Abstract: Methods, systems, and computer storage media for providing unified device management using a unified device management engine of a device management system are described. Device management refers to administering, controlling, and maintaining various types of computing devices. The unified device management engine provides a unified policy object that supports unified management of a remote client and a local client using a unified policy. A unified policy object for a remote client and a local client is configured. The unified policy object is a combined management configuration that enables enforcement of a unified policy on both the remote client and the local client. The unified policy is communicated to the remote client. Unified device management data associated with the unified policy, the remote client, and the local client is generated. The unified device management data is communicated to cause display of the unified device management data on a device management interface.

Abstract: The disclosed apparatus, systems and methods relate to methods, systems, and devices for the isolation of devices on a LAN network. Route poisoning, ARP poisoning null routing, blackhole and/or firewall blocking are employed to prevent peer-to-peer network communications within the local area network.

Abstract: An event handler implements a state machine or similar construct for processing of complex event chains as incremental events are detected. This approach advantageously limits processing to monitoring for and responding to a next event in a sequence of events, and supports complex event detection in a manner that scales efficiently in time and computation.

Abstract: A system automates user-specific performance customization in software controlled across multiple devices by conducting current user sessions in which programs are run and user interfaces are displayed at least in part controlled by user-specific program-specific configuration files. The system receives user commands across a network connection from user devices. The user commands include runtime instructions for the specific running programs for which actions are performed accordingly. The system automatically updating user-specific historical data according to received user requests and/or received user commands. Upon initiating a subsequent user session of any specific user, performance attributes of that user session are controlled according at least in part to the updated user-specific historical data in the user-specific profile.

Abstract: Examples include techniques for a trusted execution environment (TEE) at a compute server to request a service to be performed by an accelerator that is located at or with a service server. Examples are described of the TEE at the compute server authenticating the remote accelerator to enable establishment of one or more secure communication sessions for the accelerator to decrypt encrypted data, perform a transformation on the decrypted data and then re-encrypt the transformed data. Examples are also described of the TEE at the compute server authenticating a service TEE at the service server as well as the accelerator to enable the service TEE and the accelerator to collaboratively decrypt encrypted data, perform a transformation on the decrypted data and then re-encrypt the transformed data.

Abstract: The method for authenticating a first device, the method including receiving RF signals from the first device, acquiring feature data from the received RF signals, fitting a model for authenticating the first device using the acquired feature data, storing in memory the fitted model in a second device, and, by the second device receiving a new RF signal from a device to authenticate, acquiring feature data from the new RF signal, and determining whether or not the device to authenticate is the first device by transmitting the feature data, acquired from the new RF signal, as input to the fitted model, the feature data acquired from a RF signal includes values of only one of an in-phase component and a quadrature component of the RF signal over time.

Abstract: A system can include one or more memory devices storing instructions executed by one or more processors. The one or more processors can receive a public key of a device of an industrial automation system corresponding to a private key of the device. The one or more processors can receive a request to grant the device a license to enable a feature of the device or access a feature of the industrial automation system. The one or more processors can generate a certificate including the public key of the device and an indication of the license in a non-encrypted format. The one or more processors can transmit the certificate to the device to cause the device to enable the feature of the device or access the feature of the industrial automation system responsive to the device proving possession of the private key corresponding to the public key in the certificate.

Abstract: Systems and methods are described for providing a secure network connection between a serverless instance and an external environment with respect to a serverless execution environment hosting the serverless instance. A secure connection management system may be implemented in a serverless execution environment with at least one host device hosting the one or more function execution environments. The secure connection management system may facilitate establishment and management of a secure network connection between the serverless instance and the external environment in accordance with the connection configuration. The secure connection management system may also be isolated from the function execution environments in a separate execution environment such that the secure connection management system may take action to reduce risk to the external environment against issues with the execution of serverless function code on the serverless instance.

Abstract: A request to access a destination device associated may be received from a user device. The request may comprise a digital certificate. The digital certificate may comprise a public key of the user device. A distributed ledger address of the user device may be determined by applying a deterministic function to the public key of the user device. A distributed ledger entry may be created on a distributed ledger. The distributed ledger entry may comprise the address of the user device. Based on the distributed ledger entry, access to the destination device may be granted to the user device.

Abstract: Various aspects of the present disclosure generally relate to wireless communication. In some aspects, a network entity may receive, from a security service device, a middlebox security policy, wherein the middlebox security policy is associated with a user equipment (UE) and a service device, and wherein the middlebox security policy indicates a set of authorization policies relating to one or more of the UE or the service device. The network entity may receive a communication on a communication link between the UE and the service device. The network entity may transmit the communication in accordance with the middlebox security policy. Numerous other aspects are described.

Abstract: An incremental micro-segmentation system includes a shared network and a network control device. The network control device is configured to perform operations of: retrieving multiple key values from a network flow; adding the multiple key values to be a policy rule of a temporary policy group based on an interested attribute of the temporary policy group of a candidate policy group set; computing a group score of each temporary policy group according to a recommended factor; when determining that the group score is greater than a threshold, generating a recommendation set including the temporary policy groups; and deploying the recommendation set to an access control list to make the temporary policy groups be enforced.

Abstract: A method of device deployment includes steps as follows. Each of a plurality of receiving devices executes a Bluetooth low energy mode when being booted initially. Any one individual receiving device in the plurality of receiving devices decrypts a plurality of sub-encrypted messages repeatedly sent by a sending device executing the Bluetooth low energy mode, so as to generate a message of mass deployment setting corresponding to the plurality of sub-encrypted messages. The individual receiving device executes a subsequent deployment according to the message of mass deployment setting after the individual receiving device is booted initially.

Abstract: A method for managing licensed content includes receiving an encrypted license file and a pre-shared key (PSK) from a deployment package and decrypting the encrypted license file using the PSK to obtain license file content. The method further includes sending the license file content to a secure license generator, obtaining a locking ID associated with an edge device, and encrypting the license file content using the locking ID to obtain a locking ID license file, wherein the locking ID is usable to access the locking ID license file. Finally, the method includes deleting the PSK and the encrypted license file, wherein, based on the deleting, the deployment package comprises a software product file and the locking ID license file.

Abstract: A method and system for reducing triggering of throughput penalties imposed on a group of users by a software-as-a-service (SaaS) server due to Application Programming Interface (API) calls exceeding limits of the SaaS server. The approaches include intercepting requests to the SaaS server from a user group and monitoring a rate of API calls the API calls forwarded to the SaaS server, identifying one or more power users based on a notification threshold value for the user group, and managing the rate of the API calls for the requests submitted by the identified power users of the user group in accordance with an API call throttle limit, thus remediating triggering of the throughput penalty.

Abstract: Systems and techniques may generally be used for provisioning local storage data object containers. A public-facing interface may receive a satisfaction identifier for a data object axiom instrument and may acquire user consent acknowledging ephemeral disclosure of recovery credentials to initiate a satisfaction workflow. A service layer may validate the identifier against a satisfaction ledger and may orchestrate the workflow by issuing a satisfy command to another service layer. The service layer, isolated from public ingress, may generate container key material defining a destination address and may construct and sign a transfer to the address. A network broadcast interface may submit the transfer to a blockchain network. An ephemeral disclosure module may present the recovery credentials in a disclosure viewport with a countdown timer. Upon expiry, the credentials may be zeroized and subsequent disclosure may be prevented, enforcing a policy of no server-side persistence.

Abstract: Disclosed herein is a method for defining a model of a trusted IoT security gateway architecture based on a microhypervisor, wherein evaluation of the model provides a guarantee that the correct security protections are applied to each IoT device's network traffic at all times, including when under attack. The models defined in accordance with the method disclosed herein are used to verify security gateway architectures that provide robust trust properties to a broad range of legacy hardware platforms utilizing existing software with a reasonable performance overhead.

Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for securely certifying products in an ecosystem. In some implementations, a digital platform receives a user request to access digital models. The digital platform determines whether the user is authorized to access the digital models. In response, the digital platform generates a transaction request to send to a location of the digital models, wherein the transaction request comprises data identifying operations to perform using the digital models. The digital platform transmits, to the location of the digital models, the generated transaction request that causes execution of the operations. The digital platform receives data representative of a result of the operations performed. The digital platform provides, to a user interface of the user device, the data representative of the result. The digital platform audits the data related to the transaction request and the data representative of the result.

Abstract: A method for role-based access control recommendation includes obtaining one or more security logs from a security analytics platform. The method includes determining access rights to the one or more security logs for one or more users of the security analytics platform. The determining includes generating one or more clusters of security logs based on the one or more security logs. The determining includes providing, to a user of the security analytics platform, a recommendation for a first data access group for the security analytics platform based on a first cluster of the one or more clusters. The determining includes, responsive to input from the user of the security analytics platform, generating the first data access group for the security analytics platform based on the first cluster of the one or more clusters.

Abstract: A method for generating a secure secret key, includes the following steps: A. receiving, in a communication station referred to as the transmitting station, a first secret key by way of a quantum encryption channel via satellite, the first secret key also being transmitted to at least one other communication station by way of the quantum encryption channel; B. generating, in the transmitting station, a second secret key using a trusted random number generator; C. generating an encrypted secret key using the first secret key and the second secret key by the one-time pad method; D. transmitting the encrypted secret key from the transmitting station to the one or more other communication stations.

Abstract: Systems and methods for workspace orchestration based on contributor scores are described. In an illustrative, non-limiting embodiment, an Information Handling System (IHS) may include a processor and a memory coupled to the processor, the memory having program instructions stored thereon that, upon execution by the processor, cause the IHS to: receive, at a local management agent from a workspace orchestration service, one or more files configured to enable the local management agent to instantiate a workspace based, at least in part, upon an aggregated contributor score; and instantiate the workspace.