Abstract: A method to enforce security on a device by a device management client running on the device is provided. The method includes receiving a base product-platform profile of the device during a boot-up process of the device. The base product-platform profile indicates one or more control parameters of the device set at a time of installation of an application stack on the device. The method further includes comparing the one or more control parameters in the base product-platform profile with corresponding one or more control parameters in a real-time product-platform profile of the device. The method further includes detecting an attack to the device based on at least one of the one or more control parameters in the base product-platform profile being different from a corresponding control parameter in the real-time product-platform profile.

Abstract: Example methods are provided for flow-based forwarding element configuration in a network environment. An example method may comprise obtaining a set of security policies associated with the group of workloads; and based on the set of security policies, identifying an allowed forwarding path between a destination and a first workload. The method may also comprise configuring a whitelist set of flow entries and sending configuration information to the flow-based forwarding element to cause the flow-based forwarding element to apply the whitelist set. The whitelist set may include a first flow entry specifying match fields and a first action to allow communication over the allowed forwarding path, but excludes a second flow entry specifying a second action to block communication over a forbidden forwarding path between the destination and the second workload. The match fields may include transport layer information and network layer information.

Abstract: The present disclosure relates to a building management system (BMS) configured to communicate with a target system comprising a plurality of target devices to identify information pertaining to parameters of the plurality of target devices, analyze the information based on data feeds to identify a threat associated with at least one of the parameters, perform at least one test operation on the information to obtain test data, determine at least one of network traffic of at least one of the plurality of target devices, one or more firmware components of at least one of the plurality of target devices, or a configuration deployed on at least one of the plurality of target devices and determine a system cyber health score of the target system based on device cyber health scores for the plurality of target devices, wherein the system cyber health score is based on the least one of the test data, network traffic, threat, firmware components, or configuration.

Abstract: A method includes storing a golden copy of a device tree binary of a system in a trusted execution environment, identifying whether one or more parameters of a running copy of a device tree binary of the system are different from corresponding parameters of the golden copy by comparing the running copy with the golden copy, and performing a corrective action responsive to an indication that at least one of the one or more parameters of the running copy are different from the corresponding parameters of the golden copy.

Abstract: The present disclosures are directed to a silane coupling agent, two silane functional polymers, a method of making a silane coupling agent, the use of a silane coupling agent for making a silane functional polymer, a method of making a silane functional polymer by removing a protecting group, and a composition comprising one or more silane functional polymers.

Abstract: A building device of a building includes or is in communication with a processing circuit configured to store one or more files, each of the one or more files comprising instructions and a ledger, the ledger comprising information describing at least one of the one or more files. The processing circuit is configured to verify the one or more files by retrieving a root ledger from storage of the processing circuit, wherein the root ledger comprises information based on one or more characteristics of a blockchain, reassembling the blockchain based on the ledger of each of the one or more files, verifying the blockchain with the root ledger, and verifying the one or more files with the verified blockchain. The processing circuit is configured to execute the instructions of the one or more files in response to a determination that the one or more files are verified.

Abstract: A system for predicting the vulnerability of a building management system (BMS) includes one or more memory devices configured to store instructions that, when executed on one or more processors, cause the one or more processors to establish a first communication link to a first data source and receive a first data using a communication module communicatively coupled to the processor. The first data includes information related to at least one of a plurality of IoT-enabled devices. The system is further configured to generate a historical record composed of a plurality of received data feeds received from a plurality of data feeds at unanticipated time intervals and analyze at least one of the plurality of data feeds with at least one or more of: the first data, the historical record, and another of the plurality of data feeds to predict the vulnerability of the BMS.

Abstract: A system and method of communicating between a hypervisor and virtual machines using object agents within the hypervisor and the virtual machines. Further, the hypervisor and virtual machines include similar datastore mappings that allow the hypervisor and virtual machines to communicate with each other. The object agent of a virtual machine communicates information corresponding to a first object to the object agent of the hypervisor, and the object agent of the hypervisor updates a datastore mapping of the hypervisor. The hypervisor then communicates the information corresponding to the first object to an object agent of another virtual machine.

Abstract: A building device of a building includes or is in communication with a processing circuit configured to store one or more files, each of the one or more files comprising instructions and a ledger, the ledger comprising information describing at least one of the one or more files. The processing circuit is configured to verify the one or more files by retrieving a root ledger from storage of the processing circuit, wherein the root ledger comprises information based on one or more characteristics of a blockchain, reassembling the blockchain based on the ledger of each of the one or more files, verifying the blockchain with the root ledger, and verifying the one or more files with the verified blockchain. The processing circuit is configured to execute the instructions of the one or more files in response to a determination that the one or more files are verified.

Abstract: A method includes storing a golden copy of a device tree binary of a system in a trusted execution environment, identifying whether one or more parameters of a running copy of a device tree binary of the system are different from corresponding parameters of the golden copy by comparing the running copy with the golden copy, and performing a corrective action responsive to an indication that at least one of the one or more parameters of the running copy are different from the corresponding parameters of the golden copy.

Abstract: The technology disclosed herein enables reduction of secure protocol overhead when transferring packets between guest elements on different hosts. In a particular embodiment, the method provides, in a first virtual network interface of a first guest element, receiving one or more first packets from a first guest element directed to a second guest element. In response to determining that the first packets will be encapsulated in a secure protocol having a first integrity check procedure provided for by the secure protocol, the method provides refraining to perform a transmit-side portion of a second integrity check procedure on the first packets as provided for by a transport protocol. The method further provides passing the first packets to a first host of the first virtual network interface in the transport protocol.

Abstract: Example methods are provided for flow-based forwarding element configuration in a network environment. An example method may comprise obtaining a set of security policies associated with the group of workloads; and based on the set of security policies, identifying an allowed forwarding path between a destination and a first workload. The method may also comprise configuring a whitelist set of flow entries and sending configuration information to the flow-based forwarding element to cause the flow-based forwarding element to apply the whitelist set. The whitelist set may include a first flow entry specifying match fields and a first action to allow communication over the allowed forwarding path, but excludes a second flow entry specifying a second action to block communication over a forbidden forwarding path between the destination and the second workload. The match fields may include transport layer information and network layer information.

Abstract: A system and method of communicating between a hypervisor and virtual machines using object agents within the hypervisor and the virtual machines. Further, the hypervisor and virtual machines include similar datastore mappings that allow the hypervisor and virtual machines to communicate with each other. The object agent of a virtual machine communicates information corresponding to a first object to the object agent of the hypervisor, and the object agent of the hypervisor updates a datastore mapping of the hypervisor. The hypervisor then communicates the information corresponding to the first object to an object agent of another virtual machine.

Abstract: This invention covers methods for isothermal amplification of DNA. It is based on the unexpected discovery that primers having, at some positions, adenine substituted by 2-aminopurine or diaminopurine, guanine by inosine, thymine by 2-thiothymine, and cytosine by N4-ethylcytosine (“substituted primers”) were accepted by enzymes used in the standard recombinase polymerase assay (RPA). Further unexpected was the discovery that target nucleotides are efficiently amplified in an RPA-like process (hereinafter abbreviated as simply RPA) using substituted primers. RPA-like processes were also discovered to amplify target DNA with substituted primers tagged with oligonucleotides incorporating nucleotides from an artificially expanded genetic information system (AEGIS).

Abstract: A paper feeder employs a retard roll mounted on a shaft that is controlled by a magneto rheological variable clutch. Current is adjusted to the magneto rheological variable clutch to produce a variable drag torque (from near zero to fully locked) on the retard roll. The current is adjusted based on various inputs, some of which include media type, temperature, humidity, media size, and transport speed. Variable drag on the retard roll results in a reduction in induced skew of sheet passing through a nip formed between the retard roll and a separation roll, as well as, less and more consistent wear of the retard roll.

Abstract: A paper feeder employs a retard roll mounted on a shaft that is controlled by a magneto Theological variable clutch. Current is adjusted to the magneto rheological variable clutch to produce a variable drag torque (from near zero to fully locked) on the retard roll. The current is adjusted based on various inputs, some of which include media type, temperature, humidity, media size, and transport speed. Variable drag on the retard roll results in a reduction in induced skew of sheet passing through a nip formed between the retard roll and a separation roll, as well as, less and more consistent wear of the retard roll.