Abstract: Systems and methods are disclosed permitting a sender to send a secret and secure message to a recipient. An application on a sender device interfaces with known message generating tools to permit a user to generate a message. The local application encrypts the message (and optional attachments) based on public/private key pairing negotiated with the server given the recipient device id. The sender device transmits the cipher text to the server. The server generates a benign, text-based, context-appropriate message and delivers same to a recipient device by way of a known messaging service. The benign message provides a secret clue to the recipient that an encrypted message is available. Recipient may then access and decrypt the encrypted message, such as from the server in response to a successful challenge (e.g., password request).

Abstract: Provided are methods and systems for mitigating a DoS attack. A method for mitigating a DoS attack may commence with receiving, from a client, a request to initiate a secure session between the client and a server. The method may continue with determining whether the client is on a whitelist. Based on a determination that client is absent from the whitelist, a pre-generated key may be sent to the client. The method may include determining validity of the established secure session. The determination may be performed based on further actions associated with the client. Based on the determination that the secure session is valid, a renegotiation of the secure session may be forced. The method may further include generating a new key using a method for securely exchanging cryptographic keys over a public channel. The new key is then sent to the client.

Abstract: A computer-implemented method for preventing false positive malware identification may include (1) identifying a set of variants of a trusted software program, (2) characterizing, for each variant in the set of variants of the trusted software program, at least one common property of the variants, (3) clustering the set of variants of the trusted software program based on the common property of the variants, and (4) creating a signature capable of recognizing variants of the trusted software program. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: In many information security scenarios, a certificate issued by a certificating authority may be presented to a client in order to assert a trust level of a certificated item, such as a message or a web page. However, due to a decentralized structure and incomplete coordination among certificating authorities, the presence and exploitation of security vulnerabilities to issue untrustworthy certificates may be difficult to determine, particularly for an individual client. Presented herein are techniques for providing a certificating authority trust service that collects and evaluates certificates submitted to clients by certificating authorities, and advises the clients of a certificating authority trust level for respective certificating authorities (e.g., determined as a consensus of the evaluated certificates issued by the certificating authority).

Abstract: A system and method for detecting malware in compressed data. The system and method identifies a set of search strings extracted from compressed executables, each of which is infected with malware from a family of malware. The search strings detect the presence of the family of malware in other compressed executables, fragments of compressed executables, or data streams.

Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for network monitoring, user account compromise determination, and user behavior database system. The system monitors network actions of user accounts including user account access across multitudes of network accessible systems, determines user account transitions, and determines different types of high-risk user behavior indicative of compromise. Network actions can be obtained from generated information by the network accessible systems, and correlated across additional data sets including contextual ones. User interfaces are generated describing network actions of user accounts, and are configured for user interaction, which cause generation of updated user interfaces and access to electronic data sources to determine information relevant to the user interaction.

Abstract: This disclosure describes, in part, systems, devices, and techniques to encrypt address resolution protocol (ARP) messages to prevent a rogue device from accessing information about a local network. In certain embodiments described herein, networked devices are preconfigured with security credentials that allow the devices, possibly via network interface controllers (NICs), to encrypt outgoing ARP messages and decrypt incoming ARP messages. The NICs may listen for encrypted messages that are recognized as being ARP messages. These encrypted messages may include a designator that indicates that the message is an encrypted ARP message. When a NIC receives a message that is indicated as an encrypted ARP message, then the NIC will decrypt the message using secure credentials to obtain the true ARP message. The device will then process the message in accordance standard procedures.

Abstract: A method, terminal and secure RF communication system are provided. The method for radio frequency secure communication of the invention comprises: generating magnetic channel data, and transmitting the magnetic channel data via a magnetic channel; establishing a radio frequency link with a peer device which feeds back a response information of the magnetic channel data; generating first radio frequency data, encrypting the first radio frequency data using the magnetic channel data, and transmitting the encrypted first radio frequency data to the peer device via the radio frequency link; and/or receiving encrypted second radio frequency data transmitted by the peer device via the radio frequency link, and decrypting the encrypted second radio frequency data using the magnetic channel data. By the above technical solution, the invention avoids the risk that a preset key is intercepted or decrypted, and enhances the security of the radio frequency link data exchanging process.

Abstract: Disclosed is an authentication system and method. The authentication system according to one embodiment of the present disclosure comprises a transceiver for receiving an authentication request including a client-side OTP and encoded account information from a client, and transmitting the result of the authentication performed in accordance with the authentication request to the client; a decoder for decoding the encoded account information so as to compute the account information of the client and an authentication request time; a server-side OTP generator for generating a server-side OTP using the computed account information of the client and authentication request time; and an authenticator for comparing the client-side OTP included the authentication request and the server-side OTP in order to authenticate the client.

Abstract: A method performed in a processor of an intrusion detection/prevention system (IDS/IPS) checks for valid packets in an SMB named pipe in a communication network. In a processor configured as an IDS/IPS, a packet in a transmission is received and a kind of application of a target of the packet is determined. Also, the data in the packet is inspected by the IDS/IPS as part of the SMB named pipe on only one of a condition that: (a) the FID in an SMB command header of the packet is valid (i) for segments/fragments in the SMB named pipe and (ii) for the determined kind of application of the target of the packet, as indicated by a reassembly table, and (b) the determined kind of application of the target of the packet does not check the FID, as indicated by the reassembly table.

Abstract: A method for enforcing a network policy is described herein. In the method, a network socket event request from an application executing in a first context is intercepted by an agent prior to the request reaching a transport layer in the first context. A context refers to virtualization software, a physical computer, or a combination of virtualization software and physical computer. In response to the interception of the request, the agent requests a decision on whether to allow or deny the network socket event request to be communicated to a security server executing in a second context that is distinct from the first context. The request for a decision includes an identification of the application. The agent then receives from the security server either an allowance or a denial of the network socket event request, the allowance or denial being based at least in part on the identification of the application and a security policy.

Abstract: A method for exchanging strong encryption keys between devices using alternate input methods. At least two devices that want to communicate with one another are set in key exchange mode. The at least two devices are to communicate with one another using a short range radio or personal area network. The at least two devices negotiate with one another to determine which of the at least two devices will generate an encryption key, wherein device A represents the negotiated device and device B represents the non-negotiated device. Device A generates the encryption key and transmits the encryption key to device B using an out-of band transmission channel. The out-of-band transmission channel may be transmitting the encryption key via audio tones. A validation process determines whether the transmission of the encryption key via the out-of-band transmission channel was successful.

Abstract: A system and method for communication and messaging among self-adapting peer nodes is disclosed, where each node maintains a list of authorized peer nodes. The nodes exchange requests directly with other nodes over networks, providing information identifying the requesting node and the type of request. The receiving node authenticates the requesting node, authenticates the type of request, and determines method of response to the request. If the request is authenticated and the type of request is valid, the receiving node also validates the incoming request and originating node and adapts its peer node database, applying any required changes. The types of requests exchanged between nodes include: status and location change, message, audio, voice, video, text, and data. The types of responses include: authorized, unauthorized, or ignore. The nodes may periodically send and receive requests for status, messages, and data updates from an optional central server.

Abstract: A method for encrypting and storing data on a removable medium includes: obtaining a medium key uniquely associated with the removable medium; encrypting the data using the medium key to generate encrypted data; and writing the encrypted data onto the removable medium.

Abstract: In accordance with an example embodiment of the present invention, an apparatus, a computer program product and a method is provided for establishment of a wireless communication link through machine reading. The example embodiment comprises receiving at least information identifying a wireless communication device through machine reading a machine-readable object, and initiating a wireless communication link establishment with the wireless communication device using the received information, wherein the wireless communication link establishment is incorporated with an indication that a machine-readable object associated with the wireless communication device was read.

Abstract: Disclosed herein is a method for executing unprotected mode services in a protected mode computing environment includes initiating a protected mode service that is configured to execute in a protected mode. Further, the method includes verifying an integrity of one or more unprotected mode services configured to execute in an unprotected mode. The one or more unprotected mode services is registered with the protected mode service. The method also includes initiating an unprotected mode service of the one or more unprotected mode services in response to the integrity of the unprotected mode service being verified.

Abstract: A system for dynamic message routing on a topic between publishing nodes and subscribing nodes includes a plurality of message queues, at least one topic/node table, a subscribing module, a publishing module, and other modules to send messages between one or more publisher and one or more subscribers. Methods include: a method for publishing a message on a topic, a method for forwarding a message on a topic, a method for subscribing to messages on a topic, a method for automatically removing subscribers, a method for direct publishing of messages, and methods for optimizing message transmission between nodes.

Abstract: Application programming interface (API) hooks are injected into an application program executing at a client during run-time. Responsive to these hooks, data intended for encryption prior to transmission from the client is diverted, for example for content filtering, compression, etc., prior to being encrypted. In the case of encrypted data received at the client, the data is decrypted but before being passed to the application it is diverted, under control of the API hooks, for content filtering, decompression, etc.

Abstract: An improved technique authenticates a user based on an ability to corroborate previous transaction data sent by a user device. Along these lines, the improved technique makes use of an independent information source for verifying the accuracy of previous transaction data obtained by a given collector. For example, when a collector of location data is a GPS unit of a cell phone, an independent information source may be a cell tower closest to the cell phone at the time of the transaction. While location data provided by the cell tower may not be as precise as that provided by the GPS unit, such data is useful for corroborating the location data from the GPS unit. In this scenario, if the data provided by the cell tower fails to corroborate that provided by the GPS unit, then the GPS unit adds significant risk to authenticating the user.

Abstract: Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for receiving one or more respective socket commands from a virtual machine socket core, the one or more respective socket commands being associated with a respective socket destination address; determining, based on the one or more respective socket commands and the respective socket destination address, whether to communicate data associated with the one or more respective socket commands to a host virtual socket device; and in response to determining to communicate the data associated with the one or more respective socket commands to the host virtual socket device, converting the socket destination address to a Uniform Resource Identifier (URI) address and communicating the data associated with the one or more respective socket commands and the URI address between the host virtual socket device.

Abstract: Methods, apparatus and articles of manufacture for identifying suspicious user logins in enterprise networks are provided herein. A method includes processing log data derived from one or more data sources associated with an enterprise network, wherein the enterprise network comprises multiple hosts; generating a set of profiles, wherein the set comprises a profile corresponding to each of multiple users and a profile corresponding to each of the multiple hosts, wherein each profile comprises one or more login patterns based on historical login information derived from said log data; and analyzing a login instance within the enterprise network against the set of profiles.

Abstract: Embodiments of the invention relate to efficiently storing encrypted data in persistent storage or passing to another data processing component. A downstream decrypter is utilized to act within the data path between a data generator and a storage server. The decrypter fetches an encryption key and any other necessary auxiliary information necessary to decrypt received data. Following decryption of the data, the decrypter has the ability to operate directly on plaintext and perform storage efficiency functions on the decrypted data. The decrypter re-encrypts the data prior to the data leaving the decrypter for persistent storage to maintain the security of the encrypted data.

Abstract: A system and method are disclosed that may allow a hybrid application to support persistent login, multilogin, and push notifications. User credentials may be received and utilized to obtain an access token and a refresh token. The refresh token may be stored to persistent storage and the access token may be used to obtain a browser authentication cookie from an authentication server. The web application portion of a hybrid application may be authenticated using the browser authentication cookie.

Abstract: A computer-implemented method for securing personal information of a user on social networks. The method involves: receiving personal information from a user in an unencrypted textual form by a client computer; transmitting the received personal information via a secure virtual private network (VPN) connection to a dedicated VPN server/proxy; receiving the personal information at the dedicated VPN server/proxy; encrypting the received personal information at the dedicated VPN server/proxy using an encryption key; and transmitting the encrypted personal information from the dedicated VPN server/proxy to the social network. Other users of the social network also use the dedicated VPN server/proxy in order to decrypt (access) the personal information of the user, which has been encrypted as specified above.

Abstract: According to one embodiment, a transparent security gateway is coupled between a client end station (CES) and a web application server (WAS). The security gateway monitors an encryption protocol handshake between the CES and the WAS to capture, using a provided private key of the WAS, a generated symmetric key to be used for an encryption layer connection. Using the captured symmetric key, the security gateway receives an encrypted connection record of the encryption layer connection, decrypts the encrypted connection record to yield a plaintext connection record, modifies the plaintext connection record, encrypts the modified plaintext connection record using the symmetric key, and transmits one or more packets carrying the encrypted modification plaintext connection record instead of the received encrypted connection record such that neither the CES or WAS is aware of the modification of the encrypted data.

Abstract: A system is disclosed that includes components and features for enabling enterprise users to securely access enterprise resources (documents, data, application servers, etc.) using their mobile devices. An enterprise can use some or all components of the system to, for example, securely but flexibly implement a BYOD (bring your own device) policy in which users can run both personal applications and secure enterprise applications on their mobile devices. The system may, for example, implement policies for controlling mobile device accesses to enterprise resources based on device attributes (e.g., what mobile applications are installed), user attributes (e.g., the user's position or department), behavioral attributes, and other criteria.

Abstract: An enhanced whitelisting module associated within a system whitelists unknown files for execution on the system. The whitelisting module may oversee the computation of a hash of a file loaded into the memory and comparison of the hash to hashes within a hash table generated from clean files located on a clean system. The whitelisting module may communicate to a device internal and/or external to the system to retrieve the hash table of clean files. In certain embodiments, a rolling hash (or other piecewise hash) may be used to determine the location and/or extent of the differences between a modified file and a clean file.

Abstract: A method operates, during development of an application program intended to be run on a mobile user device, to perform a computer assisted analysis of the application program to determine at least one user privacy-related aspect of the application program; and to present the determined at least one user privacy-related aspect. The determined at least one user privacy-related aspect may be presented to a developer of the application program An apparatus and system for performing the method are also disclosed.

Abstract: A server system is configured to provide an e-mail based interface for executing management operations on a virtualized infrastructure which includes a plurality of virtual machines (VMs), underlying host computers, clusters, and/or data centers. Such an interface may be provided in a virtualized infrastructure to enable a system administrator to execute administrative operations remotely from a mobile device without requiring custom installation of an application on the mobile device or a secure connection to the server system. The server system receives e-mails at a pre-determined e-mail address, authenticates the sender of the e-mail, and extracts and executes commands from the e-mail. A number of techniques for validating the e-mail containing server commands may also be provided.

Abstract: Various embodiments provide a method and apparatus of providing accelerated encrypted connections in a cloud network supporting transmission of data including per-user encrypted data. Transmission of encrypted data from an application server uses an encryption scheme that encrypts static data using a first encryption scheme that derives keys from the content itself and encrypts dynamic data, such as dynamic website content with personalized user data, using a second encryption scheme.

Abstract: A method and system for facilitating interaction between an electronic device and a plurality of content provider websites are disclosed. In one embodiment, the method includes receiving at a server a plurality of information portions provided from the websites, where each of the information portions is associated with a respective copy of information that is available at each of the websites. The method also includes aggregating at the server the information portions so that they are combined into an overall grouping, with the respective information portions being maintained respectively as distinct subportions within the grouping. Further, the method includes sending from the server a message for receipt by a part of the electronic device, the primary message including the grouping. The grouping is sent together with an additional copy of the information or with an indication of that information to which the overall grouping relates.

Abstract: A sending computer (sender) delivers private messages over a network via dynamically established encrypted channels where no copies of the message are persisted on third party computers. Private messages are routed dynamically based on membership status of the receiving computer (receiver) and direct addressability status of the sender and receiver. The system determines membership status of the receiver and provides a notification message and delivery link to the receiver when the receiver is not a member of the private network. When the receiver is a member, direct addressability of sender and receiver is determined, and the message is delivered directly to the receiver over an encrypted channel when the sender is directly addressable. When the sender is not directly addressable, the encrypted channel between the sender and receiver is established through a third party relay without persisting a copy of the private message on the third party relay.

Abstract: A system administrator of a wireless LAN 100 manipulates a personal computer PC1 to change a WEP key. The personal computer PC1 authenticates a memory card MC as genuine under management of the system administrator. In the case of the authenticated memory card MC, changed setting information, as well as a previous WEP key before the change of the setting information, is written into the memory card MC. The system administrator then inserts this memory card MC into a memory card slot of a printer PRT1. The printer PRT1 authenticates the memory card MC as genuine under management of the system administrator. In the case of the authenticated memory card MC, the setting information is updated. This arrangement effectively relieves the user's workload in setting wireless communication devices, while ensuring the sufficiently high security.

Abstract: The invention is directed to systems and methods for detecting the loss, theft or unauthorized use of a device and/or altering the functionality of the device in response. In one embodiment, a device monitors its use, its local environment, and/or its operating context to determine that the device is no longer within the control of an authorized user. The device may receive communications or generate an internal signal altering its functionality, such as instructing the device to enter a restricted use mode, a surveillance mode, to provide instructions to return the device and/or to prevent unauthorized use or unauthorized access to data. Additional embodiments also address methods and systems for gathering forensic data regarding an unauthorized user to assist in locating the unauthorized user and/or the device.

Abstract: The present disclosure relates to methods and systems for managing a guest virtual machine executing within a virtualized environment. A daemon is established on a guest virtual machine executing within a virtualized environment. The daemon is configured to communicate with a management service virtual machine executing within the virtualized environment. The daemon receives, from the management service virtual machine via an application layer protocol, a request identifying an action type of a plurality of predetermined action types. The daemon identifies the action type of the plurality of predetermined action types from the received request and performs an action corresponding to the identified action type. In some implementations, the application layer protocol is one of Hypertext Transfer Protocol (HTTP) or Hypertext Transfer Protocol Secure (HTTPS).

Abstract: The present invention relates to key management in a secure microcontroller, and more particularly, to systems, devices and methods of automatically and transparently employing logic or physical address based keys that may also be transferred using dedicated buses. A cryptographic engine translates a logic address to at least one physical address, and processes a corresponding data word based on at least one target key. The target key is selected from a plurality of keys based on the logic or physical address. A universal memory controller stores each processed data word in the corresponding physical address within a memory. Each key is associated with a memory region within the memory, and therefore, the logic or physical address associated with a memory region may be used to automatically identify the corresponding target key. A dedicated secure link may be used to transport key request commands and the plurality of keys.

Abstract: According to one embodiment, a computing device is coupled to a set of web application layer attack detectors (ADs), which are coupled between HTTP clients and web application servers. The computing device automatically learns a new condition shared by a plurality of alert packages reported by the set of ADs due to a triggering of one or more rules that is indicative of a web application layer attack. The computing device automatically generates a new set of attribute values by analyzing the plurality of alert packages to identify the condition shared by the plurality of alert packages, and transmits the new set of attribute values for delivery to the set of ADs for a different rule to be used to protect against the web application layer attack from the HTTP clients or any other HTTP client.

Abstract: A method and system of encrypting and decrypting documents and recipient rights.

Abstract: A computer-implemented method, network management system, and network clients are provided for out-of-band network security management. The network management system includes routers, firewalls, and out-of-band interfaces. The out-of-band interface of the network management system transmits access control lists to network clients connected to a trusted network. The trusted network connects the routers, firewalls, and network clients. The firewalls receive access control lists from the network management system to police communications that traverse the trusted network and an untrusted network. The routers receive access control lists from the network management system to police communications that traverse the router within the trusted network. The access control lists for the routers and firewalls are transmitted over a network interface to the trusted network and are transmitted separately from the access control lists for the network clients.

Abstract: Techniques for in-app user data authorization are described. An apparatus may comprise a processor circuit, a permissions component, and a token component. The permissions component may be operative on the processor circuit to receive a request from an application to perform a task on a device and to return a response to the request to the application based on active permissions for the application. The token component may be operative on the processor circuit to manage a token database and to determine the active permissions for the application based on the token database. Other embodiments are described and claimed.

Abstract: Framework for conditionally attaching web service policies to a policy subject (e.g., a web service client or service endpoint) at subject runtime. In one set of embodiments, a constraint expression can be defined that specifies one or more runtime conditions under which a policy should be attached to a policy subject. The constraint expression can be associated with the policy and the policy subject via policy attachment metadata. The constraint expression can then be evaluated at runtime of the policy subject to determine whether attachment of the policy to the policy subject should occur. If the evaluation indicates that the policy should be attached, the attached policy can be processed at the policy subject (e.g., enforced or advertised) as appropriate. Using these techniques, the policy subject can be configured to dynamically exhibit different behaviors based on its runtime context.

Abstract: A method and system that allows a host system application to securely communicate with a legacy device is provided. A redirector software module receives data that is destined for a host system serial COM port. Data is secured and re-directed to a legacy device via a network port instead of the serial COM port. Conversely, data destined for the host system is provided to a device server via a server COM port by the legacy serial device. The data can be encrypted and sent to the host system via the network. The redirector software module decrypts the encrypted data and presents it to the consumer application as if the data had arrived via the local COM port.

Abstract: Embodiments of multi-user web service sign-in client side components are presented herein. In an implementation, the currently authenticated user account of a first application of a client is transferred to another application of a client. In another implementation, a common credential store is used to share data for a plurality of user accounts associated with a client between a plurality of applications of the client, and for the applications to output multi-user interfaces having portions corresponding to the plurality of accounts.

Abstract: Disclosed is a method for implementing an encryption engine, which includes: when an engine binding interface is called, a hardware encryption engine establishes a connection with a hardware encryption equipment, acquires an algorithm list of said equipment, and fills a first data structure; when a key initialization interface is called, said engine, according to the transmitted first data structure, sets an encryption/decryption algorithm to be used by said equipment, and retrieves a corresponding algorithm key; and if no algorithm key is retrieved, said engine controls said equipment to create said algorithm key; when a data encryption/decryption interface is called, said engine, according to the currently set encryption/decryption algorithm and said algorithm key, controls said equipment to perform an encryption/decryption operation on the transmitted data. The present invention can add or extend the encryption/decryption algorithm that can only be implemented in hardware to a software algorithm library.

Abstract: According to one embodiment, a computing device is coupled to a set of web application layer attack detectors (AD), which are coupled between HTTP clients and web application servers. The computing device learns a new set of attribute values for a set of attribute identifiers for each of a sequence of rules through an iterative process having a plurality of iterations. The iterative process begins with an attack specific rule, and the sequence of rules includes an attacker specific rule and another attack specific rule. Each iteration includes receiving a current alert package from one of the ADs sent responsive to a set of packets carrying a web application layer request meeting a condition of a current rule used by the AD, automatically generating a new set of attribute values based upon the current alert package, and transmitting the new set of attribute values to the set of ADs.

Abstract: A transmit portion of a network device including a medium access control (MAC) module configured to receive a frame of data to be transmitted from the network device in accordance with a MAC security (MACsec) protocol. In response to the frame of data being a precise time protocol (PTP) frame, the MAC module is configured to encrypt the PTP frame in accordance with the MACsec protocol, and associate an identifier with the encrypted PTP frame. A physical layer module includes a transmit module configured to transmit the encrypted PTP frame from the network device at a particular time. A PTP module configured to, based on the identifier associated with the encrypted PTP frame, generate a time stamp indicating the particular time that the transmit module transmits the encrypted PTP frame from the network device. The time stamp is transmitted from the network device along with the encrypted PTP frame.

Abstract: Embodiments of the invention are directed to systems, methods and computer program products for enrolling a user in a device identification program. In some embodiments, a system is configured to: receive device identification information from a mobile device, receive user information associated with a user, the user information enabling identification of the user, associate the device identification information with the user information, and create a record based on the device identification information and the user information.

Abstract: An Internet-enabled device, such as a smartphone, tablet, PC, wearable sensor, or household appliance, executes an application (or “app”) has its own VPN connection with a VPN gateway device. The app does not use the device-level or system VPN to connect with the gateway. The app, which may be security wrapped, is made more secure by having its own VPN tunnel with the gateway, wherein the VPN tunnel is not used by other apps running on the device. The conventional (or device-level) VPN connection is not used by the app(s). The app has its own IP stack, an HTTP proxy layer, an IPsec module, and a virtual data link layer which it uses to build IP packets, encapsulate them, and transmit them to a transport module in the device operating system, for example, a UDP module.

Abstract: Efficient routing for a client-server session or connection is provided in an application layer of multi-layered systems interconnect stack by caching a plurality of application-specific information at an intermediary network point; using the application specific information to route messages for an application connection; and indexing the application-specific information with a key provided by the application. Optionally, a second key may be used to retrieve the application-specific information if the first key is not provided in an application connection request, where the second key is optionally opaque to the application program. The intermediary network point may be an edge of network Internet Protocol (IP) switch, and the application layer in which the routing is performed may be layer seven of the Open Systems Interconnection model.

Abstract: According to one aspect, the subject matter described herein includes a method for communicating an encrypted data packet. The method includes steps occurring at a first gateway node. The method also includes receiving a data packet from a first host. The method further includes determining that a first security association (SA) instance associated with the data packet is in an inactive state. The method further includes identifying a second SA instance that is both associated with the data packet and in an active state. The method further includes forwarding the data packet to the second SA instance.