Abstract: Generative artificial intelligence models receive prompts as input. The prompts can be augmented using contextual data retrieved by a retrieval-augmented generation process. Including sensitive data in a prompt or in contextual data can compromise the security of the sensitive data by exposing proprietary information to the respective generative artificial intelligence model. The sensitive data can be secured while remaining useful as contextual data using a secure augmentation logic. The secure augmentation logic receives sensitive data related to a plurality of entities and generates a knowledge graph that encodes relationships among the entities. The secure augmentation logic consistently anonymizes one or more entities in the knowledge graph according to a sensitive data anonymization policy. The secure augmentation logic generates a set of data representations based on the consistently anonymized knowledge graph.

Abstract: Techniques that facilitate multiple sentinels for securing communications are provided. In one example, a system communicates with at least one multi-purpose device configured to communicate with one or more sources, at least one computing device configured to communicate with a defined source that is different than the one or more sources, and at least one security sentinel that manages one or more security processes for a communication network associated with the at least one multi-purpose device and the at least one computing device. The system also manages one or more other security processes for the communication network associated with the at least one multi-purpose device and the at least one computing device.

Abstract: Embodiments of the present disclosure provide a communication method and apparatus, applied to nodes supporting short-range communication, for example, Bluetooth nodes or nodes in an in-vehicle short-range communication system. The method includes receiving an association request message from a second node and determining a group key of a first communication group. The first communication group is a communication group to which the second node belongs. The method further includes encrypting the group key of the first communication group, based on a shared key between a first node and the second node, to obtain a first protection key and sending a first association establishment message to the second node. The first association establishment message includes a first protection key.

Abstract: Embodiments herein provide a method for providing a service to an edge application (600). The method includes receiving, by a server (500), at least one of a request for accessing the service associated with a User Equipment (300) from the edge application (600), and a request for a user consent associated with the UE (300) from the edge application (600). The method includes retrieving, by the server (500), the user consent from the edge enabler client (100), where the user consent indicates a consent of a user of the edge enabler client (100) to provide at least one of the service and the user consent with the edge application (600). The method includes sending, by the server (500), at least one of the service and the user consent to the edge application (600).

Abstract: A system and method for noise reduction for cybersecurity alerts in a cloud computing environment is presented. The method includes receiving a plurality of cloud alerts, wherein each cloud alert in the plurality of cloud alerts includes an identifier of a cloud entity; initiating a fuzzy search based on the identifier of the cloud entity and a plurality of code objects stored in a code repository of the cloud computing environment; determining, based on a result of the fuzzy search, a probability that a code object of the plurality of code objects is associated with the cloud alert; removing the cloud alert from the cybersecurity monitoring system in response to determining that the probability exceeds a first predetermined threshold; and initiating a mitigation action in the cloud computing environment based on the cloud alert in response to determining that the probability is below a second predetermined threshold.

Abstract: Management of data layer synchronization for container images includes receiving a command and detecting at least one source data layer associated with a source container image in a source repository. A system extracts at least one identifier from the command. The system identifies the at least one identifier in manifest information of each container image of a set of container images. The system detects the source container image from the set of container images and detects the at least one source data layer of the source container image. The system synchronizes the at least one source data layer with the target data layer of the target container image.

Abstract: An application function (AF) or network exposure function (NEF) requests authorization tokens to access policy control functions (PCF) from network repository function (NRF) for each AI/ML cycle, and receives a token that authorizes the AF to manage the quality of service (QoS) policy for the next AIML training cycle. Upon token validation, the AF sends a request to the NEF to reserve resources for an AF session. Upon authorization, the NEF sends a discovery request message to a binding support function (BSF) to discover PCFs serving WTRUs of an indicated group for the next AI/ML training cycle in the request from the AF. The BSF sends a discovery response to the NEF that comprises a list of the PCFs serving the identified WTRUs. The authorization tokens for PCF policy management on each PCF for the next AIML training cycle are then requested from the NRF.

Abstract: A system and a method are disclosed for providing recommendations for sets of security operations for improving security of documents created or executed within an online document system. A supplier entity may select sets of security operations to be performed for a request provided to a signing entity. The online document system computes an aggregate measure of security for the selected sets of security operations and compares it to a threshold measure of security. If the aggregate measure is less than the threshold measure, the online document system uses a machine-learned model to identify additional sets of security operations that when added, results in an updated aggregate measure of security greater than the threshold. The additional sets of security operations are presented to the supplier entity for inclusion within a security operation workflow in combination with the selected sets of security operations.

Abstract: A system maintains values for secure connection settings for multiple registered users and restricts data resets. Upon receiving a reset request to reset the value of a particular secure connection setting for a specific user, trials are conducted each by: receiving the requested new value from the requesting device; and sending a validation request to a validation system, the validation request including, at least in part, the requested new value for the particular secure connection setting. If a reply from the validation system is deemed a repudiation of the requested new value, a trial count is tolled. If the trial count reaches a predetermined condition, trials are suspended, a denial message is sent to the requesting device, and the specific user is alerted of a attempt to alter their data.

Abstract: Techniques for providing consistent monitoring and analytics for security insights for network and security functions for a security service are disclosed. In some embodiments, a system/process/computer program product for providing consistent monitoring and analytics for security insights for network and security functions for a security service includes receiving a flow at a software-defined wide area network (SD-WAN) device; inspecting the flow to determine whether the flow is associated with a split tunnel; and monitoring the flow at the SD-WAN device to collect security information associated with the flow for reporting to a security service.

Abstract: An autonomous pentesting agent may execute an autonomous pentest of a network involving a password spraying operation and using a custom sequence of password candidates. The autonomous pentesting agent may execute an autonomous pentest of the network associated with multiple user accounts having access to respective network assets. The autonomous pentesting agent may obtain the custom sequence of password candidates for the user accounts based on character pattern tokens and environmental factors of the network. Each character pattern token may be associated with a set of character strings having a defined statistical probability of inclusion in a password that includes the character pattern token. The autonomous pentesting agent may perform the password spraying operation during the autonomous pentest. The password spraying operation may involve successive attempts to compromise a password of user accounts in accordance with the custom sequence of password candidates.

Abstract: Techniques are provided for data protection using policy-based digital vault rotation. One method comprises obtaining data to be stored; selecting one of multiple digital vaults; and storing the data in the selected digital vault, wherein a different one of the multiple digital vaults is selected using a rotation policy in response to rotation criteria being satisfied and wherein the data is moved to the selected different digital vault. The multiple digital vaults may comprise multiple digital vaults having different memory spaces on a given device and/or multiple digital vaults on different devices. The multiple digital vaults may only respond to a designated vault proxy service. An active digital vault may be identified using the rotation policy in response to a request for data and the data may be retrieved from the active digital vault and provided to a requester associated with the request.

Abstract: The present disclosure provides a database container configured to contain multiple data sources. A first command is received to add a new data source to the database container. In response, the new data source is created within the database container, where the database container acts as a parent such that the new data source inherits properties of the database container including a first set of access permissions. Display of the new data source is caused via the database container. The system receives a second command to link an existing data source residing outside the database container to the database container. In response, a view of the existing data source is created within the database container without containing the existing data source, causing the existing data source to retain a second set of access permissions different from the first set of access permissions.

Abstract: In some embodiments, a system/process/computer program product for flow metadata exchanges between network and security functions for a security service includes receiving a flow at a software-defined wide area network (SD-WAN) device; analyzing the flow to determine whether the flow is associated with a split tunnel, comprising: extracting meta data information associated with one flow of the flow to determine the meta data information, wherein the meta data information includes one or more of the following: a user identifier, an application identifier, and/or a device identifier; comparing the extracted meta data information with meta data information associated with a predetermined set of users, applications, and devices; and in the event that the extracted meta data information matches the meta data information associated with one or more of the predetermined set of users, applications, and devices, then determining that the one flow is associated with the split tunnel; and monitoring the flow at the SD-W

Abstract: Methods and systems for providing computer implemented services are disclosed. To provide the services, requests for access to resources may be sent. Prior to servicing requests that are received, the requests may be evaluated using a distributed consensus analysis process. The distributed consensus analysis process may take into account views of multiple devices regarding whether the requests can be validated. Requests that are validated via the distributed consensus analysis process may be honored.

Abstract: A method implemented in a computing system hosting a three-dimensional virtual reality world. The computer system stores a set of searchable records, each having: a searchable hash of at least a portion of personally identifiable information; and an encrypted identity, decryptable using an encryption key generated based at least in part on the searchable hash and a global key. In response to a search request identifying at least a portion of personally identifiable information as a search criterion, the computer system generates a hash of the search criterion, and finds a matching searchable record that has a searchable hash equal to the hash computed from the search criterion. An encryption key is computed based on the global key and the matched searchable record to decrypt an encrypted identity of a user having at least the portion of personally identifiable information that is the search criterion in the search request.

Abstract: A computing machine stores supervised computing resources and private computing resources. The computing machine facilitates tracking, by a supervision service, of activity of the computing machine with respect to a supervised computing resource of the supervised resources that is executing on the computing machine. The computing machine supports user privacy, by the supervision service, with respect to a private computing resource of the private computing resources that is executing on the computing machine.

Abstract: There is provided a computer-implemented method for establishing a communication channel for exchanging messages securely between an initiator device and an endpoint device using an intermediary server. The initiator device is in communication with the intermediary server via a first session encrypted according to a cryptographic protocol. The endpoint device is in communication with the intermediary server via a second session encrypted according to a cryptographic protocol. A request for a handover token via the first session is sent to intermediary server. The handover token includes data that has been generated at the endpoint device and is configured to be used in setting up the communication channel between the initiator device and the endpoint device. The handover token is received from the intermediary server via the first session encrypted according to a cryptographic protocol. The communication channel is established between the initiator device and the endpoint device.

Abstract: A system for securely transmitting data between two devices is disclosed. Each device comprises an interface, an encryption module, a decryption module and a message authentication code (MAC) generator. The encryption and decryption modules may utilize a stream cipher, while the MAC generator utilizes a hashing algorithm. A MAC is transmitted after a predetermined amount of time, regardless of the amount of activity on the interface. The device receiving the MAC compares it to the MAC that it generated to ensure that they match. This guarantees that a breach of integrity can be detected in a reasonable amount of time and addressed accordingly. This system may utilize an interface having bidirectional data signals or unidirectional data signals.

Abstract: There is provided a computer-implemented method of reinforcement learning for training a machine learning model configured to provision and/or deprovision virtual application instances of an application in a distributed compute network having one or more compute nodes, the method being performed by at least one hardware processor and the method comprising: a) defining an action space for a training environment representative of the distributed compute network, the training environment having a plurality of states and, for each state, one or more available actions in the action space, each action being operable to transition the distributed compute network in the training environment from a current state to a new state; b) selecting one or more available actions in the action space to define a new state; c) determining a reward for the one or more selected actions based upon a predicted change in load characteristics for the distributed compute network in the training environment in moving from the current sta