Abstract: A third-party server may maintain a list of named entity devices that belong to one or more roles in an application environment. The server may receive an authorization query from a policy consuming device. The authorization query may include an identity of a particular named entity device which sent a message to the policy consuming device and contextual metadata associated with the message. The server may determine that the particular named entity device belongs to one of the roles and filter the list based on the contextual metadata. The server may generate an interaction control list that includes the filtered list and transmit the interaction control list to the policy consuming device as a response to the authorization query. The interaction control list causes the policy consuming device to react to the message based on the interaction control list.

Abstract: Methods, devices and systems for providing a robust and secure cloud-based platform for data processing and management are described. In an example, a method for improving the configurability and compliance of a cloud-computing environment comprising a plurality of zones includes receiving, at a configuration engine, a plurality of parameters and a plurality of security rules for each of the plurality of zones, creating, based on the plurality of parameters, a virtual network and one or more subnets for each of the plurality of zones, and updating, based on the plurality of security rules, one or more routing tables assigned to the one or more subnets to ensure traffic to and from a zone of the plurality of zones passes through a corresponding firewall of the zone.

Abstract: Aspects of the disclosure relate to managing and routing messages to distributed user devices in an enterprise computing environment. In some embodiments, a computing platform may receive an application content request from an enterprise tablet computing device. The computing platform may generate and send a database query, which may cause a message database server to select message data from a message database hosted by the message database server. After sending the database query, the computing platform may receive, from the message database server, the message data selected from the message database. Subsequently, the computing platform may generate a notification for the enterprise tablet computing device and may send the notification to the enterprise tablet computing device, which may cause the enterprise tablet computing device to display the notification.

Abstract: A system may include a traffic interception module configured to intercept network traffic of a host device. A traffic virtualization module may be configured to generate a virtual file on the host device containing the intercepted network traffic. A security system interface module may be configured to provide the virtual file to a secure digital security system over a virtualized file interface coupling the host device to the secure digital security system, and to receive instructions to allow or to deny the network traffic from the secure digital security system over the virtualized file interface. A traffic access management module may be configured to allow or to deny the network traffic based on the instructions.

Abstract: The present disclosure relates to techniques for enforcing control policies on one more software as a service (SaaS) platforms from a centralized security control platform. An integration component is configured to integrate SaaS accounts with the security enforcement platform. The security enforcement platform executes functions that facilitate the creation of control policies on SaaS accounts. Exemplary control polices can be created to manage or control file sharing activities, user authentication, plugin usage, and/or other functions and features that may impact the security of the files or content included on the SaaS accounts. Activity events generated by the integrated SaaS accounts can be monitored by the security control platform. The activity events monitored by the security enforcement platform can be utilized to enforce the control policies and facilitate verification of file sharing activities.

Abstract: An example method performed by one or more processing devices includes: generating encrypted content at a sender device using one or more first keys that are available from a key provider; and outputting the encrypted content to a recipient device over one or more channels; where the key provider enables access, following authorization, by the recipient device to one or more second keys for decrypting the encrypted content; and where an entity that enables the channel is unaffiliated with the key provider.

Abstract: Techniques regarding pipeline security compliance are provided. For example, one or more embodiments described herein can comprise a system, which can comprise a memory that can store computer executable components. The system can also comprise a processor, operably coupled to the memory, and that can execute the computer executable components stored in the memory. The computer executable components can comprise a certification component that certifies a result from an execution of a pipeline for a computer application based on a comparison of an implemented security control profile associated with the pipeline and an applicable security control profile identified from a source artifact associated with the computer application.

Abstract: A data platform for developing and deploying a user application within a unified security context. The data platform authorizes a first user to use an editor to access source code of a user application based on security policies of a security context and authorizes the first user to use an application and data manager to set usage privileges for a second user to use the user application based on the security policies of the security context. To provide the user application to the second user, the data platform deploys the user application by instantiating a User Defined Function (UDF) server and an application engine of the UDF server within the security context, instantiating the user application as an application of the application engine within the security context, and authorizing access by the user application to databased on the security policies of the security context.

Abstract: Integrated controls frameworks are disclosed. In one embodiment, in an information processing apparatus comprising at least one computer processor, a method for using an integrated control framework for an application comprising a plurality of application modules may include: (1) defining an application profile, an application model, and a target cloud environment for an application; (2) identifying a plurality of security, resiliency, and controls requirements for the target cloud environment; (3) configuring a plurality of security controls for the application based on the plurality of security, resiliency, and controls requirements; and (4) deploying the security controls to the target cloud environment.

Abstract: An aggregated networking device subsystem station move control system includes first and second aggregated networking devices connected via an ICL. The first aggregated networking device receives a MAC address from the second aggregated networking device that was learned on an orphan port that has port security enabled and a station-move-deny configuration, and generates a static MAC address entry in its MAC address table that associates the MAC address with the ICL. The static MAC address entry causes data packets received on non-ICL ports on the first aggregated networking device that include the MAC address to generate a static MAC move violation. The first aggregated networking device also programs rule(s) that, in response to data packets being received on its non-ICL ports that have port security disabled and generating a static MAC move violation, causes the association of the MAC address with that non-ICL port.

Abstract: An Internet of Things (IoT) protection service at the network level is described. A secure session is established between an edge server and an IoT client that is requesting to send data to an IoT device. The edge server receives the request from the IoT client over the secure session instead of the IoT device directly because a Domain Name System (DNS) request for a unique fully qualified domain name assigned to the IoT device returns an IP address of the edge server instead of an IP address of the IoT device. The edge server analyzes the request to determine whether to transmit the request to the IoT device, including applying web application firewall rule(s) against the request. If the request does not trigger any rule, then the edge server transmits the request to the IoT device. If the request triggers any rule, then the edge server blocks the request.

Abstract: Methods, devices and systems are disclosed for inter-app communications between software applications on a mobile communications device. In one aspect, a computer-readable medium on a mobile computing device comprising an inter-application communication data structure to facilitate transitioning and distributing data between software applications in a shared app group for an operating system of the mobile computing device includes a scheme field of the data structure providing a scheme id associated with a target software app to transition to from a source software app, wherein the scheme id is listed on a scheme list stored with the source software app; and a payload field of the data structure providing data and/or an identification where to access data in a shared file system accessible to the software applications in the shared app group, wherein the payload field is encrypted.

Abstract: An example apparatus can include a memory device and a controller coupled to the memory device configured to receive a command including command information to access a register from a host device. The controller can grant access to the register in response to the controller determining the command is valid and/or deny access to the register in response to the controller determining the command is invalid. The controller can determine the command is valid by calculating an answer using a seed from the command in a formula and verifying the calculated answer matches an answer from the command. The command, once verified as valid, can allow the host device to access configuration registers and/or data registers.

Abstract: A quantum key distribution system may include a transceiver including a state randomizer to impart a random state transformation to one or more qubits of a generated faint pulse and a quantum bit encoder to reflect the faint pulse back to the transceiver with one or more encoded bits. The transceiver may receive a return pulse through the communication channel, where the state randomizer reverses the random state transformation. The transceiver may include three or more detectors to measure the return pulse at time-gated timeslots associated with possible paths of the return pulse. Reception of the faint pulse from the quantum bit encoder as the return pulse triggers a detector in a first known subset of the detectors, while reception of a faked-state pulse from a third party as the return pulse results in a non-zero probability of triggering of a detector in a second known subset of the detectors.

Abstract: The invention is directed to a computer readable medium storing a display control program for causing a computer to execute: a setting procedure of setting display control information of protected content to be protected based on authentication information; and a determination procedure of determining whether to permit display of the protected content and whether to cancel an authenticated state of the protected content based on the display control information set by the setting procedure.

Abstract: An example system includes a processor to receive a graph-based masking policy and a composite payload containing a data object to be masked. The processor is to instantiate a masking engine based on the graph-based masking policy. The processor is to execute the masking engine on the composite payload to generate a masked payload comprising a masked data object. The data object to be masked is masked in place such that the resulting composite payload type is maintained. The processor is to output the masked payload.

Abstract: Systems, computer program products, and methods are described herein for dynamic communication channel switching based on preconfigured network security protocols.

Abstract: A computerized method for restricting communications between virtual private cloud networks comprises creating a plurality of security domains. Each of the plurality of security domains identifies gateways associated with one or more virtual private cloud networks. Also, the method features generating transit routing data stores in accordance with each of the plurality of security domains; determining whether a connection policy exists between at least a first security domain and a second security domain of the plurality of security domains; and precluding communications between gateways associated with the first security domain and gateways associated with the second security domain in response to determining that no connection policy exists between the first security domain and the second security domain.

Abstract: Participants as requestors using a requesting network element request one or more tokenization processors to generate tokens that represent a sanitized version of data such that the resultant tokens are amenable to comparison across participants. As circumstances warrant, one or more such tokens can be submitted to the tokenization processor(s) to privately retrieve the original data. Role-based access control scope parameters and tokenization processor-specific tokenization processor secrets can be embedded into reversible tokens that remain invariant under updating of the tokenization processor secrets across tokenization processors.

Abstract: Methods, systems, and computer programs are presented for enabling any sandboxed user-defined function code to securely access the Internet via a cloud data platform. A remote procedure call is received by a cloud data platform from a user-defined function (UDF) executing within a sandbox process. The UDF includes code related to at least one operation to be performed. The cloud data platform provides an overlay network to establish a secure egress path for UDF external access. The cloud data platform enables the UDF executing in the sandbox process to initiate a network call.