Abstract: A communication device may obtain second security information in a case where a first instruction for establishing a second wireless connection with a second parent station is accepted under a state where a first wireless connection with a first parent station is established, and determine whether a second security level indicated by the second security information is lower than a first security level indicated by first security information in a memory. The communication device may execute at least one process of a notification process or an acceptance process in a case where it is determined that the second security level is lower than the first security level and establish the second wireless connection with the second parent station without executing the at least one process in a case where it is determined that the second security level is not lower than the first security level.

Abstract: A method for generating hashes associated with web domains and reacting to transmissions from those web domains is disclosed. When artifacts from a first web domain and artifacts from a second web domain have been transmitted over a network, a system generates, via a hashing or fingerprinting function that uses registry information, a first hash for the first web domain and a second hash for the second web domain and identifies a correlation between the first web domain and the second web domain based on shared subsets of the first hash and second hash. Upon receiving a notification that artifacts from the first web domain had been determined to negatively impact the functioning of a secondary computing system, based on the identified correlation between the first web domain and the second web domain, the system automatically quarantines artifacts from the second web domain from interacting with the secondary computing system.

Abstract: A computer-implemented method for detecting a security status of a computer system may include: in response to satisfaction of a predetermined trigger condition associated with an electronic application installed on a memory of the computer system, performing a security check process on the computer system; in response to the security check process determining that a security status of the computer system is currently compromised, performing a first security action; and in response to the security check process determining that the security status is formerly compromised, performing a second security action.

Abstract: An apparatus for a vehicle-to-everything (V2X) service establishes a secure session with a V2X server by using a transport layer security (TLS) handshake on the basis of an X.509 certificate of the V2X server. The apparatus generates a signed V2X message having a digital signature generated on the basis of a pseudonym certificate. The apparatus encodes the signed V2X message on the basis of the X.509 certificate.

Abstract: According to examples, an apparatus may include a processor that may determine that an application was accessed through a portal. Based on a determination that the application was accessed through the portal, the processor may determine whether a first credential type or a second credential type was supplied to access the application, in which the first credential type may include a set of personal credentials of a user and the second credential type may include a set of single sign-on credentials that the user may use to access multiple applications. The processor may also output a trace that may indicate an identification of the application that was accessed and the type of the credential supplied to access the application, in which a backed entity may analyze the data included in the trace.

Abstract: Embodiments described herein may be directed to systems, methods, apparatuses, devices, computer program products, computer-executable instructions, and/or applications for securely and anonymously accessing web resources and customizable attribution of identity. In accordance with the present disclosure, a user may inspect and analyze a webpage as well as the underlying source code from an “arm's length” using a secure analysis application to prevent exposure on the user's local machine. The secure analysis application may provide increased flexibility in masking and/or modifying the user's digital persona to external websites.

Abstract: Secured data access in virtual data processing is described. An example includes instructions to receive a request from an application in a compute node of a compute cluster in a virtual data processing environment to access a secured data source for a user, the virtual data processing environment including a multiple secured data sources that are accessible by compute nodes of the virtual compute cluster; fetch a credential in a current application context and forward the credential for validation; validate the credential with a credential authority; and, upon successfully validating the credential, authenticate the user at the secured data source and establish a connection with the secured data source.

Abstract: An application client on a user device receives an internal request from within the application client. The internal request is associated with edge application device(s) hosted by a computing platform. In response to the internal request, the application client obtains an authorization token from the computing platform and initiates an edge discovery request to the computing platform using the authorization token. In response to the edge discovery request, the application client receives connection information of a particular edge application device among the edge application device(s) that is identified for the application client by the computing platform. The application client establishes a connection between the application client and the particular edge application device using the connection information of the particular edge application device.

Abstract: A method of configuring a filter to perform pattern matching against input data is provided. The method includes receiving one or more rules, each rule including one or more field specifiers, each field specifier including a value specifier that specifies a value to be matched and a location specifier that specifies a location in the input data. For each rule of the one or more rules an empty buffer is initialized. For each field specifier the value specified by the field specifier is appended to the buffer, and the buffer contents are inserted into contents of a probabilistic data structure representing all of the field specifiers of the rule. The probabilistic data structure is configured to receive a query that includes query buffer contents determined from the input data and respond with a match status of probably present based on a predetermined probability, or definitely not present.

Abstract: Some embodiments of the invention provide a method of implementing an intent-based intrusion detection and prevention system in a datacenter, the datacenter including at least one host computer executing multiple machines. The method receives a filtered set of intrusion detection signatures to be enforced on the at least one host computer. The method uses a set of contextual attributes associated with a particular data message to generate an intrusion detection signature for the particular data message, the generated intrusion detection signature including a bit pattern, each bit associated with a contextual attribute in the set. The method compares the generated intrusion detection signature with the received set of intrusion detection signatures to identify a matching intrusion detection signature in the received filtered set.

Abstract: The present disclosure provides for improving security in a meter or an intelligent electronic device (IED) through the use of a security key which is unique to each meter or IED. Such a key may be used to prevent password reuse among multiple meters. Such a key may also be used to encrypt critical components of the software, such that only when running on the correct meter can the components of the software be decrypted. Such a key may also be used to uniquely identify the device in a larger data collection and management system. The security key can also be used to prevent the direct copying of meters. The present disclosure also provides for a meter or IED that stores functional software separately from core software.

Abstract: A secret key sharing system includes a transceiver in a first layer, a plurality of transceivers in a second layer, and a plurality of transceivers in a third layer. The transceivers in the second layer receive a first random number from the transceiver in the first layer via a directional carrier wave. The transceivers in the third layer receive a second random number from one of the transceivers in the second layer via the carrier wave. The transceiver in the first layer and the transceivers in the second layer share a first secret key based on the first random number, and the one of the transceivers in the second layer and the plurality of transceivers in the third layer share a second secret key based on the second random number.

Abstract: A multi-customer electronic access control (EAC) system comprising a mobile electronic device communicably engaged with at least one EAC server via a first communications protocol and communicably engaged with at least one EAC controller and lock via a second communications protocol. In accordance with certain aspects of the present disclosure, the mobile electronic device comprises an end user application comprising an application data store configured to store a plurality of embedded and encrypted authorization data for two or more separate EAC systems. In accordance with certain aspects of the present disclosure, the end user application is configured to enable a consistent user experience and single sign-on functionality for the two or more separate EAC systems.

Abstract: Examples described herein relate to deferred authentication in secure boot systems. An untrusted component is identified in a boot sequence in a trusted execution environment. A secure boot authentication of the untrusted component is deferred for a predetermined period and access to hardware resources is restricted. An image digest and privilege rights including access to hardware resources associated with the untrusted component is obtained in an untrusted execution environment. A request including the image digest and the privilege rights is sent to a central node over a secure connection. A response including a signature based on image digest and approved privileges is received from the central node. The untrusted component is authenticated in the trusted execution environment using the signature before expiry of the predetermined period. Access to the hardware resources is provided to the untrusted component in the trusted execution environment based on the approved privileges.

Abstract: Described herein are improved systems and methods for provisioning of private computer networks and application software as well as providing private SaaS.

Abstract: The technology disclosed herein enables network consensus management using trusted execution environments. An example method can include: determining, using a processing device associated with a first trusted execution environment (TEE) for a first node of a network in a distributed computing system, that the first node is a leader for a first set of networking transactions processed by the network in the distributed computing system; determining using the processing device associated with the first TEE, whether a second node of the network in the distributed computing system comprises a second TEE that satisfies an authentication threshold; and responsive to determining that the second node comprises the second TEE that satisfies the authentication threshold, setting, using the processing device associated with the first TEE, the second TEE of the second node as the leader for a second set of networking transactions processed by the network in the distributed computing system.

Abstract: Systems and methods for attributing user behavior from multiple technical telemetry sources are provided. An example method includes determining that the user has logged into the computing device, in response of the determination, collecting log data from a plurality of telemetry sources associated with the computing device, extracting, from the log data, activity data concerning activities of the computing device, analyzing the activity data to determine that the activity data are attributed to the user, generating, based on the activity data, behavior attributes of the user, associating the behavior attributes with a unique identifier of the computing device, and estimating security integrity of the computing device based on a comparison of the behavior attributes to reference behavior attributes. The reference behavior attributes include further behavior attributes determined using log data of at least one further computing device associated with the user.

Abstract: A client device determines that a telephony outage is occurring. The client device connects to an on-premises telephony node using an encrypted password at the client device. The client device accesses a set of telephony services via the on-premises telephony node.

Abstract: A multi-device electronic access control application, method and system. Certain aspects of the present disclosure provide for an end user mobile application that inter-operates with various types of electronic locking devices in a simple, repeatable method to enable a user to unlock any make or model of electronic access control device, if they are authorized to do so at that site, time and purpose, from a single mobile application user interface. An end user mobile application may be communicably engaged with a remote application server to integrate with enterprise backend user/site data and alarm systems, such that the end user mobile application is configured to manage user authorization/authentication, site access protocols/permissions and alarm management. An electronic access control method may comprise one or more steps for authorizing a user; suppressing an alarm; and unlocking an electronic locking device with a specified method for the given access point.

Abstract: A system and method for modifying functionality within a wireless network based on a provided passphrase is disclosed. The method includes defining a first and second set of network policies associated with a first and second passphrase, respectively, with the second passphrase being different from the first. The method also includes determining if the provided passphrase used by a client device while engaging in an authentication process with a mutable network device to secure a network connection matches one of the first or second passphrases. The method further includes configuring a traffic kernel module within the network device to provide the network connection to the client device, the connection defined by the set of network policies corresponding to the provided passphrase. Each network policy describes a functionality and governs the circumstances in which it is applied, the functionality being at least one of an access, a capacity, and a resource.