Abstract: An encryption/decryption method is disclosed, where the input data string is described in term of consecutive groups of alternating same type bits, where one of these groups of same type bits is defined as a preferred group with the other groups having either lower or higher number of same type bits, where the data string is partitioned into variable length processing strings where the variable length is determined by the occurrence of the preferred group or of a determined number of bits consisting of groups of lower number of same type bits, where these variable length processing strings are encrypted function of the configuration and content of each processing string only, where consecutive processing strings are additionally encrypted based on their content only, where further encryption is performed from permutations of select partitions of groups of processing strings only as well as from permutations of select partitions of consecutive processing strings, where all said encryption means creating a tota

Abstract: Techniques are described for configuration and application of intent-based network access control (NAC) policies for authentication and authorization of multi-tenant, network access server (NAS) devices to access enterprise networks of organizations. A network management system configures intent-based NAC policies for an organization. A cloud-based NAC system may apply an appropriate intent-based NAC policy in response to an authentication request from a NAS device. The NAC system identifies a vendor of the NAS device, matches incoming attributes in the authentication request to a set of normalized match rules of the intent-based NAC policy, and translates a set of abstracted policy results corresponding to the set of normalized match rules into a vendor-specific set of return attributes based on the vendor of the NAS device. The NAC system sends the vendor-specific set of return attributes to the NAS device to enable the NAS device to access the enterprise network of the organization.

Abstract: A configurable system and method for automatically taking in streams of log data from various sources, dynamically parsing, normalizing the data and routing it to subsystems of an analytics engine. The routed data may undergo aggregating and other enrichment based on content, rules and data, so as to generate useful event observations, which may recursively be fed back into the system's data ingestion stream to further enhance the usefulness of the system's outputs, in real-time, in the context of computer system and data security.

Abstract: Aspects of the present application relate to systems, methods and non-transitory computer readable media for network virtualization in a rack-based switch. The method can include sending a communication from a first virtual machine (“VM”) instantiated on a first host machine to a first network virtualization Top of Rack (“ToR”) switch. The first network virtualization ToR can include a peripheral component interconnect express (“PCIe”) switch coupled to a plurality of host-side Ethernet ports, a virtualization device communicatingly coupled to the PCIe switch, which virtualization device can include a plurality of virtualization functions, and a switching ASIC coupled to the virtualization device and to a network-side Ethernet port. The method can include forming the communication into an Internet Protocol (“IP”) packet with a first virtualization function of the virtualization device, and sending the IP packet to a second VM with the switching ASIC.

Abstract: A method of updating of firmware to a client device such as a BLE button is provided. The method includes the steps of providing a first user device and detecting the client device with the first user device. It is determined if the client device is in an update mode in response to instructions from a second user device. The firmware is uploaded from the first user device to the client device in response to the client device being in the update mode.

Abstract: Methods, systems, apparatuses, and computer-readable storage mediums described herein are configured to detect anomalous post-authentication behavior with respect to a user identity. For example, one or more audit logs that specify a plurality of actions performed with respect to the user identity of a platform-based identity service, while the user identity is authenticated with the platform-based identity service, are analyzed. The audit log(s) are analyzed via an anomaly prediction model that generates an anomaly score indicating a probability whether a particular sequence of actions of the plurality of actions is indicative of anomalous behavior. A determination is made that an anomalous behavior has occurred based on the anomaly score. In response to determining that anomalous behavior has occurred, a mitigation action may be performed that mitigates the anomalous behavior.

Abstract: A network device may receive IPv6 fragments of a flow. Source and/or destination port information may be encoded into an upper sixteen bits of an identification number of an IPv6 fragment header of each of the IPv6 fragments. The network device may extract the source and/or destination port information from the IPv6 fragments, and may perform a spoof check of the IPv6 fragments. The network device may drop any of the IPv6 fragments that fail the spoof check, to generate remaining IPv6 fragments, and may translate the remaining IPv6 fragments into IPv4 fragments based on the source and/or destination port information. The network device may forward the IPv4 fragments toward an IPv4 cloud network.

Abstract: Some embodiments of the invention provide a method for forwarding data messages between a client and a server (e.g., between client and server machines and/or applications). In some embodiments, the method receives a data message that a load balancer has directed from a particular client to a particular server after selecting the particular server from a set of several candidate servers for the received data message's flow. The method stores an association between an identifier associated with the load balancer and a flow identifier associated with the message flow, and then forwards the received data message to the particular server. The method subsequently uses the load balancer identifier in the stored association to forward to the particular load balancer a data message that is sent by the particular server. The method of some embodiments is implemented by an intervening forwarding element (e.g., a router) between the load balancer set and the server set.

Abstract: Disclosed are systems, apparatuses, methods, and computer-readable media to implement circuit-style network with co-routed bidirectional network paths. A method includes receiving a request for a circuit policy between a source node and a destination node, the circuit policy defining a co-routed bidirectional policy between the source node and the destination node; requesting a path compute service to identify a path between the source node and the destination node that satisfies the circuit policy through a first network; receiving a path identifying a first set of network nodes that satisfy the circuit policy; configuring each node in the first set of network nodes within the first network with the circuit policy; and establishing a connection using the path that satisfies the circuit policy between the source node and the destination node.

Abstract: In some embodiments, during the SIP registration, the UE indicates in the REGISTER requests its support for ANBR as defined by “ANBR” attribute in the SDP and the P-CSCF indicates its support for the “ANBR” attribute in the SDP in the response for registration. In some embodiments, the P-CSCF serving a PLMN passes through the “ANBR” attribute in the SDP when the P-CSCF recognizes that the PLMN supports ANBR functionality. In some embodiments, the UE can include “ANBR” attribute in the SDP offer and answers when the P-CSCF indicates its support for the “ANBR” attribute in the SDP.

Abstract: Examples provide a cloud server management controller configured to determine a network resource threshold and a cloud resource availability for a cloud server. The first resource availability is an amount of cloud network resources available in the cloud server within the network resource threshold. For each respective system of a plurality of local network systems, the controller determines a local resource usage and predicts a cloud resource requirement. The cloud resource requirement is an amount of cloud network resources required to provide a cloud-based equivalent of the respective system. The controller builds a model based on the cloud resource requirement for each respective system and the network resource threshold. The model defines a cloud migration priority for each of the plurality of local network systems. Based on the model, the controller generates a cloud migration timeline for sequentially migrating each respective system to the cloud server.

Abstract: Systems, methods, and computer-readable media are disclosed for dynamically onboarding a UE between private 5G networks. In one aspect, a private 5G (P5G) federation system can receive a request from a user device for registration with a serving private 5G network, which is part of a P5G federation system. The P5G federation system can further determine that the user device is authenticated with a home private 5G network of the user device, which is also part of the P5G federation system. The P5G federation system can transmit, to the serving private 5G network, a security profile of the user device that is received from the home private 5G network. As follows, the P5G federation system can facilitate onboarding of the user device to the serving private 5G network with the security profile.

Abstract: Techniques for associating assets related to events detected in at least one computer network with respective assets in an asset catalog for the at least one computer network. The techniques comprising: obtaining information about an event related to a first asset, the information specifying computer network addressing information for the first asset; generating a signature of the first asset from the computer network addressing information using at least one trained machine learning model, wherein the signature comprises a numeric representation of the first asset; associating the first asset with at least one asset in the asset catalog using the signature and at least one signature of the at least one asset in the asset catalog, wherein the at least one signature was previously determined using the at least one trained machine learning model; and outputting information identifying the at least one asset with which the first asset was associated.

Abstract: A method controls access to at least one confidential data access to which by a function of a watch requires an identification of its wearer. The method includes authenticating the wearer of the watch to authorise access to the functions of this watch, selecting one of the functions of the watch requiring the use of at least one of the confidential or general data archived in the memory element, determining the category to which the at least one data required by the function belongs, verifying the identity of the wearer of the watch from at least one biometric information element comprised within a portion of the skin of this wearer when the at least one data is the confidential data, and authorizing use of the at least one confidential data by the function as soon as the identity of the wearer of the watch is verified.

Abstract: A method for determining a preimage element of a cryptographic hash function includes providing an output value of a cryptographic hash function and hash function operations of the cryptographic hash function; for each of the hash function operations, determining at least one hash function relation, comprising an equation and/or an inequality; determining an optimization problem comprising: the output value, at least one constraint assigned to an iteration of the cryptographic hash function, and optimization variables comprising internal state variables of the cryptographic hash function and at least one preimage variable, wherein the at least one constraint is determined from the at least one hash function relation and comprises preceding internal state variables assigned to a preceding iteration; and solving the optimization problem and determining a preimage element of the cryptographic hash function from an optimizing value of the at least one preimage variable.

Abstract: Various techniques described herein relate to analyzing and redacting information from customer interaction records such as call transcripts, to support transmission of the interaction records from a secured environment to various external analytics systems. Transcript texts may be received and processed by a redaction system, during which the transcript texts may be analyzed to generate conversations and convert numerical texts into numbers. One or more regular expressions defining search and replace patterns may be selected and used to redact confidential or sensitive information from the transcripts. In various implementations, the regular expressions used to redact transcripts may be determined or generated based on transcript categorization, the security characteristics of the transmission networks and/or external systems to which the redacted transcripts are to be transmitted, and/or other attributes of the transcript or the associated systems.

Abstract: Systems and methods for retrieving regional content via remote access point servers are disclosed. In one embodiment, the disclosure relates to a network system for content retrieval from remote network regions. The network system may comprise a first device. The first device may be configured to receive a request for content. The content may be on one or more content servers located in a remote network region. The first device may be further configured to at least one of forwarding the request, via tunneling, to a destination access point server located in proximity to the one or more content servers and receiving the content from the destination access point server, obtaining the content from a cache of the first device.

Abstract: According to an embodiment, an electronic device may include: a communication module comprising communication circuitry configured to operate in Bluetooth low energy (BLE), a memory, and at least one processor operatively coupled to the communication module and the memory. The at least one processor may be configured to: receive authentication information about each function from an external electronic device via BLE, the authentication information about each function including information about data for the function and information about an access right level of the function, store the received authentication information about each function in the memory, and control the communication module to transmit an authentication index of each function corresponding to the authentication information about the function to the external electronic device by BLE.

Abstract: The control network system is connected to electronic control unit(s) and a communication device, and includes security sensor(s) that transmits a security alert indicating that an indication of a security breach is detected to the network, if the indication is detected in at least one of the network, the electronic control unit(s), or the communication device. The intrusion path analysis device includes: an alert obtainer that obtains the security alert from the security sensor(s); an event obtainer that obtains an event history of an event that occurs in the control network system; and an intrusion path analyzer that performs an analysis on an intrusion path of an attack on the basis of the security alert, the event history, and an intrusion depth indicating an intrusion level to be assumed in a case the security alert occurs, and that outputs a result of the analysis.

Abstract: Compliancy management is implemented across a plurality of applications utilizing a generic model. The generic compliancy model includes references to external data objects. A compliancy state record for each data object records a current compliancy status (e.g., active, inactive, blocked, deleted, incompliant). That status may transition in response to the receipt of an incoming compliancy event that is processed according to a rule set. The compliancy state record is associated with one or more compliancy object records storing data of the external data object. The generic structure of the compliancy model is agnostic to specific application data models of the services, thereby offering benefits of scalability that are compatible with modern microservice-based architectures.