Abstract: Disclosed is a method and device for dynamically adding a consensus node in a blockchain. The method comprises: receiving a registration request, initiated by a new participant, for registration as a new consensus node in a consensus network, wherein the registration request is used for initiating a registration to the consensus network; generating, according to the registration request, a network update block in which topological information of a new consensus network is written, wherein the new consensus network comprises consensus nodes in the consensus network and the new consensus node; and synchronizing block information in the consensus network and the network update block to the participant and the consensus nodes so as to obtain the new consensus network.

Abstract: Techniques for updating blockchains using a proof of work determined serially include receiving a block of data for inclusion in a new block of a blockchain; deterministically determining an initial nonce, hashing a combination of the block of data and the initial nonce to create a hashed value; iteratively deterministically determining an updated nonce based on a combination of the hashed value and updating the hashed value by hashing the updated nonce until the updated hashed value satisfies a proof of work criteria; creating the new block based on the block of data, the initial nonce, and the updated hashed value that satisfies the proof of work criteria; and having the new block stored in the blockchain.

Abstract: In a blockchain, contents of communication of electronic data are basically made public, and a malicious person can find system vulnerability of the blockchain. Leak of secret information or the like to an unintended third party through unauthorized access or the like by exploiting the vulnerability and cause is actually possible. Thus, it cannot be said that sufficient security measures are taken. In the present invention, a colony server stores partial data containing data of a predetermined size from a beginning of data to be managed received from a terminal, and a center server stores body data containing data of the predetermined size +1 and thereafter. Thus, the data to be managed is managed in a divided manner. Also, even if the body data is leaked from the colony server through unauthorized access or the like, the body data is merely part of the data to be managed, and has no value on its own.

Abstract: Disclosed herein are a method for protecting data for information centric in-network computing and a system using the same. The method includes: preparing, at a computing node, a an encryption key pool that includes a security key for sharing a symmetric key used for encrypting result data according to a user's request and matching information; preparing, at an INC agent receiving the user's request, a synchronization key pool for sharing the security key through the matching information; and creating, by the computing node, a processor for executing output processing of the result data and allocating a security key to the processor based on the matching information of the encryption key pool when a security key exists. The security key is allocated to the computing node which is determined to perform the request in the INC agent.

Abstract: Systems, methods, and computer program products for controlling access by applications to application data are provided. A computing device receives a request for access control data over a network and returns access control data to the requestor to control an applications access over the network to application data. The access control data returned to the requestor includes access-point dependent access control data to control the application's access to the application data based on the access point used to access the network.

Abstract: A wireless programmable digital chess clock having to a housing, a display mounted in the housing and operatively arranged to display time associated with a first player's clock and operatively arranged to display time associated with a second player's clock, a first switch mounted in the housing and operatively arranged to stop the first player's clock and start the second player's clock when activated; a second switch mounted in the housing and operatively arranged to stop the second player's clock and start the first player's clock when activated, a microcontroller operatively arranged to set and control the first and second players' clocks, and, a near field communication module, in communication with microcontroller, and operatively arranged to receive signals from an external transmitting device, where the signals are used to set the time on the first and second players' clocks.

Abstract: Systems and methods for peer-to-peer video streaming from an edge data storage device to a browser are described. A surveillance video camera may establish a secure peer-to-peer connection using a first data transfer protocol with a user device. Once the secure peer-to-peer connection is established with the user device, out of band key exchange may occur through the peer-to-peer connection. Then, a shared key may be generated at both the video camera and the user device such that a request for media from the user device may be sent to a relay server over a second data transfer protocol. The video camera may then send an encrypted data file responsive to the media request over the second data transfer protocol to the relay server.

Abstract: A system, method, and computer-readable medium having instructions thereon for a method is provided for cryptographically securing electronic transmissions, whether for standalone use on text or embedded in processor hardware. The making of and using enhanced 256-bit symmetric ciphers which are FIPS-compliant is provided for security of transmissions as well as of static information, i.e., data at rest.

Abstract: A method of multi-party computation, for processing and secure handing of a plurality of data associated with one or more users, comprising the steps of: providing a predetermined multi-party computation algorithm; each user being able to send a first dataset to a data processing unit via a respective second data processing unit distinct from the first data processing unit and in signal communication with the first data processing unit; each first dataset being associated with the user and comprising one or more encrypted numerical values; processing each first dataset that has been sent using at least one reference function residing in the first data processing unit to generate a respective encrypted result for each reference function; requesting the first data processing unit to send the result using a predetermined function shared by the users and a respective second data processing unit sending the result to the second requesting data processing unit; wherein the step of sending the first dataset comprise

Abstract: A storage cluster may dynamically select a data transport mode for supporting a backup or export job. The storage cluster may receive a trigger indication to create, a backup of data of a source virtual machine. The storage cluster may select a data transport mode to use for reading the data from the source virtual machine to create the backup at the storage cluster. The selection may be from a set of data transport modes that includes a proxy virtual machine mode and a direct-to-host mode. The storage cluster may transmit, to a host for the source virtual machine, a request to activate the selected data transport mode, and receive the data from the source virtual machine via the selected data transport mode. The storage cluster may use the data to create the backup.

Abstract: Apparatus and methods for extending functionality of memory controllers in a processor-based device are disclosed herein. In one aspect, a processor-based device provides a memory access intercept circuit that is communicatively coupled to a memory controller and a memory device. The memory access intercept circuit is configured to receive a memory write request that is directed to and received by the memory controller, and generates a write transaction identifier (ID) for the memory write request. The memory access intercept circuit then generates proxy write data containing the write transaction ID, and sends the proxy write data to the memory controller. The memory access intercept circuit subsequently intercepts the actual write data directed to the memory controller, and stores the write data in a write data buffer in association with the write transaction ID.

Abstract: Embodiments described herein provide for a voice biometrics system execute machine-learning architectures capable of passive, active, continuous, or static operations, or a combination thereof. Systems passively and/or continuously, in some cases in addition to actively and/or statically, enrolling speakers. The system may dynamically generate and update profiles corresponding to end-users who contact a call center. The system may determine a level of enrollment for the enrollee profiles that limits the types of functions that the user may access. The system may update the profiles as new contact events are received or based on certain temporal triggering conditions.

Abstract: We describe apparatuses, systems, method, reagents, and kits for conducting assays as well as process for their preparation. They are particularly well suited for conducting automated sampling, sample preparation, and analysis in a multi-well plate assay format. For example, they may be used for automated analysis of particulates in air and/or liquid samples derived therefrom in environmental monitoring.

Abstract: An information processing system includes a first device and a second device. The first device generates first encrypted data by applying a first encryption with respect to the original data stored in a shared storage area, and causing the first encrypted data to be stored in the shared storage area. The second device generates second encrypted data by applying a second encryption with respect to the first encrypted data stored in the shared storage area, and causes the second encrypted data to be stored in the shared storage area. The first device deletes the original data and the first encrypted data from the shared storage area.

Abstract: Systems and methods using a universal bridge acting as a gateway to a cloud-based control system to control Internet of Things (IoT) devices are disclosed. The system comprises a cloud-based server, and a bridge operable in a plurality of communication protocols and coupled to the IoT devices. Each IoT device communicates with the bridge using at least one of the plurality of communication protocols. The bridge transmits data received from the IoT devices to the cloud-based server over a network, and receives data from the cloud-based server, over the network, to be transmitted to at least one IoT device from the plurality of IoT devices.

Abstract: A processor with an elliptic curve cryptographic algorithm and a data processing method thereof are shown. Three elliptic curve cryptographic instructions are proposed in the instruction set architecture for key exchange between an initiator and a responder. The initiator device executes the first elliptic curve cryptographic instruction to generate a key pair (rA, RA). In addition to considering the first temporary public key RA, the responder device further takes the second temporary public key RB into consideration when executing the second elliptic curve cryptographic instruction to generate the responder-generated shared key KB. Based on the temporary private key rA, and the temporary public keys RA and RB, the initiator device executes the third elliptic curve cryptographic instruction to generate the initiator-generated shared key KA.

Abstract: A method for controlling an energy grid. In this method, first pieces of information about the past behavior of at least one user at the energy grid are ascertained by a processing unit assigned to the user, homomorphically encrypted and transferred homomorphically encrypted to a first data memory. An external processing unit reads the homomorphically encrypted first pieces of information, calculates as a function thereof second, homomorphically encrypted pieces of information about a predicted, future behavior of the user and stores the second, homomorphically encrypted pieces of information on a second data memory. The second, homomorphically encrypted pieces of information are read out from the second data memory and decrypted by the processing unit assigned to the user. A control of the energy grid takes place as a function of the decrypted second pieces of information.

Abstract: Various embodiments are disclosed for self-authorized identification and services, and applications therefor. A computing device may generate a public-private key pair and a self-authorizing identifier (SAID), a byte string that is globally unique and immutable to the computing device. A remote service implementing a blockchain protocol may store a public key of the public-private key pair in a distributed blockchain ledger, which is used to authenticate the computing device in various network-based communications, and encrypt or decrypt such communications. An enclave service may be employed to asynchronously send messages between computing devices. The computing device may have an isolated environment that permits collaboration applications to execute therein, as well as an actallet that permits distribution applications not executing in the isolated environment to access the SAID or data pertaining thereto.

Abstract: A processor with an elliptic curve cryptographic algorithm and a data processing method thereof are shown. The processor has a first register, storing a private key pointer pointing to a private key. In response to a single elliptic curve cryptographic instruction of an instruction set architecture, the processor reads a ciphertext input from a first storage space within a system memory, performing a decryption procedure using the elliptic curve cryptographic algorithm on the ciphertext input based on the private key obtained by referring to the first register to decrypt the ciphertext input and generate a plaintext output, and programming the plaintext output into a second storage space within the system memory.

Abstract: A method is provided for granting access, for user equipment registered in a home mobile network to a wireless local area network. In this method, a probe request is received by an access network server located in the wireless local area network, wherein this probe request includes first information allowing to identify the home mobile network of the user equipment. The access network server determines then at least one access point of the wireless local area network to which the user equipment is allowed to connect, based on the identification of the home mobile network from the first information and sends a response message including at least one access identifier identifying the at least one access point of the wireless local area network.

Abstract: In various embodiments, a system may be configured to substantially automatically determine whether to take one or more actions in response to one or more identified risk triggers (e.g., data breaches, regulation change, etc.). The system may, for example: (1) compare the potential risk trigger to one or more previous risks triggers experienced by the particular entity at a previous time; (2) identify a similar previous risk trigger (e.g., one or more previous risk triggers related to a similar change in regulation, breach of data, type of issue identified, etc.); (3) determine the relevance of the current risk trigger based at least in part on a determined relevance of the previous risk trigger; and (4) determine whether to take one or more actions to the current risk trigger based at least in part on one or more determined actions to take in response to the previous, similar risk trigger.

Abstract: Aspects of the disclosure relate to processing systems for performing cross-sectional asset editing. A computing platform may receive permission to perform a first subset of event processing steps. The computing platform may delegate permission to an external event processor to perform a second subset of event processing steps and to an external resource management platform to perform a third subset of event processing steps. The computing platform may generate an element chain corresponding to the account. In response to receiving a request to process an event, the computing platform may add a sub-element to the element chain containing a fixed parameter corresponding to an expected value associated with the event and a variable parameter corresponding to an actual value associated with the event. In response to receiving a request to write the actual value to the element chain, the computing platform may modify the variable parameter of the sub-element accordingly.

Abstract: A system and method for implementing M-TIF to integrate one or more non-IP tactical nodes as an integral part of a 5G network includes a tactical translator. The tactical translator provides I/O functionality, message encapsulation, message translation, and IP-to-non-IP address translation. The tactical translator may be interposed between a tactical gateway and a tactical proxy to securely bridge legacy non-IP waveforms with the 5G Core.

Abstract: Aspects of the disclosure relate to a system and method for cryptographically transmitting and storing identity tokens and/or activity data among spatially distributed computing devices. The system may comprise a plurality of chains, such as an identity chain and an activity chain. In some aspects, identity data associated with a user may be used to generate an identity token for the user. The identity token may be transmitted to a plurality of computing devices for verification. Based on a verification of the identity token, the identity token may be stored in the identity chain. A request to perform an activity may also be received, and identity data associated with the user may be received in order to authenticate the user. The computing device may generate, based on the received identity data, an identity token for the user.

Abstract: A method includes: federating, by a computer device, a proxy hardware security module from a physical hardware security module; storing, by the computer device, the proxy hardware security module; receiving, by the computer device, a first one of a plurality of periodic identifying communications from the physical hardware security module; and erasing, by the computer device, the proxy hardware security module as a result of the computer device not receiving a second one of the plurality of periodic identifying communications.

Abstract: A method and electronic device are provided for decrypting homomorphically encrypted (HE) data. The method may include generating, in the electronic device, result metadata that specifies a size of the HE data to be decrypted. The electronic device generates or collects HE input data and the result metadata. The HE input data and the encrypted result metadata are transmitted to a cloud server in a cloud environment to allow the cloud server to perform computations using the HE input data. The cloud server is enabled by the hardware device to send a result of the computations on the HE input data to a secure element (SE) for decryption. A relatively secure online connection is established to the SE in the cloud environment. The SE is enabled by the electronic device to decrypt the result of the computations on the HE input data as specified by the result metadata.

Abstract: A country estimation device includes processing circuitry configured to collect path information for each IP address, extract attribute information assigned to the collected path information, and estimate a country where the IP address is located by referring to attribute information indicating a country at a link destination of a path of the path information among the extracted attribute information.

Abstract: The technology disclosed herein enables a computing device to use a trusted execution environment in an untrusted device to distribute protected content to a set of one or more computing devices. An example method may include: transmitting, by a processor of a data distribution device, attestation data to a first computing device; establishing a trusted execution environment in the data distribution device, wherein the trusted execution environment comprises an encrypted storage area; loading data of the first computing device into the trusted execution environment in the data distribution device, wherein the data comprises protected content and comprises executable code to control access to the protected content; receiving, by the data distribution device, data of a second computing device; and causing the executable code to execute in the trusted execution environment to analyze the data of the second computing device and to provide the second computing device access to protected content.

Abstract: Generally, systems and methods for securely establishing data transfer, storage, and execution are presented. The system may comprise a computing device that comprises at least one programmable integrated circuit. The programmable integrated circuit may comprise multiple independently loadable partitioned segments. A first partitioned segment of the programmable integrated circuit may comprise one or more factory-installed secrets in the form of data, wherein the factory-installed secrets may be configured to convert data from an untranslated state to a translated state, and vice versa. A second partitioned segment may comprise storage-at-rest data for at least one authenticable user of the computing device. The computing device may comprise at least one storage medium that comprises data, including data comprising one or more boot instructions for the computing device, that may be in an untranslated state.

Abstract: The presentation invention relates to methods and apparatus for communicating data in communications networks. An exemplary method in accordance with one embodiment includes the steps of: establishing a first Transmission Control Protocol (TCP) session between a wireless base station and a Cable Modem Termination System (CMTS); receiving via the first TCP session at the CMTS a first set of TCP data packets from a cable modem located on a communications path between the wireless base station and the CMTS, the first set of TCP data packets having been sent by the wireless base station; and determining, by the CMTS, whether to send an Acknowledgement (ACK) message or a Negative Acknowledgement (NACK) message to the wireless base station for the entire first set of TCP data packets based on verifying a subset of TCP data packets of the first set of TCP data packets.

Abstract: The present embodiments relate to systems and methods for using a blockchain to record information related to the lifecycle of a vehicle associated with a Vehicle Identification Number (VIN), or other vehicle identifier. For example, the VIN lifecycle process may be used to ensure the transferability of title, including when information relevant to transferability is not easily determinable, such as after a collision occurs. The systems and methods may include the reception of a mileage report corresponding to a vehicle and updating a blockchain to associate the vehicle with mileage information. The systems and methods described herein may allow for using a blockchain which gives the option for private information, and permissioned participants in the blockchain. In particular, the systems and methods allow for a distributed consensus amongst businesses, consumers, and authorities, as to the validity of information and transactions stored on the blockchain.

Abstract: Described herein are techniques to enable a mobile device to perform multi-source estimation of an altitude for a location. A baseline altitude may be determined at ground level for a location and used to calibrate a barometric pressure sensor on the mobile device. The calibrated barometric pressure sensor can then estimate changes in altitude relative to ground level based on detected pressure differentials, allowing a relative altitude to ground to be determined. Baseline calibration for the barometric sensor calibration can be performed to determine an ambient ground-level barometric pressure.

Abstract: A system and method for automatic remote mobile device data extraction is provided. The system and method can include transmitting a request to extract data from a server at a first location to a computer that is at a second location, where the mobile device is connected to the computer. A web link and an activation code can be provided that allows for downloading an agent application on the computer to assist with the request, and a list of exact data elements to be extracted can also be provided. The data can be extracted from the mobile device and sent to the server.

Abstract: Systems and methods are disclosed for securing a network, for admitting new nodes into an existing network, and/or for securely forming a new network. As a non-limiting example, an existing node may be triggered by a user, in response to which the existing node communicates with a network coordinator node. Thereafter, if a new node attempts to enter the network, and also for example has been triggered by a user, the network coordinator may determine, based at least in part on parameters within the new node and the network coordinator, whether the new node can enter the network.

Abstract: The subject disclosure relates to methods for assessing cyber-security risks, and in particular for calculating a risk-index for multiple users of a computer network. In some implementations, a process of the disclosed technology includes steps for determining a privileged index for each of a plurality of network users, determining a vulnerability index for each of the plurality of network users, calculating a threat score for one or more cyber-security attacks directed at each of the plurality of network users, and calculating a risk-index for at least one network user from among the plurality of network users, wherein the risk-index is based on the privileged index, the vulnerability index, and the threat score associated with each of the network users. Systems and machine-readable media are also provided.

Abstract: Systems and methods for performing flash updates during runtime are discussed. More particularly, the amount of secure memory required to prevent tampering during the update process is limited by storing hashes of logical blocks of the update image in secure memory after initial validation while storing the update image in non-secure RAM or another non-secure memory location. Additionally, disruptions to the computing platform are limited by dividing the logical blocks into smaller progress units to minimize the amount of time spent in the secure operating environment performing the update.

Abstract: The present disclosure relates to a method and device for performing access control by authenticating an electronic device and performing secure ranging. The method may include: receiving, from a server, a device certificate including a first scrambled timestamp sequence (STS) code encrypted by a public key of the electronic device and a second STS code encrypted by an STS key; transmitting the device certificate to a target device; obtaining the first STS code by decrypting the encrypted first STS code by using a secret key of the electronic device; and performing secure ranging with the target device by using the first STS code.

Abstract: Aspects of the disclosure relate to processing cryptocurrency transactions. A computing platform may receive a transaction request. The computing platform may request SEKs from operator devices, and may receive requests to download encrypted SEKs accordingly. The computing platform may send the encrypted SEKs, and may receive corresponding decrypted SEKs from the operator devices in response. The computing platform may decrypt encrypted shares using the SEKs, and may use the decrypted shares to reconstruct a cryptographic signing key. The computing platform may validate the cryptographic signing key, and based on successful validation of the cryptographic signing key, may transfer authorize the requested transaction.

Abstract: In one embodiment, the invention provides a portable wireless personal communication system for cooperating with a remote certification authority to employ time variable secure key information pursuant to a predetermined encryption algorithm to facilitate convenient, secure encrypted communication. The disclosed system includes a wireless handset, such as PDA, smartphone, cellular telephone or the like, characterized by a relatively robust data processing capability and a body mounted key generating component which is adapted to be mounted on an individual's body, in a permanent or semi-permanent manner, for wirelessly broadcasting, within the immediate proximity of the individual, a secret or private key identifying signal corresponding to a time variable secure key information under the control of the certification authority.

Abstract: A system is provided for encoding genomics data for secure storage and processing. In particular, the system may comprise a client and server operating environment that uses a unique encoding algorithm to transform genomics data and/or metadata to produce encoded genomics data and/or metadata. In some embodiments, the encoded genomics data and/or metadata may be encrypted using one or more encryption algorithms. The encoded and/or encrypted genomics data may be stored on a secure server (e.g., a cloud environment) that may perform subsequent processing steps on the encoded and/or encrypted genomics data. Once the processing steps have been completed, the server may transmit one or more outputs associated with the genomics data and/or metadata to a client device. In this way, the system provides an efficient and secure way to store and process genomics data.

Abstract: A data processing method includes receiving a query word and in response to receiving the query word, searching a plurality of stored irreversibly encrypted substrings corresponding to the query word, where each of the plurality of stored irreversibly encrypted substrings is associated with a string of reversibly encrypted raw data. The data processing method further includes in response to searching, outputting one or more of the plurality of stored irreversibly encrypted substrings and the associated string of reversibly encrypted raw data corresponding to the query word as a query result.

Abstract: Systems and methods for conducting hydrocarbon custody transfer uses blockchain to eliminate or minimize mistrust over the reliability, accuracy, and immutability of data. The blockchain is provided as a shared data layer that can store the data in a secure and tamperproof manner. The data may include data generated by equipment, sensors, people, processes, and the like, and may be automatically generated or compiled manually. A blockchain application digitally signs the data using public/private key encryption before uploading the data to the blockchain. The data can then be made available to all authorized custody transfer parties, including oil producers, well operators, regulatory teams, and the like, in the form of notifications, shared dashboards, and/or auto reports. Smart contracts may be embedded in the blockchain to carry out monetary settlements and value exchange by automating funds transfer if certain criteria are met.

Abstract: The invention relates to processes and systems for using Web Real-Time Communications (RTC) to connect and communicate with devices used in an Internet of Things (IoT) framework, and devices made for the same.

Abstract: Methods, systems, and devices for wireless communications are described. A base station may indicate for a first device to transmit random information in the direction of an adverse device on at least partially overlapping time and frequency resources that are also used for receiving a downlink message from the base station. By transmitting the random information in the direction of the adverse device, the first device may cause entropy overhead to the adverse device, impacting an ability of the adverse device to decode portions of the downlink message transmitted to and intended for the first device. Accordingly, the first device may receive the downlink message and may concurrently transmit the random information in the direction of the adverse device on time and frequency resources that at least partially overlap with time and frequency resources used for receiving the downlink message based on receiving the indication from the base station.

Abstract: Novel tools and techniques might provide for implementing secure communications for IoT devices. In various embodiments, a gateway or computing device might provide connectivity between or amongst two or more Internet of Things (“IoT”) capable devices, by establishing an IoT protocol-based, autonomous machine-to-machine communication channel amongst the two or more IoT capable devices. For sensitive and/or private communications, the gateway or computing device might establish a secure off-the-record (“OTR”) communication session within the IoT protocol-based, autonomous machine-to-machine channel, thereby providing encrypted machine-to-machine communications amongst the two or more IoT capable devices, without any content of communications that are exchanged amongst the IoT capable devices over the secure OTR communication session being recorded or logged.

Abstract: Technologies for bi-directional encryption and decryption for underlay and overlay operations are described. One network device includes multiple ports, a network processing element, a programmable path-selection circuit, and a security IC. The programmable path-selection circuit is configured to operate in a first mode in which first outgoing packets are routed to the security integrated circuit to be encrypted before sending on one of the ports, and first incoming packets, received on one of the ports, are routed to the security integrated circuit to be decrypted. The programmable path-selection circuit is configured to operate in a second mode in which second incoming packets are routed to the security integrated circuit to be encrypted before processing by the network processing element and route second outgoing packets to the security integrated circuit to be decrypted after processing by the network processing element.

Abstract: Embodiments herein describe an integrated circuit that includes a network on chip (NoC) where an egress logic block or switch performs a route lookup for a subsequent (e.g., downstream) switch in the NoC (referred to herein as look-ahead routing). After receiving the packet and a port ID from the egress logic block or the switch, the downstream switch knows, without performing route lookup of its own, on which port it should forward the packet. Thus, if the downstream switch performs other functions that are dependent on knowing the destination port (e.g., arbitration or QoS updating), the downstream switch can perform those functions immediately since the port ID was already determined by, and received from, the previous network element.

Abstract: A method including determining, by a device, a sharing decryption key based at least in part on an assigned private key associated with the device and a folder access public key associated with a folder; decrypting, by the device, a folder access private key associated with the folder by utilizing the sharing decryption key; and decrypting, by the device, encrypted content associated with the folder by utilizing the folder access private key associated with the folder. Various other aspects are contemplated.

Abstract: The technology disclosed herein enables a computing device to use a trusted execution environment to retrieve protected content from mutually-untrusted devices. An example method may include: establishing, by a processor, a trusted execution environment in a computing device, wherein the trusted execution environment uses memory encryption and comprises executable code; providing, by the processor, attestation data to a set of computing devices, the attestation data representing the executable code in the trusted execution environment; receiving, by the processor, cryptographic key data from the set of computing devices; and causing, by the processor, the executable code to execute in the trusted execution environment and to initiate an operation using the cryptographic key data.

Abstract: Methods and apparatus for enabling detection of configuration changes in a network device. One method uses a configuration counter in a system database of the network device. In response to an atomic submission of CLI commands to a configuration agent and the storing of the corresponding configuration in a system database, the configuration counter is incremented. An OpenConfig module maintains an expected value of the configuration counter and, upon completion of its own command submissions, compares the expected value to the value in the configuration counter. If the two values do not match, it indicates that the configuration counter in the system database has been incremented as a result of a configuration change from a source other than the OpenConfig module. A configuration client can then be notified of the configuration change so that it can revert the configuration to a desired configuration.