Abstract: Techniques managing access rules are provided. Access rules and their associated profiles are determined for evaluation. A triggering rate or a triggering percentage can be used to indicate efficacy of the rule. Recommendations can be provided based on a triggering percentage difference of the rule during a predetermined period of time. The recommendations can be provided in an interactive user interface.

Abstract: An aggregated networking device subsystem station move control system includes first and second aggregated networking devices connected via an ICL. The first aggregated networking device receives a MAC address from the second aggregated networking device that was learned on an orphan port that has port security enabled and a station-move-deny configuration, and generates a static MAC address entry in its MAC address table that associates the MAC address with the ICL. The static MAC address entry causes data packets received on non-ICL ports on the first aggregated networking device that include the MAC address to generate a static MAC move violation. The first aggregated networking device also programs rule(s) that, in response to data packets being received on its non-ICL ports that have port security disabled and generating a static MAC move violation, causes the association of the MAC address with that non-ICL port.

Abstract: Embodiments disclosed herein are related to computing systems and methods for localizing how a user will receive and view received DID-related data. The computing system and methods are implemented in the decentralized network that implements a distributed ledger that backs one or more decentralized identities (DID) for one or more users of the computing system. Various sets of rule are accessed. The sets of rules specify how a DID owner will receive and view DID-related data received from a third party entity. The sets of rules are applied to the DID-related data received from the third party entity. The received DID-related data is modified such that the received DID-related data conforms to the one or more sets of rules. The modified DID-related data is provided to the DID owner so that the DID owner is able to view the modified DID-related data according to the applied sets of rules.

Abstract: Aspects of the disclosure relate to managing and routing messages to distributed user devices in an enterprise computing environment. In some embodiments, a computing platform may receive an application content request from an enterprise tablet computing device. The computing platform may generate and send a database query, which may cause a message database server to select message data from a message database hosted by the message database server. After sending the database query, the computing platform may receive, from the message database server, the message data selected from the message database. Subsequently, the computing platform may generate a notification for the enterprise tablet computing device and may send the notification to the enterprise tablet computing device, which may cause the enterprise tablet computing device to display the notification.

Abstract: An authorization level is set at enrollment. The authorization level can be determined based on user identity and a class of authentication. The class of authentication can be associated with strength of authentication related to a channel employed to enroll a user for access to products or services. Authorization level can also be determined based on initiation information regarding the user, a device of the user, or both. Access to the products or services can be selectively controlled based on the authorization level.

Abstract: A flexible access control for a plurality of terminal apparatuses in a physically-secured area is realized. An information processing apparatus includes a first acquisition unit configured to acquire a result of authentication performed when a specific user enters a target work room, a second acquisition unit configured to acquire a monitoring result obtained by periodically monitoring a staying state of the specific user in a work area including a target work terminal in the target work room, and an access control unit configured to permit access to the target work terminal when a first condition is satisfied, the first condition being a condition that the monitoring result indicates that the specific user stays in the work area after he/she is permitted to enter the target work room based on the authentication result.

Abstract: A building security system for a building includes one or more memory devices configured to store instructions. The instructions, when executed on one or more processors, cause the one or more processors to receive an access policy data structure for a building device, the access policy data structure indicating access policies for interactions of one or more other building devices with the building device, wherein the access policy data structure identifies the one or more other building devices with one or more building model queries, generate a dynamic access policy data structure for the building device by resolving the one or more building model queries with a building model to identify the one or more other building devices, wherein the dynamic access policy data structure comprises the access policies, and implement the access policies of the dynamic access policy data structure based on the one or more other building devices.

Abstract: In some embodiments, a secure local connection between a network node of a network and an edge device attached to the network node is provided by extending the security of the network to this local connection. The edge device attached to the network node communicates with a network manager of the network to obtain security keys and security credentials for the edge device. Using the security keys and the security credentials, the edge device can establish a secure channel between the network node and the edge device over the local connection. The edge device further communicates with the network manager to exchange routing information and to obtain a network address for the edge device. The edge device can then communicate, through the network node, with other network nodes in the network using the security keys, the security credentials, and the network address.

Abstract: A system is configured for assessing information security in a network. The system identifies portions of documents that contain information that is responsive to questions about an entity's compliance with network user requirements. The system then determines whether the identified information meets network user requirements. The system also calculates a confidence interval for its determinations. A report is generated to display the system's determinations and the associated confidence intervals for those determinations.

Abstract: A method and data processing system for making a machine learning model more resistant to adversarial examples are provided. In the method, an input for a machine learning model is provided. A randomly generated mask is added to the input to produce a modified input. The modified input is provided to the machine learning model. The randomly generated mask negates the effect of a perturbation added to the input for causing the input to be an adversarial example. The method may be implemented using the data processing system.

Abstract: An Internet of Things (IoT) protection service at the network level is described. A secure session is established between an edge server and an IoT client that is requesting to send data to an IoT device. The edge server receives the request from the IoT client over the secure session instead of the IoT device directly because a Domain Name System (DNS) request for a unique fully qualified domain name assigned to the IoT device returns an IP address of the edge server instead of an IP address of the IoT device. The edge server analyzes the request to determine whether to transmit the request to the IoT device, including applying web application firewall rule(s) against the request. If the request does not trigger any rule, then the edge server transmits the request to the IoT device. If the request triggers any rule, then the edge server blocks the request.

Abstract: Various embodiments of the present technology can include systems, methods, and non-transitory computer readable media configured to receive information about a plurality of regions contained within a hierarchy of a computer network environment, wherein the plurality of regions are assigned respective prime numbers. A first prime number assigned to a first region of the plurality of regions is determined. A second prime number assigned to a second region of the plurality of regions, wherein the second prime number is different from the first prime number is determined. A nearest common region in the hierarchy that includes the first region and the second region based on the respective prime numbers is identified. A security policy associated with the nearest common region is determined.

Abstract: Embodiments disclosed herein are related to computing systems and methods for localizing how a user will receive and view received DID-related data. The computing system and methods are implemented in the decentralized network that implements a distributed ledger that backs one or more decentralized identities (DID) for one or more users of the computing system. Various sets of rule are accessed. The sets of rules specify how a DID owner will receive and view DID-related data received from a third party entity. The sets of rules are applied to the DID-related data received from the third party entity. The received DID-related data is modified such that the received DID-related data conforms to the one or more sets of rules. The modified DID-related data is provided to the DID owner so that the DID owner is able to view the modified DID-related data according to the applied sets of rules.

Abstract: A hierarchical integrated trust assessment system features nested subsystems. Each subsystem utilizes a trust module for validating input data to the subsystem, validating output data from the subsystem, and validating the operation of the subsystem itself. The trust module verifies the format, the authenticity, the content of the inputs to the subsystem. The scope of each trust module is minimized to the associated subsystem. Minimizing the scope of the trust module results in increased reliability of the trust module's decisions.

Abstract: Secure selective token-based access control includes receiving a data access request from over a computer communications network, extracting a token from the request, selecting a decryption key for use in decrypting the token and attempting decryption of the token using the decryption key. Thereafter, on condition that the decryption key successfully decrypts the token into decrypted data, a creation date of the token in the decrypted data may be read and a rule applied to the creation date, the rule determining whether or not to expire the token. Finally, in response to a determination by the application of the rule to expire the token based upon the creation date of the token, the token is expired from subsequent use in authorizing servicing of the data access request, but otherwise the data access request is authorized for servicing.

Abstract: A system to control access to domains, servers, or content, among other things. There may be individualized or global policies. Policy servers or other devices may interface with databases, DNS servers, firewalls, programmable virtualized routers, or dynamic host configuration protocol servers, among other devices to dynamically update various policy enforcement elements.

Abstract: Detecting, mitigating and isolating a Signaling Storm, particularly in 5G communication networks. A Control Plane signal probe is connected at a first network node located between a Radio Access Network and a 5G Core Network, to monitor control messages originating from 5G-capable devices. A User Plane signal probe is connected at a second network node located between the 5G Core Network and remote entities to which the 5G-capable devices are sending messages, to monitor control messages passing through the second network node. An Inventory Management sub-system stores data correlating between 5G-capable devices and IMSI numbers. A Protector Unit is configured to receive (i) data collected by the Control Plane signal probe, and (ii) data collected by the User Plane signal probe, and (iii) a subset of IMSI numbers. The Protector Unit performs Machine Learning analysis, and detects and quarantines particular 5G-capable devices that are compromised or malfunctioning.

Abstract: A system may include a traffic interception module configured to intercept network traffic of a host device. A traffic virtualization module may be configured to generate a virtual file on the host device containing the intercepted network traffic. A security system interface module may be configured to provide the virtual file to a secure digital security system over a virtualized file interface coupling the host device to the secure digital security system, and to receive instructions to allow or to deny the network traffic from the secure digital security system over the virtualized file interface. A traffic access management module may be configured to allow or to deny the network traffic based on the instructions.

Abstract: In an approach to managing obfuscation of regulated sensitive data, one or more computer processors detect content for display on a computing device. One or more computer processors analyze the content for sensitive data. One or more computer processors retrieve one or more applicable regulations, where the regulations are associated with displaying sensitive data. One or more computer processors determine a location on the display for obfuscating the sensitive data in the content, based on the retrieved one or more applicable regulations. One or more computer processors identify one or more context rules applicable to the sensitive data in the content. One or more computer processors determine the one or more context rules override the one or more applicable regulations. One or more computer processors display the sensitive data in the content.

Abstract: A method for hash chain migration includes detecting a version update of an object that includes a hash chain that stores fields of the object. Sub chains are identified from the hash chain. Migration sub chains are generated from the plurality of sub chains using a plurality of processes. Container blocks are generated from the plurality of migration sub chains. A migration chain is generated from the plurality of container blocks. The object is accessed using the migration chain.