Abstract: A system for controlling selection of filters for protecting against vulnerabilities of a computer network includes a vulnerability management system analyzes the computer network and determines network vulnerabilities for the computer network. The vulnerability management system is configured to receive real-time data on a status of filters protecting against vulnerabilities of the computer network. A database contains a pre-generated mapping of network vulnerabilities to filters for protecting against the network vulnerabilities. The vulnerability management system enables user control of filters for protecting against vulnerabilities of the computer network based upon the determined network vulnerabilities of the computer network, the pre-generated mapping of network vulnerabilities to the filters for protecting against the network vulnerabilities and the real-time data on the status of the filters.

Abstract: A light-weight resilient mechanism is used to synchronize server secure keying data with member devices in a highly-scalable distributed group virtual private network (VPN). A server device generates an initial secure keying data set, for the VPN, that includes a first version identifier, and sends, to member devices and via point-to-point messages, the secure keying data set. The server device sends, to the member devices, heartbeat push messages including the first version identifier. The server device generates an updated secure keying data set with a second version identifier and sends, to the member devices, a key push message that includes the updated data set. The server device sends, to the member devices, heartbeat push messages including the second version identifier. Member devices may use the first and second version identifiers to confirm that secure keying data sets are current and quickly identify if updates are missed.

Abstract: A system and method which includes monitoring an existing first connection to a secured network domain. A first network configuration is employed to access the secured network domain via the first connection. An available second connection to the network domain is detected, whereby the system and method automatically switch to the second connection to access the secured network domain upon detecting a termination with the first connection. Access to the secured network domain, via the second connection, is established by employing a second network configuration. In an aspect, the first connection is by cable and the first network configuration is associated with direct access to the secured network domain. In an aspect, the second connection is a wired or wireless signal and the second network configuration is associated with a Virtual Private Network (VPN) connection.

Abstract: A method begins when at least a consensus threshold number of devices are active in a virtual private network (VPN) group of devices. The method continues by encoding group specific data based on a consensus threshold number of devices in the VPN group of devices and a number of devices in the VPN group of devices to produce one or more sets of encoded data slices. The method continues by sending the one or more sets of encoded data slices to at least one of: the consensus threshold number of devices or a dispersed storage network (DSN) memory for storage therein. When the at least the consensus threshold number of devices are not active in the VPN group of devices, each of the devices in the VPN group of devices are prohibited from creating the group specific data or accessing previously created group specific data.

Abstract: System and method embodiments are disclosed here to resolve Internet Protocol (IP) address overlap of Virtual eXtensible Local Area Network (VXLAN) endpoints in packets forwarded between the VXLAN and an external or public network. An embodiment method includes assigning different port number ranges to different virtual private networks of the VXLAN, mapping private IP addresses for endpoints at the virtual private networks to corresponding public IP addresses known to a public network, and mapping local ports of the endpoints to corresponding port numbers from the port number ranges assigned to the virtual private networks, wherein each of the endpoints at the virtual private networks is assigned to a unique combination of public IP address and port number. The mapping can be done at a VXLAN gateway or at the endpoints on physical servers of the virtual private networks.

Abstract: Techniques for configuring and managing remote security devices are disclosed. In some embodiments, configuring and managing remote security devices includes receiving a registration request for a remote security device at a device for configuring and managing a plurality of remote security devices; verifying the registration request to determine that the remote security device is an authorized remote security device for an external network; and sending a response identifying one or more security gateways to the remote security device, in which the remote security device is automatically configured to connect to each of the one or more security gateways using a distinct Layer 3 protocol tunnel (e.g., a virtual private network (VPN)).

Abstract: A process is disclosed in which all network traffic between a mobile device and an untrusted network arriving before the establishment of a VPN tunnel are dropped in response to rules imposed by the mobile device's operating system. Once a VPN tunnel is established all communication from the mobile device is secured, without an intervention on the part of the user of the device. A device supporting such a process is also disclosed.

Abstract: A communication control method and system for controlling communication among multiple industrial control systems connected via a network. The communication control system includes: a communication relay apparatus for relaying communication between at least two of multiple industrial control systems; a monitoring section for monitoring the multiple industrial control systems; and a control section for switching, if the monitoring section detects an anomaly from at least one of the multiple industrial control systems, communication between an industrial control system detected with an anomaly and a second industrial control system so that the communication is performed via the communication relay apparatus.

Abstract: Methods, apparatuses, and computer program products for dynamic allocation of network security credentials for alert notification recipients are provided. Embodiments include receiving from a managed system, by an alert management system, an alert indicating one of a failure in the managed system and a pending failure in the managed system; selecting, by the alert management system, a remote device from a plurality of remote devices registered for remote access with the alert management system; preapproving, by the alert management system, network security clearance of the selected remote device, the network security clearance for remote access to the management system via a virtual private network (VPN) interface; and transmitting to the selected remote device, by the alert management system, an alert notification that includes an internet address corresponding to the VPN interface.

Abstract: A method for allowing or denying, by an appliance, access to a resource by an application on a client via a virtual private network connection includes basing the decision to allow or deny access on identification of the application. The appliance intercepts a request from an application on a client on a first network to access via a virtual private network connection a resource on a second network. The appliance identifies the application and associates with the intercepted request an authorization policy based on the identity of the application. The appliance determines, using the authorization policy and the identity of the application, to either allow or deny access by the application to the resource.

Abstract: One embodiment includes a non-transitory computer readable medium having instructions executable by a processor to implement a method. The method includes receiving user configuration data for a network device, the configuration system being coupled to a service network. The method also includes storing device configuration data in a configuration database coupled to the service network, the device configuration data being based on the user configuration data and service network data. The method also includes receiving a configuration request at the configuration system from the network device in response to the network device being unconfigured and connected in a user network. The method further includes transmitting the device configuration data from the configuration database to the network device in response to the configuration request.

Abstract: A network element, method and computer program product is enabled to perform interactive connectivity checks in a mobility environment. Specifically, a network element comprises a discovery unit configured to identify a candidate defined as a combination of an internet protocol address and a port which the network element can use to communicate with a particular other network element. The network further comprises a mobile internet protocol signaling unit configured to submit a candidate identified by the discovery unit and to receive a candidate related to the other network element, and a simple traversal underneath network address translators protocol enabled unit configured to perform a connectivity check for a pair constituted by the submitted candidate and the received candidate by using the simple traversal underneath network address translators protocol.

Abstract: A system may include a Web Real-Time Communication (WebRTC) backend server configured to receive a request for a Uniform Resource Identifier (URI) for a WebRTC call session requested by a browser application and generate the URI for the WebRTC call session; and a validation proxy configured to receive the URI from a WebRTC gateway and validate the URI with the WebRTC backend server. The WebRTC backend server may be receive a request to validate the URI from the validation proxy, determine whether the URI corresponds to a valid URI, and send a validation message to the validation proxy, if the received URI is valid. The validation proxy may generate a Session Initiation Protocol (SIP) message based on the received validation message and send the generated SIP message to a contact center services system to initiate a real-time call between the contact center services system and the browser application.

Abstract: The disclosure provides a method for resource and admission control of a home network, the RACF of an NGN retail service provider formulates an initial policy rule according to a resource request after receiving the resource request sent by an SCF; a CPN performs authorization check on one or more resource requests after receiving them, each of which includes the initial policy rule and is sent by an RACF of a respective NGN retail service provider, formulates a final policy rule after the authorization check is passed, and executes the final policy rule. The disclosure further provides a system for resource and admission control of a home network correspondingly, since a CGPE-FE executes corresponding operation according to the decision result of an HPD-FE, the disclosure can avoid resource control errors such as resource desynchrony or resource inconsistence, and can improve system stability.

Abstract: A security module and method within an information handling system are disclosed. In a particular form, a processing module can include a local processor configurable to initiate access to resources of a host processing system. The processing module can also include a security module configured to enable use of the resources of the host processing system using a security metric. According to an aspect, the security module can be further configured to detect the security metric, and enable access to a resource of the host processing system in response to the security metric. The security module can further be configured to disable access to another resource of the host processing system in response to the security metric.

Abstract: A system includes an application access manager driver and an operating system (OS) kernel module in a kernel-mode address space of an OS. The system also includes application modules, a public application whitelist, a public application whitelist manager, a user/group application whitelist, and a user/group application whitelist manager in a user-mode address space of the OS. A method includes receiving a request to launch an application, calling a “create process” function in the OS kernel module, calling a pre-registered “create process” callback function to the application access manager driver, and determining whether the application is allowed to execute based on whether the application access manager driver identifies the application as an allowable process in either public application whitelist or user/group application whitelist.

Abstract: According to one embodiment, a computer system executing a computer program is coupled to multiple secure network domains configured in a multi-level security architecture. The computer program simultaneously establishes a voice connection with a first terminal configured on a first secure network domain and a second terminal configured on a second secure network domain. The computer program may then selectively couple an electroacoustical transducer to the first terminal or the second terminal, and generate an indicator on a user interface indicating the security level of the selected terminal.

Abstract: An example method includes receiving a request for a cloud capability set during an Internet Key Exchange negotiation associated with a virtual private network (VPN) tunnel between a subscriber and a cloud, wherein the cloud capability set comprises one or more cloud capabilities, mapping the request to one or more cryptographic modules that can support the cloud capability set, and offloading the VPN tunnel to the one or more cryptographic modules. The request can be an Internet Security Association and Key Management Protocol (ISAKMP) packet listing the one or more cloud capabilities in a private payload. The method may further include splitting the VPN tunnel between the cryptographic modules if no single cryptographic module can support substantially all the cloud capabilities in the cloud capability set. In some embodiments, the request is compared with a service catalog comprising authorized cloud capabilities.

Abstract: A standalone onsite appliance designed to connect a local network and telephony infrastructure to a hosted cloud environment. The appliance acts as an extension of the cloud by creating a bridge into the local network and providing each local user a portion of the cloud infrastructure. The appliance integrates local and wide-area networking, security services, Voice over IP (VoIP) services, and a virtualized server environment. In addition, the appliance provides offline access to otherwise cloud hosted infrastructure, data, and serves as a failover solution in the event of a loss of Internet connectivity.

Abstract: A negotiation unit, of a logical network control apparatus connected to a LAN, judges settings of processing to be performed on communication data by a network connection apparatus, from properties of an application to be used in communication, and decides parameters to be used for a VPN connection. The VPN connection is performed using the determined parameters.

Abstract: Methods and systems for managing cloud zones are described herein. A management server for a cloud of computing resources may add private zones to the cloud. The private zones may contain computers owned and operated by a user of the cloud, such as a cloud customer, rather than the cloud operator. The management server may manage the computing resources in the private zone by sending commands to an agent, which in turn relays the management server's commands to the individual computing resources. The agent may be authenticated using a token.

Abstract: A system and method are provided for supporting storage and analysis by law enforcement agency premises equipment of intercepted network traffic. The system and method provide integrity of the intercepted network traffic stored in an archive in accordance with lawful intercept requirements by storing all of the intercepted traffic, both benign and malicious, in the archive in its original form. The system and method furthermore provide for security from any malicious data packets of the archive by separating the malicious packets from the benign packets and forwarding only the benign packets to analysis applications of the law enforcement agency premises equipment.

Abstract: Recommending a security policy to a firewall, includes receiving a request from a firewall for a recommendation as to whether the firewall should allow or block a detected present communication for which the firewall does not have an existing security policy. Information about past blocked and allowed communications at other firewalls on a network is searched to identify past communications that are similar to the present communication. The identified past communications are assigned a respective positive or negative vote. A positive vote indicates a past communication was allowed and a negative vote indicates a past communication was not allowed. A positive recommendation is sent to the requesting firewall to allow the present communication if the positive votes outnumber the negative votes, and a negative recommendation is sent to the requesting firewall to block the present communication if the negative votes outnumber the positive votes.

Abstract: Embodiments of the present invention refer to a method for establishing a connection through a virtual private network “VPN” (9) between a first (1) and a second (3) entities of a transport network, the said entities comprising a virtual private network “VPN” interface (5, 7), wherein, between the said interfaces, a bearer of a selected type, among a plurality of types corresponding to a plurality of quality of service “QoS”, is determined according to the quality of service “QoS” requested for the connection and wherein the parameters used by the virtual private network “VPN” interfaces (5, 7) for the establishment of the bearer are global routing parameters corresponding to global routing parameters of the transport network and wherein the said parameters comprise at least one parameter which is different from one bearer type to another so that the selected bearer type associated with the quality of service “QoS” requested for the connection is identified by the first and the second entities.

Abstract: In one implementation, encrypted data and a virtual machine are stored together as a virtual machine-data image, wherein the virtual machine is configured to EXERT management control over the data based on policies set by an owner of the data. In another implementation, metadata defining or tagging policies for usage of data is associated with the data. Control capabilities of service providers are mapped to the policies, wherein those service provider environments that best satisfy the controls mapped to the policies are identified.

Abstract: A method of monitoring levels of security conformity and preparedness of a plurality of network connected computing machines, obtains a report by remotely scanning the machines in segments. The machines might already be connected to commercial security software and a patch dispenser. The report includes definition dates and any files quarantined by the commercial security software, patch-management-software communication present and the patches received. The method uses the report and software (not installed on the scanned machines) to produce a Network Security Scanner for Enterprise Protection output to perform a security-preparedness audit of the scanned machines. The audit non-intrusively ascertains. If the scanned machines conform to user-defined fields and policies, and assists in selective security updating of the machines. The scanning, unrecognized by the scanned machines may be configured to suit their OS, and done periodically as desired. A computer readable medium executing the method is included.

Abstract: A network device comprises a storage device storing an application program for a secure communications service; and at least one processor configured to execute the application program enabling the network device to: (a) send a request to look up a network address of a second network device based on an identifier; (b) receive an indication that the second network device is available for the secure communications service, the indication including the requested network address of the second network device and provisioning information for a secure communication link; (c) connect to the second network device over the secure communication link, using the received network address of the second network device and the provisioning information for the secure communication link; and (d) communicate at least one of video data and audio data with the second network device using the secure communications service via the secure communication link.

Abstract: Example methods and apparatus to enhance security in residential networks and residential gateways are disclosed. A disclosed example apparatus includes a transceiver to receive an Internet protocol (IP) packet, a first packet processing module associated with a protected IP address, the first packet processing module to be communicatively coupled to a first network device, a second packet processing module associated with a public IP address, the second packet processing module to be communicatively coupled to a second network device, and a packet diverter to route the received IP packet to the first packet processing module when the IP packet contains the protected IP address and to route the IP packet to the second packet processing module when the IP packet does not contain the protected IP address.

Abstract: Techniques are described for providing users with access to computer networks, such as to enable users to interact with a remote configurable network service to create and configure computer networks that are provided by the configurable network service for use by the users. Secure private access between a computer network provided for a user by the configurable network service and one or more other remote computing systems of the user (e.g., a remote private network) may be enabled in various ways. For example, a user may programmatically invoke an API provided by the configurable network service to obtain assistance in establishing remote access from a remote location to a provided computer network of the configurable network service, such as to establish a VPN connection from the remote location to the provided computer network using hardware and/or software supplied to the remote location in response to the API invocation.

Abstract: A method of transparently transferring data between a network application running on a first processor and a target service running on a second processor through a tunnel server running on a third processor, the method comprising: connecting a target program running on the second processor to the tunnel server; connecting a client program running on the first processor to the tunnel server; connecting the network application to the client program through a network adapter running on the first processor; sending data from network application to the tunnel server through the client program; connecting the target program to the target service through a network adapter running on the second processor; and relaying data from the tunnel server to the target service through the target program.

Abstract: A method for providing security groups based on the use of tunneling is disclosed. The method includes assigning a security group identifier (SGI) to a packet and classifying the packet based on the packet's SGI.

Abstract: A method is provided for electronically masking the geographic location of a client device in a communication network comprising the following steps: (a) mapping a communication from a first diverter node at a first location to a second diverter node at a second location, and (b) causing the communication to appear as originating from a client device at the second location when the communication is received by a destination device, wherein the second location is different from the first location. Also provided is a device that may be used to implement such a method.

Abstract: Techniques for sharing virtual machine (VM) resources are provided. A relative location for a resource within a VM is created; the relative location dynamically resolves to a particular physical location when a principal requests access to the resource at runtime. The principal is located outside an environment associated with the VM. Authentication and access restrictions are dynamically enforced against the requests made by the principal before a connection is permitted between the principal and the resource (the resource located within the environment of the VM).

Abstract: A multi-tenant data center environment includes a dedicated domain having at least one dedicated server associated with a client and a cloud domain having at least one cloud server associated with the client. The cloud server may have a public interface to a public network and a private interface to a private network. In turn, a network device is coupled between the dedicated domain and the public network, and is further coupled to the cloud server via the private network. A controller of the data center may be used to determine presence of the cloud server, and configure the network device to allow certain traffic to pass directly to the dedicated domain, while preventing other traffic from this direct path, based on access controls of the network device.

Abstract: Embodiments of information processing systems and associated components can include logic operable to perform operations in a virtualized system including a plurality of guest operating systems using descriptors. The descriptors specify a set of commands defining the operations in a plurality of security domains and specify permission to a plurality of resources selectively for the plurality of guest operating systems.

Abstract: One embodiment disclosed relates to a method for a switch to respond to a new client. A new client is detected at a port of the switch. The switch temporarily assigns the port to be an untagged member of a virtual local area network (VLAN) which is configured for unauthorized clients. Initialization services are provided to the new client via the unauthorized-client VLAN. The new client may be authenticated by way of an authentication session using the unauthorized-client VLAN. If the new client is authenticated, then the untagged membership of the port in the unauthorized-client VLAN is dropped, and the port is assigned to be an untagged member of a specified VLAN.

Abstract: A method and an apparatus for providing security in an intranet network are disclosed. For example, the method receives a packet at a customer edge router, and applies an inbound access control list by the customer edge router to the packet if the packet is destined to a server in a protected server group, wherein said protected server group identifies one or more servers within the intranet network to be protected. The method applies an outbound access control list by the customer edge router to the packet if the packet is from a server in the protected server group.

Abstract: In a method and appliance for authenticating, by an appliance, a client to access a virtual network connection, based on an attribute of a client-side certificate, a client authentication certificate is requested from a client. A value of at least one field in the client authentication certificate received from the client is identified. One of a plurality of types of access is assigned responsive to an application of a policy to the identified value of the at least one field, each of the plurality of access types associated with at least one connection characteristic.

Abstract: Methods and apparatuses for private electronic information exchange are described herein. In one embodiment, when electronic information is received to be delivered to a recipient, the electronic information is transmitted over an electronic network with a private routing address. The private routing address is routable within a private domain, which is a subset of the electronic network. Other methods and apparatuses are also described.

Abstract: Techniques are provided herein for enabling a virtual private network (VPN) using a bidirectional, full duplex transport channel configured to send and receive application layer data packets. At a source network device that hosts a VPN client, the VPN client is configured with a bidirectional, full duplex transport channel that is configured to send and receive Open Systems Interconnection application layer data packets. The VPN client is also configured with a virtual network interface that operates to virtually link the VPN client with the transport channel.

Abstract: An information processor includes a data storage portion that stores a first capability list indicating capabilities regarding an encryption. The information processor also includes a communication portion that receives a second capability list indicating capabilities, regarding the encryption, of a device. Further, the information processor includes a processing unit that determines an algorithm, by which communications are performed with the device, by referring to the first capability list and the second capability list. The communication portion sends identification information for identifying the algorithm determined by the processing unit and a public key relying on the algorithm to the device.

Abstract: A method can be used for authenticating access of a virtual private cloud, which are used for performing VPC access authentication between networks that communicate with each other using an IP routing protocol. A VPN routing device receives a request for accessing a virtual private network VPN by a virtual private cloud VPC. The request is sent by a cloud manager. The request for accessing a VPN by a VPC carries an identifier of a bearer network of a target VPN and a VPN identifier. The VPN routing device sends the VPC access request to a network edge device corresponding to the identifier of the bearer network. The VPC access request carries the VPN identifier.

Abstract: An apparatus for analyzing traffic is provided. The apparatus may precisely identify and analyze web traffic through 5 tuple-, HTTP-, and request/response pair-based packet analysis by monitoring the correlation between sessions.

Abstract: Techniques are disclosed for improving security in virtual private network. In one embodiment, key information is generated for a virtual private network (VPN) connection between a first device and a second device. A plurality of shares is then generated based on the key information. A first set of one or more shares is stored on a dongle that is paired to the first device. A second set of one or more shares is stored on the first device. In response to a request to resume the VPN connection, the first set of shares is retrieved from the dongle. The key information is reconstructed based on the first set of shares and the second set of shares. The reconstructed key information may then be used to resume the VPN connection.

Abstract: There are provided a rule-set analyzer and a method of analyzing an ordered security rule-set comprising a plurality of rules comprising N?1 extrinsic rule-fields. The method comprised: upon specifying an extrinsic space constituted by atomic elements corresponding to the values characterizing an extrinsic rule-field, partitioning said specified extrinsic space into two or more equivalence classes, wherein each atomic element in said extrinsic space belongs to one and only one equivalence class; mapping said equivalence classes over the rule-set; and generating a logically equivalent security rule-set, wherein respective rules comprise N?1 extrinsic rule-fields.

Abstract: A cloud center infrastructure system may include a service aggregator connected directly to a provider network. The service aggregator may be configured to receive, via the provider network, a data unit from a customer device, associated with a customer; identify a first device, associated with a first traffic processing service, based on a sequence of traffic processing services associated with the customer; and send the data unit to the first device, wherein the first device is located in a cloud services center, and wherein the first device is connected to the service aggregator over a Layer 2 connection.

Abstract: The present invention discloses an authentication server and a method for controlling a mobile communication terminal access to a virtual private network (VPN).

Abstract: Disclosed is a method for providing mobile virtual private network (VPN) services. An operation method of a group and tunnel manager (GTM) for providing mobile VPN services includes receiving a first message for registering information of a VPN group from a gateway, generating tunnel information between the GTM and the gateway based on the first message, and transmitting a packet based on the tunnel information. Accordingly, a private address may be used even in a mobile VPN, and therefore a VPN site may be configured even in an environment where a public address is difficult to use, or a flexible VPN site may be configured.

Abstract: An integrated virtual desktop and security management system provides the virtual desktop server functionality and, more importantly, security management for computing devices and servers in the corporate data network. The computing devices include computers running virtual desktop client software and computers running a complete operating system and applications. The system in this invention can intercept data packets exchanged among the computing devices and servers and also can scrutinize virtual machine computing and networking activities, and therefore, possess the capability of analyzing, logging, reporting, and permitting or denying computing and networking activities of devices in the corporate data network.

Abstract: A disclosed remote management system includes an electronic device; a communication adaptor; and a management apparatus connected via the communication adaptor to the electronic device and configured to remotely manage the electronic device.