Abstract: Embodiments herein provide a method for providing a service to an edge application (600). The method includes receiving, by a server (500), at least one of a request for accessing the service associated with a User Equipment (300) from the edge application (600), and a request for a user consent associated with the UE (300) from the edge application (600). The method includes retrieving, by the server (500), the user consent from the edge enabler client (100), where the user consent indicates a consent of a user of the edge enabler client (100) to provide at least one of the service and the user consent with the edge application (600). The method includes sending, by the server (500), at least one of the service and the user consent to the edge application (600).

Abstract: A system and method for noise reduction for cybersecurity alerts in a cloud computing environment is presented. The method includes receiving a plurality of cloud alerts, wherein each cloud alert in the plurality of cloud alerts includes an identifier of a cloud entity; initiating a fuzzy search based on the identifier of the cloud entity and a plurality of code objects stored in a code repository of the cloud computing environment; determining, based on a result of the fuzzy search, a probability that a code object of the plurality of code objects is associated with the cloud alert; removing the cloud alert from the cybersecurity monitoring system in response to determining that the probability exceeds a first predetermined threshold; and initiating a mitigation action in the cloud computing environment based on the cloud alert in response to determining that the probability is below a second predetermined threshold.

Abstract: Management of data layer synchronization for container images includes receiving a command and detecting at least one source data layer associated with a source container image in a source repository. A system extracts at least one identifier from the command. The system identifies the at least one identifier in manifest information of each container image of a set of container images. The system detects the source container image from the set of container images and detects the at least one source data layer of the source container image. The system synchronizes the at least one source data layer with the target data layer of the target container image.

Abstract: A system and a method are disclosed for providing recommendations for sets of security operations for improving security of documents created or executed within an online document system. A supplier entity may select sets of security operations to be performed for a request provided to a signing entity. The online document system computes an aggregate measure of security for the selected sets of security operations and compares it to a threshold measure of security. If the aggregate measure is less than the threshold measure, the online document system uses a machine-learned model to identify additional sets of security operations that when added, results in an updated aggregate measure of security greater than the threshold. The additional sets of security operations are presented to the supplier entity for inclusion within a security operation workflow in combination with the selected sets of security operations.

Abstract: An application function (AF) or network exposure function (NEF) requests authorization tokens to access policy control functions (PCF) from network repository function (NRF) for each AI/ML cycle, and receives a token that authorizes the AF to manage the quality of service (QoS) policy for the next AIML training cycle. Upon token validation, the AF sends a request to the NEF to reserve resources for an AF session. Upon authorization, the NEF sends a discovery request message to a binding support function (BSF) to discover PCFs serving WTRUs of an indicated group for the next AI/ML training cycle in the request from the AF. The BSF sends a discovery response to the NEF that comprises a list of the PCFs serving the identified WTRUs. The authorization tokens for PCF policy management on each PCF for the next AIML training cycle are then requested from the NRF.

Abstract: A system maintains values for secure connection settings for multiple registered users and restricts data resets. Upon receiving a reset request to reset the value of a particular secure connection setting for a specific user, trials are conducted each by: receiving the requested new value from the requesting device; and sending a validation request to a validation system, the validation request including, at least in part, the requested new value for the particular secure connection setting. If a reply from the validation system is deemed a repudiation of the requested new value, a trial count is tolled. If the trial count reaches a predetermined condition, trials are suspended, a denial message is sent to the requesting device, and the specific user is alerted of a attempt to alter their data.

Abstract: Techniques for providing consistent monitoring and analytics for security insights for network and security functions for a security service are disclosed. In some embodiments, a system/process/computer program product for providing consistent monitoring and analytics for security insights for network and security functions for a security service includes receiving a flow at a software-defined wide area network (SD-WAN) device; inspecting the flow to determine whether the flow is associated with a split tunnel; and monitoring the flow at the SD-WAN device to collect security information associated with the flow for reporting to a security service.

Abstract: An autonomous pentesting agent may execute an autonomous pentest of a network involving a password spraying operation and using a custom sequence of password candidates. The autonomous pentesting agent may execute an autonomous pentest of the network associated with multiple user accounts having access to respective network assets. The autonomous pentesting agent may obtain the custom sequence of password candidates for the user accounts based on character pattern tokens and environmental factors of the network. Each character pattern token may be associated with a set of character strings having a defined statistical probability of inclusion in a password that includes the character pattern token. The autonomous pentesting agent may perform the password spraying operation during the autonomous pentest. The password spraying operation may involve successive attempts to compromise a password of user accounts in accordance with the custom sequence of password candidates.

Abstract: Techniques are provided for data protection using policy-based digital vault rotation. One method comprises obtaining data to be stored; selecting one of multiple digital vaults; and storing the data in the selected digital vault, wherein a different one of the multiple digital vaults is selected using a rotation policy in response to rotation criteria being satisfied and wherein the data is moved to the selected different digital vault. The multiple digital vaults may comprise multiple digital vaults having different memory spaces on a given device and/or multiple digital vaults on different devices. The multiple digital vaults may only respond to a designated vault proxy service. An active digital vault may be identified using the rotation policy in response to a request for data and the data may be retrieved from the active digital vault and provided to a requester associated with the request.

Abstract: The present disclosure provides a database container configured to contain multiple data sources. A first command is received to add a new data source to the database container. In response, the new data source is created within the database container, where the database container acts as a parent such that the new data source inherits properties of the database container including a first set of access permissions. Display of the new data source is caused via the database container. The system receives a second command to link an existing data source residing outside the database container to the database container. In response, a view of the existing data source is created within the database container without containing the existing data source, causing the existing data source to retain a second set of access permissions different from the first set of access permissions.

Abstract: In some embodiments, a system/process/computer program product for flow metadata exchanges between network and security functions for a security service includes receiving a flow at a software-defined wide area network (SD-WAN) device; analyzing the flow to determine whether the flow is associated with a split tunnel, comprising: extracting meta data information associated with one flow of the flow to determine the meta data information, wherein the meta data information includes one or more of the following: a user identifier, an application identifier, and/or a device identifier; comparing the extracted meta data information with meta data information associated with a predetermined set of users, applications, and devices; and in the event that the extracted meta data information matches the meta data information associated with one or more of the predetermined set of users, applications, and devices, then determining that the one flow is associated with the split tunnel; and monitoring the flow at the SD-W

Abstract: Methods and systems for providing computer implemented services are disclosed. To provide the services, requests for access to resources may be sent. Prior to servicing requests that are received, the requests may be evaluated using a distributed consensus analysis process. The distributed consensus analysis process may take into account views of multiple devices regarding whether the requests can be validated. Requests that are validated via the distributed consensus analysis process may be honored.

Abstract: A method implemented in a computing system hosting a three-dimensional virtual reality world. The computer system stores a set of searchable records, each having: a searchable hash of at least a portion of personally identifiable information; and an encrypted identity, decryptable using an encryption key generated based at least in part on the searchable hash and a global key. In response to a search request identifying at least a portion of personally identifiable information as a search criterion, the computer system generates a hash of the search criterion, and finds a matching searchable record that has a searchable hash equal to the hash computed from the search criterion. An encryption key is computed based on the global key and the matched searchable record to decrypt an encrypted identity of a user having at least the portion of personally identifiable information that is the search criterion in the search request.

Abstract: A computing machine stores supervised computing resources and private computing resources. The computing machine facilitates tracking, by a supervision service, of activity of the computing machine with respect to a supervised computing resource of the supervised resources that is executing on the computing machine. The computing machine supports user privacy, by the supervision service, with respect to a private computing resource of the private computing resources that is executing on the computing machine.

Abstract: There is provided a computer-implemented method for establishing a communication channel for exchanging messages securely between an initiator device and an endpoint device using an intermediary server. The initiator device is in communication with the intermediary server via a first session encrypted according to a cryptographic protocol. The endpoint device is in communication with the intermediary server via a second session encrypted according to a cryptographic protocol. A request for a handover token via the first session is sent to intermediary server. The handover token includes data that has been generated at the endpoint device and is configured to be used in setting up the communication channel between the initiator device and the endpoint device. The handover token is received from the intermediary server via the first session encrypted according to a cryptographic protocol. The communication channel is established between the initiator device and the endpoint device.

Abstract: A system for securely transmitting data between two devices is disclosed. Each device comprises an interface, an encryption module, a decryption module and a message authentication code (MAC) generator. The encryption and decryption modules may utilize a stream cipher, while the MAC generator utilizes a hashing algorithm. A MAC is transmitted after a predetermined amount of time, regardless of the amount of activity on the interface. The device receiving the MAC compares it to the MAC that it generated to ensure that they match. This guarantees that a breach of integrity can be detected in a reasonable amount of time and addressed accordingly. This system may utilize an interface having bidirectional data signals or unidirectional data signals.

Abstract: There is provided a computer-implemented method of reinforcement learning for training a machine learning model configured to provision and/or deprovision virtual application instances of an application in a distributed compute network having one or more compute nodes, the method being performed by at least one hardware processor and the method comprising: a) defining an action space for a training environment representative of the distributed compute network, the training environment having a plurality of states and, for each state, one or more available actions in the action space, each action being operable to transition the distributed compute network in the training environment from a current state to a new state; b) selecting one or more available actions in the action space to define a new state; c) determining a reward for the one or more selected actions based upon a predicted change in load characteristics for the distributed compute network in the training environment in moving from the current sta

Abstract: A method for extending a memory isolation domain includes allocating memories of multiple isolation domains, where the multiple isolation domains are in a correspondence with N protection keys and M extended page tables. When a first application is allowed to access a memory of a first isolation domain, the method further includes determining, based on the correspondence, a first protection key and a first extended page table that correspond to the first isolation domain, where the multiple isolation domains include the first isolation domain, the N protection keys include the first protection key, and the M extended page tables include the first extended page table. The method further includes enabling access permission for the first isolation domain based on the first protection key and the first extended page table, for the first application to access the memory of the first isolation domain.

Abstract: Methods and systems for data security are provided. The method includes generating respective tags for data segments in a dataset, deriving respective temporal keys associated with the respective tags for the plurality of data segments from a master key, and transforming the plurality of data segments from a plaintext to a ciphertext using the respective temporal keys as a first input and the respective tags as a second input, while format-preserving the data segments. The master key can be updated to prevent from reverse-transforming a selected data segment in the dataset from the ciphertext to the plaintext.

Abstract: A data deidentification system that extracts insights from user data and retains both the insights and user data in a form that complies with applicable data privacy and related standards. The system receives user data, which can include personal identifying information and other sensitive data governed by one or more standards, including standards specifying how the data can be used and how long it can be retained. From the data, the system extracts insights characterizing various aspects of the associated users. The system also selectively hashes portions of the data, obscuring the identity of associated users. Neither the insights nor the selectively hashed data identify individual users, and therefore they are not subject to the same standards and can be retained indefinitely. Later, after the standards-protected data has been discarded, the system can provide insight information in response to a request.