Abstract: Security techniques for device assisted services are provided. In some embodiments, secure service measurement and/or control execution partition is provided. In some embodiments, implementing a service profile executed at least in part in a secure execution environment of a processor of a communications device for assisting control of the communications device use of a service on a wireless network, in which the service profile includes a plurality of service policy settings, and wherein the service profile is associated with a service plan that provides for access to the service on the wireless network; monitoring use of the service based on the service profile; and verifying the use of the service based on the monitored use of the service.

Abstract: Systems and methods are provided for authenticating image files when network connections should not or cannot be used to transfer image files. A user device application may capture an image at a user device, generate an image file, and generate a hash file based on the image file. Instead of sending the image file to an authentication server for authentication, the application may send the hash file. If desired, the application may transfer the image file when a desirable network connection is available. Any alteration to the image file in the meantime will result in a different hash file for the altered image file, thus allowing detection of altered image files. This approach offers decreases the amount of data that is required to be transmitted in low or undesirable signal conditions, while maintaining an ability to detect alterations to image files that may have been made in the meantime.

Abstract: A computer system may receive one or more requests for access to one or more cloud services and may store the one or more requests in a request log. The computer system may receive one or more access rules applicable to cloud service access rights. The computer system may aggregate the one or more requests of the request log to determine access requirements for a container, the container being configured to store one or more applications. The computer system may generate and store container access policies that define access of a container and the one or more cloud services, the container access policies based at least in part on the aggregated one or more requests and the one or more access rules. The computer system may send the container access policies to a request forwarder of a compute instance in a production environment.

Abstract: A method may include receiving, from a user device, a registration request that includes a subscription concealed identifier (SUCI), identifying a network element to decode the SUCI and forwarding the SUCI to the identified network element. The method may also include decoding the SUCI to identify a subscription permanent identifier (SUPI), identifying a unified data management (UDM) device associated with the SUPI and transmitting an authentication request to the identified UDM device to obtain authentication information associated with the user device. The method may further include receiving the authentication information and authenticating the user device based on the received authentication information.

Abstract: Processing per-use requests for user data is disclosed, including: receiving a use-specific request to read a set of user data; determining whether to grant the use-specific request based at least in part on an access policy associated with an accessor definition associated with the use-specific request; and in response to a determination to grant the use-specific request, transforming the set of user data based at least in part on the accessor definition.

Abstract: A control apparatus includes: at least one memory configured to store instructions; and at least one processor configured to execute the instructions to: control communication in a vehicle by setting a control entry to a plurality of switches relaying, by referring to the control entry, a packet input to and output from an ECU installed in the vehicle, and perform an authentication processing for a device attempting communication with the ECU via any one of the plurality of switches. The control sets, to the switch, a temporary control entry realizing the communication between the device and ECU when authentication of the device is successful.

Abstract: Aspects of the disclosure relate to processing external messages using a secure email relay. A computing platform may receive, from a message source server associated with a first domain, a first email message and a first set of authentication credentials. Based on validating the first set of authentication credentials, the computing platform may inject, into the first email message, a DomainKeys Identified Mail (DKIM) signature of a second domain different from the first domain, which may produce a signed message that identifies itself as originating from the second domain. Based on scanning and validating content of the signed message, the computing platform may send the signed message to a message recipient server, which may cause the message recipient server to validate the DKIM signature of the signed message and determine that the signed message passes Domain-based Message Authentication, Reporting and Conformance (DMARC) with respect to the second domain.

Abstract: A method including pre-authenticating, by an infrastructure device, a user device for obtaining communication services from a server, the pre-authenticating including determining a given duration of time and a communication parameter associated with a pre-authentication request received from the user device; and operating, by the infrastructure device, a port associated with the server in an activated mode for the given duration of time to enable the user device to transmit an authentication request indicating the communication parameter prior to an expiration of the given duration of time. Various other aspects are contemplated.

Abstract: A system, method and apparatus to control memory devices over computer networks. For example, a server system establishes a secure authenticated connection with a client computer system to receive a request having a batch identification that is configured in the server system to identify a batch of multiple memory devices. After determining that the client computer system is eligible to control the multiple memory devices in the batch, the server system transmits to the client computer system a response. The response contains control data for each respective memory device in the batch. The control data is based on at least a cryptographic key stored in the server system in association with the respective memory device. Using the control data the client computer system submits a command with a digital signature to the respective memory device, which validates the digital signature prior to execution of the command.

Abstract: Systems and methods for authenticating a user on an augmented, mixed and/or virtual reality platform are provided. Once the user is authenticated, advertisements, experiences, appless apps, and/or tools may be deployed to a user, such as transforming an object on gaze into an advertisement, experience, scripted or un-scripted 3D object, animated or still 2D image, appless app, and/or tool. Using augmented, mixed and/or virtual reality technology, when a user looks/gazes at a virtual object, the bubble may then pop, transitioning into a video screen. The video screen is not being augmented on the virtual object itself.

Abstract: Embodiments of this application provide a network security management method and an apparatus. The method includes: receiving, by a first network device, a session request sent by a terminal device, where the session request is used to request establishment of a first session with a first data network, the session request includes first authentication information for the first session, and the first authentication information includes identifier information of the first data network; obtaining, by the first network device, second authentication information for a second session of the terminal device, where the second authentication information includes identifier information of a second data network to which the second session is connected; and if the identifier information of the first data network is the same as the identifier information of the second data network, authorizing the terminal device to establish the first session with the first data network.

Abstract: A service processing method, apparatus, and storage medium of a blockchain system are provided. The service processing method includes obtaining authentication information of a service participant; determining whether data in the authentication information of the service participant is updated; generating, based on the data in the authentication information of the service participant being updated, a notification message according to the updated data; and transmitting the notification message to a service processing node subnetwork, the notification message instructing one or more service processing nodes in the service processing node subnetwork to process a service request according to updated authentication information of the service participant.

Abstract: Systems and methods in accordance with present implementations can include decrypting, by one or more processors, a data packet using a session key to recover a decrypted data packet, the data packet comprising a data element encrypted with a first content-specific key associated with a shared secret, the data packet encrypted with the session key, and decrypting, by the one or more processors, the data element of the decrypted data packet using a second content-specific key corresponding to a data type of the data element, to recover a decrypted data element.

Abstract: A method for joining an association that includes receiving, by a first cluster, an association access credential and a unique address of an association manager, generating, based on the association access credential, an association access request, sending, to the unique address, the association access request, receiving, in response to the sending, association information, and initiating, based on the association information, a connection to a second cluster in the association.

Abstract: Various embodiments are generally directed to techniques to enforce policies for computing platform resources, such as to prevent denial of service (DoS) attacks on the computing platform resources. Some embodiments are particularly directed to ISA instructions that allow trusted software/applications to securely enforce policies on a platform resource/device while allowing untrusted software to control allocation of the platform resource. In many embodiments, the ISA instructions may enable secure communication between a trusted application and a platform resource. In several embodiments, a first ISA instruction implemented by microcode may enable a trusted application to wrap policy information for secure transmission through an untrusted stack.

Abstract: A system includes at least one processor and at least one memory including instructions that, when executed by the at least one processor, cause the at least one processor to perform operations. The operations include providing a secure link to an auditable, machine-readable dataset to a client device of a user, the auditable, machine-readable dataset comprising data. At least one policy constraint is provided to at least a portion of the data in the dataset. In response to detecting activation of the secure link at the client device, one or both of the user and the client device is authenticated based on the policy constraint. Streaming access is provided to the auditable, machine-readable dataset in real-time.

Abstract: A method including establishing, by a first device, a virtual private network (VPN) connection with a VPN server; establishing, by the first device during the established VPN connection, a meshnet connection with a second device in a mesh network; determining, by the first device, whether the second device is a destination associated with a transmission packet to be transmitted by the first device; and transmitting, by the processor, the transmission packet by utilizing the VPN connection or by utilizing the meshnet connection based at least in part on determining whether the second device is the destination associated with the transmission packet. Various other aspects are contemplated.

Abstract: Implementations of the present disclosure are directed to providing remote access to electronic documents stored in a server system using a virtual secure room, and include actions of authenticating a user at least partially based on credentials the user, at least partially in response to authenticating the user, providing a secure connection between a computing device of the user and the server system, transmitting at least one electronic document for display to the user on the computing device, monitoring the user, while the at least one electronic document is displayed to the user on the computing device, and selectively closing the secure connection in response to one or more of at least one activity and at least one state of the user.

Abstract: A virus scanning router may manages a local network, including routing network traffic between devices on the network and routing network traffic being sent to and from such devices via an external communication system. The virus scanning router remotely scans for viruses the files stored on one or more such devices on the network. The virus scanning router may be a device trusted by the other devices on local network to facilitate the virus scanning router reading and scanning one or more files stored on such devices for viruses. The virus scanning router also takes corrective actions such as isolating the infected device or isolating an affected network zone to which the remote device belongs.

Abstract: Various embodiments provide an approach to detect intrusion of connected IoT devices. In operation, features associated with behavioral attributes as well as volumetric attributes of network data patterns of different IoT devices is analyzed by means of statistical analysis to determine deviation from normal operation data traffic patterns to detect anomalous operations and possible intrusions. Data from multiple networks and devices is combined in the cloud to provide for improved base models for statistical analysis.