Abstract: A global policy store, in which policies applicable to multiple applications in an enterprise environment can be stored, can be stored in association with that environment. An application-level policy combining algorithm can be associated with a specific application to resolve conflicts between the results of evaluating policies that pertain to that application's resources. A persistent model is defined for an Extensible Access Control Markup Language (XACML) target definition.

Abstract: The present disclosure relates to methods and devices, of activating lawful interception. According to the present disclosure, a gateway comprises a controller for controlling, using a flow control protocol, the flow of packets through a switch controlled by the gateway. The switch receives (S11), from the controller, a lawful interception activation request, comprising a target identity; activates (S12), in response to said request, lawful interception on a target identified by the target identity; duplicates (S13), in the switch, packets targeting the target; encapsulates (S14) the duplicated packets with an additional header; and forwards (S15) duplicates from the switch directly to the lawful interception service provider entity (1) for further distribution to a Lawful interception Agency.

Abstract: A method of transmitting data within a vehicle includes: storing two copies of a data message; constructing at an electronic control unit (ECU) a serial bus message that includes one copy of the data message and a message authentication code (MAC) created using a secret key stored at the ECU, a MAC algorithm, and a different copy of the data message; transmitting the serial bus message to a receiving ECU over a vehicle bus; authenticating the serial bus message at the receiving ECU using a copy of the key stored at the receiving ECU by creating a copy of the MAC from the data message included in the serial bus message and the copy of the key; comparing the MAC from the serial bus message with the copy of the MAC created at the receiving ECU; and rejecting or accepting the data message based on the comparison.

Abstract: In representative embodiments keys used in authentication are removed from local systems and stored on a key server system. When keys are needed for authentication, requests are routed to the key server system. In some embodiments, the keys do not leave the key server system and the key server system performs requested operations using the keys. In other embodiments, secure protocols are used to temporarily allow the local system to retrieve and use the key. In this latter situation, keys are not maintained on the local system.

Abstract: Methods, computer program products, computer systems, and the like, which protect messages in an electronic messaging system, are disclosed. The methods, computer program products, computer systems, and the like include detecting an occurrence of an event, and, in response to the detecting the occurrence of the event, scanning a message. The occurrence of the event indicates that the message should be scanned. The message includes recipient information, which identifies a recipient of the message, and is stored in a message store. The message has been received at a message destination associated with the recipient. The scanning uses a malware definition. The scanning is performed prior to the message being retrieved from the message store in response to a request by the recipient to retrieve the message from the message store. The event is other than the request by the recipient to retrieve the message from the message store.

Abstract: An apparatus and method for generating an application container are provided. The method includes selecting a target application from among a plurality of applications included in an electronic device, acquiring a policy file corresponding to the target application, determining whether the policy file includes a category of the target application, and executing the application container which includes the target application.

Abstract: The disclosed computer-implemented method for disseminating location-based reputations for link-layer wireless attacks may include (i) receiving, at a server from a first wireless client, a wireless-attack report for a location that includes (a) information that indicates that the first wireless client detected a link-layer wireless attack (e.g., a wireless-access-point spoofing attack or a deauthentication attack) at the location or (b) information that indicates that the first wireless client did not detect any link-layer wireless attacks at the location, (ii) using, at the server, the wireless-attack report to generate a reputation for link-layer wireless attacks for the location, (iii) receiving, at the server from a second wireless client, a request for the reputation of the location, and (iv) responding to the request with the reputation of the location. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: Systems and methods for managing network security events with the assistance of augmented reality are provided. According to one embodiment, a reality image of a network object is captured by an augmented reality device. The network object is identified from the reality image by the augmented reality device. Dynamic network security information is received by the augmented reality device from a network security appliance associated with a network that is managing the network object. An augmented overlay image is generated by the augmented reality device based on the reality image and the dynamic network security information. The augmented overlay image is displayed by the augmented reality device.

Abstract: The disclosed computer-implemented method for detecting modification attacks on shared physical memory may include (i) identifying a page frame of physical memory that is shared by a plurality of virtual machines, (ii) calculating a first checksum for the page frame, (iii) calculating, while the page frame is shared by the plurality of virtual machines and before any of the plurality of virtual machines writes to a page of virtual memory that is mapped to the page frame, a second checksum for the page frame, (iv) detecting a modification attack (such as a rowhammer attack) on the page frame by one of the plurality of virtual machines by detecting that the first checksum does not equal the second checksum, and (v) performing a security action in response to detecting the modification attack. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: A method for sharing data from within a secure network perimeter includes providing a sharing folder associated with a first user for transferring data therefrom to destinations outside the secure perimeter. Data stored within the sharing folder is stored in a secured fashion. Semi-trusted applications are provided an ability to retrieve the secured data in a unsecured fashion for sharing of same. The semi-trusted applications are other than able to retrieve and share secured data from at least a folder other than the sharing folder in unsecured form.

Abstract: A method and system for regulating access by an access program to a data object residing in a storage system, which may be used to protect against data theft in a storage server. The storage server receives, from a client node, a certificate request for a certificate pertaining to access of the data object by the access program. The storage server validates the certificate request and in response, generates the certificate and transmits the certificate to the client node. The certificate request and the certificate each include a signature of the access program and an identifier of the data object. The storage server receives from the client node an I/O request for access of the data object by the access program. The storage server determines whether the I/O request is valid or invalid and processes the I/O request with privileged handling or degraded handling, respectively.

Abstract: Example embodiments of the present invention relate to a method, a system, and a computer program product for data recovery from an unavailable peer node of a plurality of peer nodes in a network detected as unavailable. The method includes recovering from neighboring peer nodes of the plurality of peer nodes in the network neighboring the unavailable peer node a fragment of a data object distributively stored to the unavailable peer node.

Abstract: According to one embodiment, a system includes a processing circuit and logic integrated with and/or executable by the processing circuit. The logic is configured to cause the processing circuit to generate a multi-context ADPL tag unique to a pair of data socket descriptors on which data is to be received and/or transmitted by a first application instance operating on the system and a second application instance operating on a second host. The logic is also configured to cause the processing circuit to embed the ADPL tag as part of an application payload in response to the first application instance calling an API configured to transmit the application payload out from the system via a sender data socket descriptor. More systems, methods, and computer program products are described in accordance with other embodiments.

Abstract: A system and method for providing a secured connection between servers on a local area network (LAN) and clients on a wide area network (WAN) via a de-militarized zone (DMZ). The system includes a Service, a LAN Server, a LAN Controller, a DMZ Server and a DMZ Stack Pool Service. The method includes establishing an outbound TCP-based connection to the DMZ Stack Pool Service based on a request; passing Client Connection Information to the LAN Server; generating a first connection to the Service and a second connection to the DMZ Server, wherein the LAN server creates a Connection Binder between the Service and the outbound connections; creating a Connection Binder that binds the incoming Request and the outbound connection to complete the route of the Request; streaming the Request through the DMZ Server and the LAN Server; and streaming the request data from the Service to the Client.

Abstract: A method and system of conducting a cryptocurrency payment via a mobile device, using a contactless token to store and protect a user's secret key. A cryptocurrency wallet encrypted with the secret key is received by the mobile device from the token. A cryptocurrency payment instruction is received by the mobile device, prompting for a user credential to approve the instruction. In response the mobile device sends to the token a message comprising the encrypted wallet together with the payment instruction and the user credential. Using the secret key, the token then decrypts the cryptocurrency wallet from the encrypted wallet and creates a payment transaction by digitally signing the payment instruction, and transmitting the payment transaction to a cryptocurrency network or exchange. Confirmation of the transaction requires either a PIN, biometric or fingerprint on the mobile device, or authentication via button press, PIN or fingerprint on the token.

Abstract: In a general aspect, shared secrets for lattice-based cryptographic protocols are generated. In some aspects, a public parameter (a) is obtained, where the public parameter is an array defined for a lattice-based cryptography system. A first secret value (s) and a second secret value (b) are obtained. The first secret value is a second array defined for the lattice-based cryptography system, and is generated based on sampling an error distribution. The second secret value is a third array defined for the lattice-based cryptography system, and is a product of the first and second arrays (b?as). A public key ({circumflex over (b)}) is then generated by applying a compression function to the second secret value (b), and the public key is sent to an entity. A shared secret (?) is then generated based on information received from the entity in response to the public key.

Abstract: A system for verifying applications for Real-Time Execution (RTE) devices is provided. The system includes a memory, at least one processor coupled to the memory, and a simulation component executable by the at least one processor. The simulation component may be configured to receive device simulation information for an RTE device, the device simulation information including device configuration information, application information, and targeted performance information, configure a virtual device simulator to simulate performance of the RTE device, run the virtual device simulator to process one or more simulated events, and output simulation results.

Abstract: Network access control systems and methods are provided herein. A method includes receiving at a network device a SYN packet from a client device over a network, determining if the client device is a trusted source for the network using the SYN packet, if the client device is a trusted resource, receiving an acknowledgement (ACK) packet from the client device that includes identifying information for the client device plus an additional value, and identifying information for the network device, and establishing a connection with the network for the client device.

Abstract: A method in a wireless sensing device for authenticating a gateway device of a sensor network is described. The method includes receiving a certificate where the certificate was generated by the management server upon a determination that the gateway device and the wireless sensing device are associated and is a digital document including data and a digital signature, where the digital signature was generated by the management server based on the data and a private key of the management server, and where the data includes a first identifier and a second identifier; confirming that the wireless sensing device is authorized to upload data to the gateway device; in response to the confirming that the wireless sensing device is authorized to upload data to the gateway device, uploading to the gateway device data indicative of a plurality of sensor measurements taken over time to be transmitted to the management server.

Abstract: Examples of techniques for authenticating mobile applications are described herein. A method can include receiving, by a processor, a key pair and a policy file associated with a mobile service. The processor can receive a service request from a mobile application at a security gateway. The processor can detect that the service request includes an invalid or missing access token. The processor can redirect the mobile application to request a grant token from an authorization end point on a server. The processor can receive a grant token request from the mobile application and forward the grant token request to the server based on a policy file, the policy file including a list of: a plurality of security objects to be authenticated, a plurality of computing devices to authenticate the security objects, and an order of authentication.