individual.

Abstract: A method of managing access to a physical mailing address using a virtual mailing address is presented. The method includes: setting up a proxy system as a server, assigning, by a server, a virtual mailing address identifier to natural or juristic person that registers with the server; linking, by the server, a physical mailing address entered by the user to the virtual mailing address identifier to generate the virtual mailing address; and enabling, by the server, a second natural person to manually access the physical mailing address when the server determines that the second user has permission to access the virtual mailing address; enabling, by the server, an institute or business (juristic person) to access the physical mailing address automatically using an Application programming interface (API) through a computer system when the server determines that the second user has permission to access the virtual mailing address.

Abstract: According to one embodiment, in response to receiving a plurality of uniform resource locator (URL) links for malicious determination, any known URL links are removed from the URL links based on a list of known link signatures. For each of remaining URL links that are unknown, a link analysis is performed on the URL link based on link heuristics to determine whether the URL link is suspicious. For each of the suspicious URL links, a dynamic analysis is performed on a resource of the suspicious URL link. It is classified whether the suspicious URL link is a malicious link based on a behavior of the resource during the dynamic analysis.

Abstract: A computer-implemented method for detecting man-in-the-middle attacks may include (1) registering a mobile device of a user within a computing environment as an authenticated mobile device that corresponds to the user, (2) receiving an authentication request to log into a secure computing resource as the user, (3) transmitting, in response to receiving the authentication request, an out-of-band push authentication prompt to the registered mobile device of the user through a different channel than a channel through which the authentication request was received, (4) comparing a geolocation indicated by the authentication request with a geolocation indicated by the registered mobile device, and (5) performing remedial action in response to detecting a man-in-the-middle attack based on a determination that the geolocation indicated by the authentication request and the geolocation indicated by the registered mobile device do not match.

Abstract: A method for providing a transparent asynchronous network flow exchange is provided. The method may include receiving a query request from a requester, whereby the received query request is associated with a network packet. The method may also include determining if the network packet contains a plurality of defined signatures. The method may further include in response to determining that the network packet contains a plurality of defined signatures, authenticating a plurality of information associated with the network packet. The method may additionally include determining a plurality of flow related security information associated with the network packet based on the authentication of the plurality of information. The method may include sending the determined plurality of flow related security information to the requester.

Abstract: A system, apparatus, method, and machine readable medium are described for performing authentication using data analytics such as machine learning.

Abstract: A method for associating a web event with a member of a group of users is implemented at a first computing device. The method includes: receiving a data access request from a second computing device; determining whether the user has previously provided personal information and authorization to the first computing device through the second computing device; if the user's personal information and authorization are found: generating a record for the data access request; if the user's personal information is found but the user's authorization is not found: generating a record for the data access request; and if neither of the user's personal information and authorization is found: identifying one or more user identifiers that are associated with the second computing device; and returning personal information associated with the one or more user identifiers to the second computing device.

Abstract: A method for use in a dispersed storage network (DSN) operates to output at least a write threshold number of write slice requests to a set of storage units of the DSN and receive write slice responses from the set of storage units. When the write threshold number of favorable write slice responses is received, the method includes generating a corresponding number of commit requests and outputting the number of commit requests to associated storage units corresponding to the write threshold number of favorable write slice responses received.

Abstract: There is provided a method of maintaining a security risk level of data objects stored in a distributed system, comprising: estimating a current security risk level of at least one storage unit of each of a plurality of network nodes based on real time monitoring; distributing a plurality of data objects among the at least one storage units of the plurality of network nodes according to the current security risk level such that a minimal security requirement of each data object is complied with; detecting a change in the current security risk level of the at least one storage unit; and creating a new copy of at least one of the data objects for storage on a different network node such that the minimal security requirement of each data object is maintained.

Abstract: A certificate authority service receives a request to issue a long-duration digital certificate from an entity for validation purposes between the entity and the service. Upon issuance of the long-duration digital certificate, the entity submits a request to the service for issuance of a short-duration digital certificate that includes a shorter validity period than the long-duration digital certificate. The service may utilize the long-duration digital certificate to validate the entity and, upon validating the entity, issues the short-duration digital certificate to the entity. The entity may subsequently utilize the short-duration digital certificate to enable a user client to authenticate the entity and securely communicate with the entity.

Abstract: A rules evaluation engine that controls user's security access to enterprise resources that have policies created for them. This engine allows real time authorization process to be performed with dynamic enrichment of the rules if necessary. Logging, alarm and administrative processes for granting or denying access to the user are also realized. The access encompasses computer and physical access to information and enterprise spaces.

Abstract: A computer-implemented system and method for secure electronic message exchange including coupling a control platform to a workstation of a plurality of workstations via a communications medium, where the control platform includes one or more apparatuses for monitoring, controlling, conversion, and billing, related to messages exchanged between a plurality of local users and a plurality of remote users. The system prevents forwarding or copying of a message sent by a local user of the plurality of local users and received by a remote user of the plurality of remote users, to another party by the control platform. The system and method also provides for authenticating the remote user with the control platform.

Abstract: A storage cluster of symmetric nodes includes a data privacy scheme that implements key management through secret sharing. The protection scheme preferably is implemented at install time. At install, an encryption key is generated, split, and the constituent pieces written to respective archive nodes. The key is not written to a drive to ensure that it cannot be stolen. Due to the secret sharing, any t of the n nodes must be present before the cluster can mount the drives. To un-share the secret, a process runs before the cluster comes up. It contacts as many nodes as possible to attempt to reach a sufficient t value. Once it does, the process un-shares the secret and mounts the drives locally. Given bidirectional communication, this mount occurs more or less at the same time on all t nodes. Once the drives are mounted, the cluster can continue to boot as normal.