Abstract: A method may include obtaining a match vector that indicates one or more filter rules that are potentially applicable to a packet. The method may include partitioning the match vector into a plurality of segments. The method may include generating a summary vector that identifies one or more portions of the match vector that include one or more match bits. A match bit may indicate one of the one or more filter rules that is potentially applicable to the packet. The method may include obtaining a relevant segment of the match vector. The relevant segment may include at least one of the portions of the match vector identified by the summary vector. The method may include determining a filter rule to apply based on the match vector and based on the one or more match bits. The method may include applying the filter rule to the packet.

Abstract: Aspects include encrypting data exchanged between two computer systems. A method includes accessing content of a memory, via a memory address, by at least one processing unit of one of the computer systems. Based on the accessing being a write operation, the content of the memory is encrypted using a memory encryption key, the encrypting is by a crypto unit of the at least one of the processing units. Based on the accessing being a read operation, the content of the memory is decrypted using the same memory encryption key, the decrypting is by a crypto unit of the at least once of the processing units. Remote direct memory access is established via memory addresses between the computer systems, the establishing including at least one of the computer systems locally storing a respective network encryption key as memory encryption keys for memory areas used for the data exchange.

Abstract: Methods and systems for authenticating a user device employ a database of global network latencies categorized and searchable by location and calendar date-time of day usage, providing network latency by geography and by time. The database is constructed using voluminous daily data collected from a world-wide clientele of users who sign in to a particular website. Accuracy of the latency data and clock skew machine identification is made practical and useful for authentications using a service provider-proprietary, stable reference clock, such as an atomic clock, so that internal clock jitter of a service provider performing authentications does not affect the network latency time and clock skew identification of user devices. Increased authentication confidence results from using the database for correcting network latency times and user device signatures generated from the clock skew identifications and for cross checking the authentication using comparisons of initial registration to current sign in data.

Abstract: A user, group, and device management and authentication system allows administrators to manage one or more directories with devices that are not associated with a domain of the one or more directories via a set of APIs. The system also allows applications and services that do not have direct access to a list of directory users to access the one or more directories. The user, group, and device management and authentication system may be an add-on system that works in conjunction with a centrally-managed directory service to provide such functionality. For example, the system may generate an access token associated with a particular directory that can be used by a service accessed by an administrator to call an API provided by the system. The API call may be translated into a directory-specific API call that can be used to perform an action in the particular directory.

Abstract: An information handling system and method performs Unified Extensible Firmware Interface (UEFI) interception and pre-processing of data associated with block input/output (I/O) commands targeting encrypted storage devices. A UEFI interceptor block (IB) I/O driver intercepts each block I/O command targeting block addresses on a storage device and identifies whether any of the target block addresses is encrypted. In response to identifying an encrypted block address among the target block addresses, the UEFI IB I/O driver forwards data associated with the encrypted block address to an encryption-decryption module to perform one of an encryption and a decryption of the data. Final handling of the block I/O command is performed using a block I/O driver chained to the UEFI IB I/O driver. Data associated with I/O commands targeting encrypted block addresses is first processed by the encryption-decryption module before final handling of the I/O command is performed by the block I/O driver.

Abstract: According to one embodiment, a computerized method comprises, accessing information associated with one or more observed events, wherein one or more of the observed events constitutes an anomalous behavior; accessing a reference model based on a first plurality of events, the reference model comprises a first event of the first plurality of events, a second event of the first plurality of events and a relationship that identifies that the second event of the first plurality of events is based on the first event of the first plurality of events, wherein at least one of the first event and the second event constitutes an anomalous behavior; and comparing the information associated with the one or more observed events with the reference model to determine whether at least one observed event of the one or more observed events matches at least one of the first event of the first plurality of events or the second event of the first plurality of events that constitutes the anomalous behavior is provided.

Abstract: Described herein are methods, network devices and machine-readable storage media for detecting whether a message is a phishing attack based on the collective responses from one or more individuals who have received that message. The individuals may flag the message as a possible phishing attack, and/or may provide a numerical ranking indicating the likelihood that the message is a possible phishing attack. As responses from different individuals may have a different degree of reliability, each response from an individual may be weighted with a corresponding trustworthiness level of that individual, in an overall determination as to whether a message is a phishing attack. A trustworthiness level of an individual may indicate a degree to which the response of that individual can be trusted and/or relied upon, and may be determined by how well that individual recognized simulated phishing attacks.

Abstract: A method of accessing a service includes receiving, from a requesting user, a request for a number of accessing users to have access to the service; generating service access data associated with the service; providing, to the requesting user, the generated service access data for distribution to the accessing users; receiving service access data from an accessing user; determining, based in part on the received service access data, whether the service can be provided; and where it is so determined, providing the service to the accessing user.

Abstract: A system and method facilitate the use of a multi-function computer for an examination. An application implementing the method receives a hash input from a user and, upon successful completion of the examination, displays a hash output. The hash output may be displayed as a visual hash. During the examination, the application or system monitors the multi-function computer to determine whether the user has activated, viewed, or launched any prohibited functions or applications on the multi-function computer. If the user views a prohibited function or application, the examination application does not display the hash output. The system and application implement various security measures to prevent spoofing or duplication of the hash output or tampering with the application.

Abstract: Distribution of verification of passwords for electronic account. Password verification is distributed (divided) across multiple entities to reduce potential exposure in the event of a server exposure.

Abstract: Methods and systems for instantiating an enclave according to a request, the enclave being instantiated at a determined location of a set of locations in a computing environment of a computing resource service provider hosting a set of computing resources. The enclave further being instantiated with executable code specified by a customer for processing network traffic in accordance with the executable code in a computing environment.

Abstract: Authenticating a client device to a service to allow the client device to access a resource provided by the service. A client device obtains a secondary credential that is associated with a primary credential and that is generated as being usable by a particular set of devices including the client device to indirectly gain access to the service through the primary credential. While outside of an enterprise network, the client device requests access to the service, including sending the secondary credential to an enterprise gateway. Based at least on sending the secondary credential to the enterprise gateway, the client device receives a resource from the service. The resource is received based at least on the enterprise gateway having forwarded the primary credential to the service after verifying that the secondary credential is valid and that the client device is in the particular set of client devices.

Abstract: A method includes a computer device receiving a set of images for at least one user; the computer device receiving unique visual clue inputs from the at least one user for each image of the set of images; the computer device receiving drawing gesture inputs from the at least one user for each image of the set of images; and the computer device using the visual clue and drawing gesture inputs to create passwords to provide a locked access point for at least one device.

Abstract: Deploying an encrypted entity on a trusted entity is illustrated herein. A method includes, at a trusted entity, wherein the trusted entity is trusted by an authority as a result of providing a verifiable indication of certain characteristics of the trusted entity meeting certain requirements, receiving an encrypted entity from an untrusted entity. The untrusted entity is not trusted by the authority. At the trusted entity, a trust credential from the authority is used to obtain a key from a key distribution service. The key distribution service is trusted by the authority. The key is used to decrypt the encrypted entity to allow the encrypted entity to be deployed at the trusted entity.

Abstract: An exemplary system that includes a computing device that stores an abstraction and unification module, the abstraction and unification module being executable by a processor of the computing device to receive from a frontend component a request for information located within a backend component of the computing device and validate that the frontend component is authorized to receive the information specified in the request. The abstraction and unification module may further pass the request to an abstraction engine that extracts the information from the backend component and provides the information extracted from the backend component to frontend component.

Abstract: In one example, a method for validating a user includes transmitting, to a management server, a request for a shared secret, and receiving, from the management server, the shared secret. Next, the shared secret received from the management server is compared to a secret identified in a user request for access to a backup of data associated with a computing device. The user is granted access to the backup when the shared secret identified by the user matches the shared secret obtained from the management server, and the user is denied access to the backup when the shared secret identified by the user does not match the shared secret obtained from the management server.

Abstract: Technologies for bootstrapping virtual network functions in a network functions virtualization (NFV) network architecture include a virtual network function (VNF) bootstrap service (VBS) in secure network communication with a VBS agent of a VNF instance. The VBS agent is configured to execute a secure VNF bootstrap capture protocol in the NFV network architecture. Accordingly, the VBS agent can be configured to register with the VBS via secure communications transmitted between the VBS and the VBS agent. The secure communications include transmitting a security quote from a TEE of a platform on which the VNF instance is instantiated and a security credential request to the VBS, as well as receiving a security credential in response to validating the security quote and the security credential request. Other embodiments are described and claimed.

Abstract: Systems and techniques for configuring wireless devices are described. To configure a wireless target device to access a network and/or network-based services, a wireless connection may be formed between the wireless target device and a wireless source device storing configuration data for accessing one or more networks and/or network-based services. The source device may determine whether it is authorized to send at least a portion of the configuration data to the target device. The target device may determine whether it is authorized to accept at least a portion of the configuration data provided by the source device. The target device may accept at least a portion of the configuration data by storing the accepted configuration data in a memory (e.g., a non-volatile memory) and/or by using the configuration data to access a wireless network and/or a network-based service.

Abstract: A method for generating a key in a network. The network includes at least one first user and one second user having a secured communication link to one another, and a third user, to which a secured communication link is to be established. The first user and the third user each generate a first partial value sequence from properties of the transmission channel between the first user and the third user. The second user and the third user each generate a second partial value sequence from properties of the transmission channel between the second user and the third user. In a secured part of the network, which includes at least the first and the second user, but not the third user, the key is ascertained from at least the first partial value sequence of the first user and the second partial value sequence of the second user. The key is also generated in the third user from at least the first partial value sequence and the second partial value sequence.

Abstract: Systems and methods of classifying network traffic may monitor network traffic. Monitored traffic may be compared with a control protocol template (CPT). When a similarity between the monitored traffic and the CPT exceeds a match threshold, the monitored traffic may be associated with the CPT.