Abstract: A method may include allocating a number of public keys, where each respective public key is allocated to a respective entity of a number of entities; storing a number of private keys, where each respective private corresponds to a respective public key; storing one or more decryption algorithms, where each respective decryption algorithm is configured to decrypt data previously encrypted using at least one encryption algorithm of the encryption algorithms. Each respective encryption algorithm may be configured to encrypt data using at least one public key. Each respective decryption algorithm may be configured to decrypt data using at least one private key. The method may include receiving encrypted data, where the encrypted data is encrypted using a first public key and a first encryption algorithm, and the encrypted data is provided over a network.

Abstract: A method and communication node for providing secure communications and services in a High Availability (HA) cluster. The communication node comprises an Operating System (OS) that detects an unavailability of a first service application process and switches a second service application process from the first state to the second state, the second service application being selected for taking over service currently provided from the first service application process, the first state and the second state each being associated to a set of rights in the cluster. The OS generates a private key for the second service application process based on its second state. The set of rights associated to the second state allows the OS to replace the first service application process with the second service application process for providing secure communications between the second service application and other service application processes in the HA cluster.

Abstract: A system, method and computer program product are provided for analyzing network traffic associated with network services. Initially, network traffic and metadata are collected from a network. Thereafter, the network traffic is analyzed utilizing the metadata.

Abstract: A method of providing transparent encryption for a web resource includes a key manager receiving an encryption key policy; receiving user identifiers and resource locators; defining an access control list based the user identifiers; generating an encryption key and a key identifier for a first resource locator; and establishing a secure communication channel between first and second watchdog modules. The method also includes the watchdog sending encryption information using the secure communication channel. The method also includes a transparent encryption module storing the encryption key and the access control list in protected memory; receiving an input comprising a request to access the first resource stored in the web resource; determining that the user identifier is included in the access control list; encrypting data using the encryption key; and decrypting data using the encryption key.

Abstract: In a content transmitting method in a content transmitting apparatus, wherein the content transmitting apparatus adds copy control information for indicating to execute a recoding control with either one of “copy can be made only one (1) generation” or “number of times of copying is limited”, on number-limited copy target content, when distributing the number-limited copy target content, which can be copied within a region of limited number of pieces.

Abstract: In a hitless manual cryptographic key refresh scheme, a state machine is independently maintained at each network node. The state machine includes a first state, a second state, and a third state. In the first state, which is the steady state, a current cryptographic key is used both for generating signatures for outgoing packets and for authenticating signatures of incoming packets. In the second state, which is entered when a new cryptographic key is provisioned, the old (i.e. formerly current) key is still used for generating signatures for outgoing packets, however one or, if necessary, both of the old key and the newly provisioned key is used for authenticating signatures of incoming packets. In the third state, the new key is used for generating signatures for outgoing packets and either one or both of the old key and new key are used for authenticating signatures of incoming packets.

Abstract: Systems and methods for inhibiting attacks with a network are provided. In some embodiments, methods for inhibiting attacks by forwarding packets through a plurality of intermediate nodes when being transmitted from a source node to a destination node are provided, the methods comprising: receiving a packet at one of the plurality of intermediate nodes; determining at the selected intermediate node whether the packet has been sent to the correct one of the plurality of intermediate nodes based on a pseudo random function; and forwarding the packet to the destination node, based on the determining. In some embodiments an intermediate node is selected based on a pseudo random function. In some embodiments, systems and methods for establishing access to a multi-path network are provided.

Abstract: A method may include allocating a number of public keys, where each respective public key is allocated to a respective entity of a number of entities; storing a number of private keys, where each respective private corresponds to a respective public key; storing one or more decryption algorithms, where each respective decryption algorithm is configured to decrypt data previously encrypted using at least one encryption algorithm of the encryption algorithms. Each respective encryption algorithm may be configured to encrypt data using at least one public key. Each respective decryption algorithm may be configured to decrypt data using at least one private key. The method may include receiving encrypted data, where the encrypted data is encrypted using a first public key and a first encryption algorithm, and the encrypted data is provided over a network.

Abstract: An apparatus includes a plurality of connection-source terminating units. Each of the plurality of connection-source terminating units constitutes an independent communication path coupled to a corresponding one of a plurality of connection-destination terminating units provided for a connection-destination apparatus. The apparatus establishes encryption information including first information used for encryption processing on communication performed via a plurality of the independent communication paths established between the apparatus and the connection-destination apparatus. The first information is used in common for all the plurality of the independent communication paths when packets are transmitted through the plurality of the independent communication paths established between the communication apparatus and the connection-destination apparatus.

Abstract: A network operations center (130) provides secure communication between fixed IP address based encryption devices (114,154) in an enclave (110) and on a handheld communication device (150) deployed on a dynamic IP address based wireless carrier network (140). In communication from the enclave (110) to the handheld device (150) a fixed IP address based data packet (310) is obtained from the enclave (110) and encapsulated into a network data packet (320) which is provided over the wireless carrier network (140) to the handheld device (150) for decapsulating the fixed IP address based data packet (410) from the network data packet (320). In communication from the handheld device (150) to the enclave (110) a fixed IP address based data packet (710) is decapsulated from a network data packet (620) into which it has been encapsulated by the handheld device (150) and provided to the enclave (110).

Abstract: Authorizing remote access points for use in a network: After the remote access point is provisioned to communicate securely to a controller using its TCP/IP address provided by a user, the remote access point is put into an un-authorized state by the controller pending further authorization. The user is presented with a secure captive portal page authenticating the end-user. User's authentication credentials are verified by the controller. After the remote access point has been authorized, the controller marks it verified as a fully functional node, and saves this state. The remote access point is provisioned with the current provisioning parameters for the remote access point as configured by the IT administrator for the end user, so that each remote access point can have unique per-user configuration applied.

Abstract: Scalable session management is achieved by generating a cookie that includes an encrypted session key and encrypted cookie data. The cookie data is encrypted using the session key. The session key is then signed and encrypted using one or more public/private key pairs. The encrypted session key can be decrypted and verified using the same private/public key pair(s). Once verified, the decrypted session key can then be used to decrypt and verify the encrypted cookie data. A first server having the private/public key pair(s) may generate the cookie using a randomly generated session key. A second server having the same private/public key pair(s) may decrypt and verify the cookie even if the session key is not initially installed on the second server. A session key cache may be used to provide session key lookup to save public/private key operations on the servers.

Abstract: The present invention relates to a solution for handling security issues of non access stratum (NAS) signaling in a telecommunications network (100) The NAS signaling is performed between a user equipment (UE) and a mobility management node, e.g. a mobility management entity (MME) The solution is realized in a device and in a method comprising steps of receiving an initial non access stratum message from the UE (101) communicating wirelessly (105) with the telecommunications network, determining security context status for the UE, determining if un-ciphered mode is to be used in the security context, set ciphering algorithm to a null ciphering algorithm, transmitting a security context and activation message to the UE, comprising information indicating ciphering algorithm, and receiving a security context activation acknowledge message from the UE.

Abstract: A public key infrastructure comprises a client side to request and utilize certificates in communication across a network and a server side to administer issuance and maintenance of said certificates. The server side has a portal to receive requests for a certificate from a client. A first policy engine to processes such requests in accordance with a set of predefined protocols. A certification authority is also provided to generate certificates upon receipt of a request from the portal. The CA has a second policy engine to implement a set of predefined policies in the generation of a certificate. Each of the policy engines includes at least one policy configured as a software component e.g. a Java bean, to perform the discreet functions associated with the policy and generate notification in response to a change in state upon completion of the policy.

Abstract: Systems and methods for combating and thwarting attacks by cybercriminals are provided. Network security appliances interposed between computer systems and public networks, such as the Internet, are configured to perform defensive and/or offensive actions against botnets and/or other cyber threats. According to some embodiments, network security appliances may be configured to perform coordinated defensive and/or offensive actions with other network security appliances.

Abstract: Methods and apparatuses to filter multimedia content are described. The multimedia content in one embodiment is analyzed for one or more parameters. The multimedia content in one embodiment is filtered based on the one or more parameters using a latent semantic mapping (“LSM”) filter. In one embodiment, the one or more parameters include information about a structure of the multimedia content. A tag that encapsulates the one or more parameters may be generated. Then, the tag is input into the latent semantic mapping filter. In one embodiment, the LSM filter is trained to recognize the multimedia content based on the one or more parameters. In one embodiment, more than two categories are provided for a multimedia content. The multimedia content is classified in more than two categories using the LSM filter. The multimedia content may be blocked based on the classifying.

Abstract: Various embodiments of the disclosed subject matter provide methods and systems for improved efficiency in spoke-to-spoke network communication. Embodiments provide systems and methods for registering a spoke with a hub, updating at least one database with spoke registration information at the hub, and advertising the spoke registration information to other spokes using a single control plane that includes transport security, peer discovery, and unicast routing information.

Abstract: Communications can be processed with multiple countermeasures to identify attacks. Each countermeasure can compute a probability of a communication containing an attack and an accompanying confidence score indicating confidence in the probability. Combining the probabilities can produce a composite probability and associated confidence of the communication containing an attack. The composite probability and confidence scores can be produced from a weighted combination of the individual countermeasure probabilities and confidence scores. Weighting factors can be generated or obtained from a database that stores profiles of confirmed attacks.

Abstract: The connectivity and security of wireless handheld devices (HDs) can he leveraged to provide a presentation appliance (PA) (e.g. a laptop) with an ability to securely communicate with an enterprise's private network. A split-proxy server, with part of it executing on the HD and a part executing on the PA, implements a full HTTP 1.1 compliant Internet/Web Proxy to couple the PA for communication through the HD. Support for the pragmatic keep-alive header, the CONNECT method, socket connection sharing, and thread pooling, enables a fully functional browsing environment to access web-based applications that are built on standard Internet technologies without the need for re-rendering or re-writing the user interfaces to suit the HD. In addition, Intranet web-based applications are made securely accessible without the need for additional VPN and remote access technologies. The PA may be configured to prevent residual storage of sensitive data on the PA.

Abstract: The disclosure provides a method and apparatus for transmitting data securely using an unreliable communication protocol, such as User Datagram Protocol. In one variation, the disclosure describes retaining compatibility with conventional Secure Sockets Layer (SSL) and SOCKS protocols, such that secure UDP datagrams can be transmitted between a proxy server and a client computer in a manner analogous to conventional SOCKS processing. Further, the disclosure describes a network arrangement that employs a cache having copies distributed among a plurality of different locations. SSL/TLS session information for a session with each of the proxy servers is stored in the cache so that it is accessible to at least one other proxy server. Using this arrangement, cached SSL/TLS communication session information may be retrieved and used by a second proxy server to accept a session with the client device when the client device switches proxy servers.

Abstract: One or more requests are received from a first system. The requests are queued in a queue. A serialization group is determined for a request and the request is associated with the determined serialization group. At least a subset of the requests from the queue is transmitted to a second system if the second system is available, including transmitting requests in a respective serialization group to the second system serially in accordance with an ordering of the requests within the respective serialization group.

Abstract: Utilizing the AAA infrastructure to dynamically allocate the various parameters needed to establish the security association between the Foreign Agent and the Home Agent. The present invention uses the AAA server as a central entity to dynamically generate and distribute the chosen security association parameters needed to support the Foreign Agent and Home Agent security association based on a request from the Foreign Agent. The AAA server can also dynamically assigns a unique SPI value to the Foreign Agent and Home Agent pairs. The various parameters that can be allocated in the present invention include a FA-HA shared secret key or a public/private key pair, an authentication algorithm and mode, a FA-HA secret key lifetime, and security parameter index or security index values. The present invention also can assist in making sure that the Foreign Agent and the Home Agent stay synchronized with respect to their security association.

Abstract: A method, a computer readable medium and a system of multi-domain login and messaging are provided. The method for multi-domain login comprises inputting a local password by an agent, accessing a password vault with the local password, and retrieving at least one hidden password from the password vault, and logging the agent into at least one agent application using the at least one hidden password. The method for multi-domain messaging comprises retrieving information of an agent from a database, retrieving at least one skill group to which the agent belongs from the information, retrieving a message linked to the at least one skill group, and sending the message to the agent.

Abstract: A method for enabling efficient SSL handshakes through pre-computing of handshake messages, the method includes: receiving, by an appliance, a server certificate identifying a server; generating, by the appliance, at least one of: (i) an SSL server certificate message comprising the received server certificate, (ii) an SSL client certificate request message, and (iii) an SSL hello done message; storing, by the appliance, the generated messages; receiving, by the appliance from a client, an SSL client hello message identifying the server; and transmitting, by the appliance to the client, an SSL server hello message and at least one of the stored messages. Corresponding systems are also described.

Abstract: A system and method for providing load balanced secure media content and data delivery (10) in a distributed computing environment is disclosed. Media content is segmented and encrypted into a set of individual encrypted segments on a centralized control center (15). Each individual encrypted segment has the same fixed size. The complete set of individual encrypted segments is staged to a plurality of intermediate control nodes (17, 19). Individual encrypted segments are mirrored from the staged complete set to a plurality of intermediate servers (21a-b, 23a-b). Requests are received from clients (11) for the media content at the centralized control center. Each individual encrypted segment in the set is received from one of an intermediate control node and an intermediate server optimally sited from the requesting client. The individual encrypted segments are reassembled into the media content for media playback.

Abstract: In order for intermediary WAAS devices to process and accelerate ICA traffic, they must decrypt the ICA traffic in order to examine it. Disclosed is a mechanism by which the ICA traffic may be re-encrypted for transport over the WAN in a manner that does not require explicit configuration by the administrator of the WAAS devices. For example, VDI traffic may be intercepted and all data redundancy elimination messages may be encrypted and sent to a peer network device.

Abstract: According to one embodiment, a reception unit receives post-office box's encrypted data, which is obtained by encrypting the data by using a post-office box's public key, from the sending apparatus. A re-encryption key storage unit stores a re-encryption key used for re-encrypting the post-office box's encrypted data into recipient's encrypted data, which is obtained by encrypting the data using a recipient's public key that is different from the post-office box's public key. A re-encryption unit re-encrypts the received post-office box's encrypted data to the recipient's encrypted data using the re-encryption key stored in the re-encryption key storage unit. A transmission unit transmits the re-encrypted recipient's encrypted data to the receiving apparatus.

Abstract: An improved system and method are disclosed for peer-to-peer communications. In one example, the method enables endpoints to securely send and receive messages to one another within a hybrid peer-to-peer environment.

Abstract: An outer COM object can be provided with privileged access to protected functionality in an inner COM object. An inner COM object can offer a custom protected interface to an outer COM object by creating a new inner internals COM object that is not available to a calling application or by creating a new extension IUnknown interface that can be used to access the protected content. An outer COM object can override behavior in an inner COM object. An inner COM object can offer access to custom behavior to an outer COM object by creating a new inner internals COM object that is not available to a calling application. The new inner internals COM object can implement a new interface that provides access to the customized (override) content or can create a new extension IUnknown interface that can be used to provide access to the customized (override) content.

Abstract: Systems and methods of authorizing a portable communication device to access a network resource. In an embodiment, a request to access a network resource is received from a portable communication device via a network. A processor is used to dynamically and selectively determine whether the portable communication device is authorized to access the requested network resource. The determination may be based on a unique identifying attribute associated with the portable communication device without the unique identifying attribute being predefined in a user profile database and without querying the portable communication device or its user for information. If the portable communication device is authorized, it may be allowed to access the network resource. Otherwise, it may be redirected to an authentication system where it may be enabled to submit authentication-related information so that it may be authorized to access the requested network resource.

Abstract: A set-top-box has on-chip OTP memory emulated using an external flash memory and a series of on-chip fuses. The external memory is comprised of one or more regions, each having its own unique region identification. Each on-chip fuse corresponds to one of the memory regions and comprises a component which can be caused to change to a particular (blown) state irreversibly. When data first needs to be written to a region of the external memory, the identification of that region is appended to the data itself together with a parity field and a validity field. The resultant data packet is then encrypted by a cryptographic circuit using a secret key unique to the set-top-box and the encrypted data packet is written to the specified region of the external memory. Then, the on-chip fuse corresponding to the region that has been written to is irreversibly blown, effectively locking that region.

Abstract: Transaction accelerators can be configured to terminate secure connections. A server-side accelerator intercepts a secure connection request that is from a client and that is directed to a server. The server-side accelerator responds to the secure connection request in place of the server, thereby establishing a secure connection between the client and the server-side accelerator. Alternatively, the server-side accelerator monitors the establishment of a secure connection between the client and the server. After the secure connection has been established, the server-side accelerator forwards security information to a client-side accelerator, enabling the client-side accelerator to assume control of the secure connection. As a result of this arrangement, the client-side accelerator is able to encrypt and decrypt data on the secure connection and accelerate it in cooperation with the server-side accelerator.

Abstract: A distributed firewall of a gateway device includes at least one IO module for performing IO functionality of the distributed firewall, at least one security processing module for performing security functionality of the distributed firewall and a firewall controller for managing the IO module and the security processing module. Each of the at least one IO and security processing modules is executed within a virtual machine. In response to a packet received from an ingress interface, the at least one IO module is to identify a security processing module corresponding to a connections session associated with the packet, to transmit the packet to the identified security processing module to perform a security process on the packet, and in response to a signal received from the identified security processing module indicating that the security process has been completed, to transmit the packet to the egress interface.

Abstract: A method includes identifying a suspect node of a network that includes multiple nodes in wireless communication. The method also includes initiating formation of a sub-network of the network in response to identifying the suspect node. The suspect node is not a member of the sub-network. After formation of the sub-network, first communications between the suspect node and a device of the network are routed to or through at least one of the members of the sub-network. The sub-network is configured to enable second communications between members of the sub-network, where the second communications are communicated in a manner that is secured against access by the suspect node.

Abstract: A system and method provides secure channels for communication in a virtual universe by employing a packet interception layer for incoming and outgoing data packets. A data path is defined and is sequentially encrypted with the public keys of servers in the path. Decryption and identification of the next server occurs in a sequential manner in which the path is known only to the sender.

Abstract: Methods are provided for processing a packet received by a mesh-enabled access point (MAP). When a first MAP receives a packet it can determine whether the packet is destined for a mesh portal based on the destination address. If so, the first MAP can retrieve an encryption key corresponding to the mesh portal, use the encryption key to encrypt the packet and set a mesh forwarding flag in the packet to indicate that the packet is destined for a mesh portal, and is encrypted with an encryption key corresponding to the mesh portal, and then forward the packet to the next hop MAP towards the a mesh portal. The mesh forwarding flag indicates that the packet is destined for a mesh portal, is encrypted with an encryption key corresponding to the mesh portal, and is to be forwarded to the next hop MAP without performing decryption/re-encryption processing on the packet. When a MAP receives a packet, the first MAP it determines whether a mesh forwarding flag is set in the packet.

Abstract: This invention includes apparatus, systems, and methods to establish a virtual private network (“VPN”), or a secured network for authenticated and encrypted data transmission to prevent disclosure of private information to unauthorized parties. This invention provides secure and authenticated data transmission from a communication device to another device over any public or private network while using existing standard applications such as email, VoIP, internet browsers, ISR applications, video conferencing, telecommuting, inventory tracking and control, etc. without the need to secure or add encryption features into each specific application. This invention provides the opportunity to selectively secure one or more existing applications with configuration changes that can be made at the user-space level of the software stack and without need for higher level software stack access, such as root access.

Abstract: A method and system for consistent format preserving encryption (C-FPE) are provided to protect sensitive data while the sensitive data is in a domain while allowing encrypted sensitive data to be treated inside the domain as if it were the unencrypted sensitive data. The method includes inserting a transparent coupling into a data flow at a perimeter of the domain, and translating a sensitive data element from an unprotected data element to a protected data element using the transparent coupling such that the sensitive data element is a protected data element within the domain.

Abstract: A seed value is received and a resource encryption key is generated from the seed value. The resource encryption key may be sent to an application server such that the application server system is able to encrypt a resource using the resource encryption key. Authentication credentials and a wrapped key are received and the wrapped key is decrypted to generate an unwrapped key that includes the resource identifier, the resource encryption key, and the user identifier in unencrypted form. The user identifier is accessed from the unwrapped key it is determined that the received authentication credentials correspond to the accessed user identifier. The resource encryption key is sent in unencrypted form to the application server system such that the application server system can decrypt the resource using the resource encryption key in unencrypted form.

Abstract: A secure message that includes an attachment is received at a server. The secure message may have a secure layer that indicates that the secure message is at least digitally signed. The secure message may be provided without the attachment to the mobile device over a wireless network. A request may be received from the mobile device to access the attachment. The request may include an attachment identifier (ID) that identifies the attachment in accordance with a message-attachment indexing system. In response to the request to access the attachment, the server may perform an index lookup to find the attachment based upon the attachment ID, may look through the secure layer of the secure message in order to locate the attachment within the secure message, and may render at least an initial portion of the attachment by the server in a format for viewing by the mobile device.

Abstract: A method for data integrity protection includes arranging in an integrity hierarchy a plurality of data blocks, which contain data. The integrity hierarchy includes multiple levels of signature blocks containing signatures computed respectively over lower levels in the hierarchy, wherein the levels culminate in a top-level block containing a top-level signature computed over the hierarchy. A modification to be made in the data stored in a given data block is received. One or more of the signatures is recomputed in response to the modification, including the top-level signature. Copies of the given data block, and of the signature blocks, including a copy of the top-level block, are stored in respective locations in a storage medium. An indication that the copy is a valid version of the top-level block is recorded in the copy of the top-level block.

Abstract: Systems, methods and computer readable media are disclosed for a trusted proxy to intercept communications between an untrusted computerized gaming system and an online multi-player gaming service that requires games to be trusted, allowing the untrusted computerized gaming system to use the multi-player gaming service. In addition to allowing the untrusted computerized gaming system to use the multi-player gaming service in general, the trusted proxy can also limit the extent of the interaction between the untrusted computerized gaming system and the multi-player gaming service.

Abstract: The present invention supports a method for transmitting information packets across network firewalls. A trusted entity is provisioned with an address designation for a pinhole through the firewall during setup of a communication session between two communication devices. This pinhole address is used throughout the communication session between the two communication devices to transmit information packets onto and out of the communication network. Information packets addressed to the communication device inside the firewall are received by the trusted entity, which replaces address header information in the information packet with the address for the pinhole. The information packet is routed to the pinhole where it passes onto the network for routing to the communication device inside the firewall. Information packets transmitted from the network are also routed to the trusted entity for routing toward the communication device outside the firewall.

Abstract: A method and apparatus for controlling access restrictions for media resource playback may include defining a user-specific content control profile authorizing one or more classes of content to be delivered to a client device, generating a media resource request identifying a first media resource associated with a first class of content and one or more attributes of the content control profile, determining whether the first class of content has been authorized for delivery to the client device based at least in part upon the one or more attributes of the content control profile, and delivering the first media resource to the client device if the first class of content has been authorized for delivery to the client device.

Abstract: A system that enables a cloud-based data repository to function as a secure ‘drop-box’ for data that corresponds to a user is provided. The ‘drop box’ can be facilitated through the use of cryptographic keying technologies. For instance, data that is ‘dropped’ by or on behalf of a particular user can be encrypted using a public key that corresponds to a user-specific private key. Thus, although the data resides within the large pool of ‘cloud-based’ data, it is protected since it can only be decrypted by using the private key, which is kept secret. The innovation can further facilitate user-centric secure storage by partitioning the cloud-based repository into multiple partitions, each of which corresponds to specific indexing criteria.

Abstract: Authentication credentials are received at a key server system. A service associated with the wrapped key is identified. A master key is accessed based on the identified service, the master key being associated with the identified service. The wrapped key is decrypted to generate an unwrapped key that includes the resource identifier, the resource encryption key, and the user identifier in unencrypted form. The user identifier is identified accessed from the unwrapped key. The received authentication credentials are determined to correspond to the accessed user identifier. In response to determining that the received authentication credentials correspond to the accessed user identifier, the resource encryption key are sent in unecrypted to the application server system such that the application server system can decrypt the resource using the resource encryption key in unencrypted form.

Abstract: A method, a cluster system, and a computer-readable medium for distributing data packets addressed to at least one virtual address over a communication network using a protocol, which allows for at least some content of the data packet to be encrypted, to a multiplicity of service nodes. The method includes receiving incoming data packets addressed to a virtual address through a packet analyzer and identifying whether the incoming data packets are encrypted. Each encryption data packet is forwarded to a decryption module and a decrypted data packet is returned. Based on the decrypted data packet, a scheduling decision is made by a scheduling module. Scheduling data is then combined with the originally received encrypted data packet such that the encrypted data packet can be forwarded to one service node for further processing.

Abstract: A data encryption engine and method for using to selectively encrypt communications. Data is received from a source device into the data encryption engine. The data encryption engine determines whether or not to encrypt the data based on a source device preference, a target device preference, a comparison of priority numbers for the source device and target device, the transport medium, the relationship between the source device and target device, a type/level of encryption or some combination. If the data is determined to need encryption, the data encryption device may encrypt the data or may flag the data for encryption by the target device. Otherwise the unencrypted data may be forwarded to the target device.

Abstract: A sentinel value is combined with a data segment, and encrypted. A digest of the encrypted combined data segment is calculated, and used in conjunction with an encryption key to generate a masked key. This masked key is then appended to the encrypted combined data segment and transmitted to an encoder. When the data segment is retrieved, the original encryption key can be recovered and used to decrypt the data segment. The sentinel value can then be extracted from the data segment and checked for integrity. The data segment can then be delivered, discarded, flagged, or otherwise handled based on the integrity of the sentinel value.

Abstract: Techniques for dynamically configuring security mechanisms in a network can construct security perimeters that satisfy security needs at any given time while also efficiently spreading security functions among network elements and systems. In one technique, a network element comprises security function modules. Systems toward which the network element forwards data packets also comprise security function modules. A particular security function module on the network element begins in a state of deactivation. The network element determines whether a corresponding security function module on one of the systems is functioning in a satisfactory manner. If not, then the network element activates the particular security function module. While activated, the particular security function module may perform at least some of the security function operations that the corresponding security function module would have performed if the corresponding security function module was satisfactory.