Abstract: In one embodiment, a method by an apparatus of a Border Gateway Protocol-Link State (BGP-LS) environment includes receiving an attestation token from a first component and encoding the attestation token in a BGP-LS signaling message. The method further includes sending the BGP-LS signaling message with the encoded attestation token to a second component of the BGP-LS environment.

Abstract: Systems, devices, and methods are discussed for avoiding data thefts in real-time transactions.

Abstract: A method including receiving, by a device, a sharing link to be utilized by the device to obtain access to encrypted content, the sharing link including a static portion and a dynamic portion; transmitting, by the device, a request to access the encrypted content, the request being routed based at least in part on the static portion and the request identifying the encrypted content in the dynamic portion; receiving, by the device, access to the encrypted content based at least in part on transmitting the request. Various other aspects are contemplated.

Abstract: A device for authenticating an organisation requesting access to user data, comprising: network interface circuitry configured to communicate over a network, and processing circuitry configured to: receive, via the network interface circuitry, encrypted user data from an information processing apparatus; generate a unique identifier to associate with a decryption key used for decrypting the encrypted user data; provide the encrypted user data and the unique identifier to a publically available database for storage immutably therein or thereon; store the decryption key in association with the unique identifier; receive, via the network interface circuitry, a request to access the user data from an organisation; establish that the requesting organisation is an approved organisation; and in the event that the requesting organisation is an approved organisation; transmit, via the network interface circuitry, the decryption key to the requesting organisation.

Abstract: A method for transmitting message frames, comprising: generating, by an end device comprising a processor, a first message frame portion comprising a first plain header; obtaining a device identifier (DevEUI) and a header blinding key (HdrBKey); generating a first header mask using the DevEUI and the HdrBKey; obtaining a first blinded header by applying the first header mask to the first plain header; obtaining a first updated message frame portion by updating the first message portion using the first blinded header; generating a first blinded message frame comprising the first updated message frame portion; and transmitting the first blinded message frame to a network gateway.

Abstract: A network device includes a memory, a memory access circuit, and a processor. The memory is configured to store a hash table for accessing a database of network addresses, the hash table including multiple buckets, each bucket dimensioned to store entries for up to a maximal permitted number of the network addresses. The memory access circuit is configured to receive a network address, to calculate a hash value over at least the network address by applying a hashing scheme selected from among a plurality of hashing schemes, to choose a bucket of the hash table based on the hash value, and to access information in the database pertaining to the network address by accessing the selected bucket. The processor is configured to select the hashing scheme to ensure that none of the buckets will be mapped to more than the maximal permitted number of the network addresses.

Abstract: A method including transmitting, by a device, encrypted content to an endpoint capable of managing access to the encrypted content; determining, by the device, a sharing link including a static portion and a dynamic portion, the static portion being associated with the endpoint and the dynamic portion including a unique identifier associated with the encrypted content; and transmitting, by the device, the dynamic portion of the sharing link to the endpoint to enable the endpoint to provide another device with access to the encrypted content. Various other aspects are contemplated.

Abstract: Example methods and systems for logical network packet handling are described. In one example, a physical network interface controller (PNIC) may receive an egress packet associated with a packet flow via a first virtual function supported by the PNIC. The PNIC may steer the egress packet towards a processing pipeline by applying a filter associated with the first virtual function or content of the egress packet, or both. The egress packet may be processed using the processing pipeline to generate a processed packet by (a) retrieving a logical network policy associated with the packet flow from a datastore on the PNIC and (b) performing one or more actions according to the logical network policy. The processed packet may be forwarded towards the destination via a second virtual function supported by the PNIC or a physical network connected to the PNIC.

Abstract: A method including communicating, by a first device, data with a second device based at least in part on communication information indicating a communication parameter associated with the second device, the data being communicated over a meshnet connection associated with a mesh network; receiving, by the first device while communicating the data in the mesh network, updated communication information indicating an updated communication parameter associated with the second device; and communicating, by the first device, the data with the second device over the meshnet connection based at least in part on the updated communication information. Various other aspects are contemplated.

Abstract: Example methods and systems for logical network packet handling are described. In one example, a physical network interface controller (PNIC) may receive an ingress encapsulated packet associated with a packet flow via a physical network. The ingress encapsulated packet may include an outer header and an inner packet that is destined for a virtualized computing instance. The ingress encapsulated packet may be steered towards a processing pipeline for processing to generate a processed packet. The processing pipeline may include (a) retrieving a logical network policy associated with the packet flow from a datastore on the PNIC; and (b) performing decapsulation to remove the outer header and one or more actions on the inner packet according to the logical network policy. The processed packet may be forwarded towards the virtualized computing instance via a virtual function supported by the PNIC or a physical network connected to the PNIC.

Abstract: A first communication apparatus may repeat a broadcast transmission of a trigger signal via a second interface, which is a signal to be used by a second communication apparatus as a trigger for sending a wireless connection request to the first communication apparatus. The wireless connection request may be for forming a first wireless network to which both the first communication apparatus and the second communication apparatus belong. The first wireless network may be a network for performing a wireless communication via a first interface. The first communication apparatus may receive the wireless connection request via the first interface from the second communication apparatus which has received the trigger signal, and establish a first wireless connection via the first interface with the second communication apparatus so as to form the first wireless network.

Abstract: A device may receive, from a network device, a user equipment (UE) parameter update request notification indicating an update to a UE parameter of a universal subscriber identity module (USIM), and may generate an encrypted UE parameter update request. The device may cause the encrypted UE parameter update request to be provided to the USIM to cause the USIM to update the UE parameter and to generate an encrypted UE parameter update response. The device may receive, from the network device, the encrypted UE parameter update response, and may verify an authenticity of content of the encrypted UE parameter update response based on whether the encrypted UE parameter update response is signed by the USIM. The device may provide, to the network device, a result indicating whether the UE parameter is updated and whether the authenticity of the content of the encrypted UE parameter update response is verified.

Abstract: A method includes communicatively coupling a shared computing resource to core computing resources associated with a first project. The core computing resources associated with the first project are configured to use the shared computing resource to perform data processing operations associated with the first project. The method also includes reassigning the shared computing resource to a second project by (i) powering down the shared computing resource, (ii) disconnecting the shared computing resource from the core computing resources associated with the first project, (iii) communicatively coupling the shared computing resource to core computing resources associated with the second project, and (iv) powering up the shared computing resource. The core computing resources associated with the second project are configured to use the shared computing resource to perform data processing operations associated with the second project.

Abstract: The present disclosure presents an exemplary tier-based reconfigurable security architecture that can adapt to different use-case scenarios by selecting security tiers and configure parameters in each security tier based on system requirements. An exemplary system comprises a security agent that is configured to monitor system characteristics of embedded components on a system-on-chip and communicate a status of the system characteristics to a reconfigurable service engine integrated on the system-on-chip, such that the reconfigurable service engine is configured to activate one of a plurality of tiers of security based at least upon the status of the system characteristics communicated.

Abstract: A method of operating a storage means, wherein for writing and storing a storage item to the storage means the storage item to be written and stored—in particular by using the concept and theory of identification—is provided, a encoding process by means of randomization is applied to the storage item to generate and to provide a randomized encoded storage item, and the randomized encoded storage item is written and stored to the storage means. At least a first randomization process is underlying the encoding process and is a randomization process dedicated and assigned to the underlying storage means. The present disclosure further refers to a unit for operating a storage means, to a storage means and to a system for processing data. By having two randomization processes underlying the encoding process, a distinction can be made between a secrecy insuring and secrecy non-ensuring randomization processes.

Abstract: Systems and methods are provided to generate an attack surface for a protected entity. The method an include receiving identifying information associated with the protected entity; scanning one or more third parties to identify a host associated with the protected entity; determining that the host resolves to a webpage; resolving the webpage; extracting a uniform resource locator (URL) from the resolved webpage; determining, based on at least one rule, that the URL is associated with the protected entity; and generating the attack surface for the protected entity, the attack surface comprising the URL.

Abstract: Techniques for utilizing an enterprise traffic interception service (TIS) to enforce policies that mandate how clients access software as a service (SaaS) offered by service providers and selectively intercept enterprise network traffic utilizing a domain name service (DNS) and a single sign-on (SSO) service on a per-client per-service basis. The TIS may include a DNS server, an identity provider service, a TLS inspecting proxy, and/or a policy server. The DNS server may handle requests to resolve an address of a service, and identify a policy, stored in the policy server, to redirect the client based on the identity of the client and the service. The identity provider service may later query the policy server during client authorization for the service to verify that the client request is in line with the policy and allow or deny access to the service.

Abstract: A relay node and method for encapsulating a packet based on a tunneling protocol. The relay node includes a communication device, a storage device, and a processor. The communication device communicates with a receiving node and a transmitting node; the storage device stores multiple instructions; and the processor is coupled to the communication device and the storage device for loading and executing the multiple instructions stored in the storage device to: control the communication device to receive a packet transmitted by the transmitting node; generate a protocol header related to the packet based on the packet, and calculate a checksum as a checksum block in the multiple sections using multiple sections in the protocol header at least; generate an encapsulated packet including the protocol header and the packet; and transmit the encapsulated packet to the receiving node through the communication device for verifying the checksum block.

Abstract: A method comprising receiving, by a one-time pad (OTP) hub, from a first user of a computer network, a communication encrypted with an OTP associated with said first user, wherein said communication is intended for a second user; encrypting, by said hub, said communication with an OTP associated with said second user; decrypting, by said hub, said communication with an OTP associated with said first user; and delivering said communication to said second user.

Abstract: Traffic broadcast to a VLAN is restricted. To do so, a plurality of stations are associated with a BSSID (basic service set identifier). A first VLAN is configured by sending a first group key to each station from the plurality of stations that is a member of the first VLAN, wherein each VLAN is associated with a unique group key. One or more frames addressed to the first VLAN are received. The one or more frames are encrypted with the first group key to prevent stations without the first group key from being able to decrypt the one or more frames. The one or more encrypted VLAN frames are broadcast to the plurality of stations associated with the BSSID.

Abstract: Systems and methods may include sending, to a network registrar, a first message including a first nonce generated by a host computing device, and receiving, from the network registrar, a second message including a second nonce, the second nonce being signed by the network registrar via a private key of a first public key infrastructure (PKI) key pair of the network registrar via a first signature. The method further includes sending a first neighbor advertisement (NA) message to the host computing device including the second nonce. The second nonce and the private key of the network registrar verifies the first signature from the network registrar, the verification of the first signature indicating that the router is not impersonating the network.

Abstract: A verified method of high-value, person-to-person communication is provided. The method comprises creating a unique dynamic messaging link recognizable to a selected intended recipient; creating a transmissible personal hypermedia message to which the link is assigned; and storing the hypermedia message on a device accessible to a network. The link comprises a recognizable proprietary domain name and a random hash code. The individual is sent a direct message and the device is monitored for transmission thereto of the link, analyzing and storing accompanying metadata. The direct message contains an invitation to click on the link over the imprimatur of a person known to the recipient. The invitation contains descriptive material relating to the hypermedia message. Upon activation of the link, without redirection, the hypermedia message is transmitted to the recipient and the sender is notified. The sender is alerted if the link has not been activated within a predetermined period.

Abstract: Multi-tenant optimized serverless placement using network interface card and commodity storage may be provided. A first request to execute a first function may be received. Next, it may be determined to execute the first function at a first network interface card. The first network interface card may include a plurality of processors. Then, a container may be created at the first network interface card. The container may have at least one processor of the plurality of processors. The first function may be executed at the container.

Abstract: A method for operating a bus system, in which a message of the bus system is received and its validity is ascertained, wherein, if it was ascertained that the message is “malicious”, a new message is sent to the designated receiver of this “non-malicious” message, the content of the new message having been previously rated as “non-malicious.

Abstract: Embodiments of the present disclosure may provide a system comprising a client source device, a server, and a client viewing device. The client source device may be configured to: encode content as a plurality of fragments of at least one quality parameter, send each encoded fragment to a cloud storage, generate metadata associated with each encoded fragment, and provide the generated metadata associated with each encoded fragment. The server may be configured to: receive each encoded fragment, store each encoded fragment into the cloud storage for retrieval, and facilitate an authentication for access to the metadata associated with each encoded fragment. A client viewing device configured to request the authentication for access to the metadata, receive the metadata, determine a desired fragment of the plurality of fragments encoded in a desired quality parameter, and retrieve the desired fragment in the desired quality parameter.

Abstract: A speech signal processing method of a user terminal includes: receiving a speech signal, detecting a personalized information section including personal information in the speech signal, performing data processing on the personalized information section of the speech signal by using a personalized model generated based on the personal information, and receiving, from a server, a result of the data processing performed by the server on a general information section of the speech signal that is different than the personalized information section of the speech signal.

Abstract: An information handling system may include a host system having an initial operating system image deployed thereon; and a management controller configured to provide out-of-band management of the information handling system. The management controller may be further configured to: receive, via a secure management network, a request to configure a plurality of operating system settings; transmit, to an initial agent executing on the operating system, one or more instructions to configure the plurality of operating system settings in accordance with the request; and after the configuration of the plurality of operating system settings, allow a user to log in to the operating system via a non-secure data network.

Abstract: Methods, systems, and apparatuses embodied herein control and track access to secured data independent of the asset storing the secured data. In this regard, some embodiments organize volumes including one or more datasets and attach one or more assets to each volume. Some embodiments further receive data permissions of use information, for example from a data steward device, for the volume and datasets, which are registered with the volume and the datasets. Some embodiments further receive a set of restrictions, retrieve the dataset permissions of use information for one or more dataset identifiers, and determine the restrictions do not conflict with the dataset permissions of use information. Some embodiments further generate, and subsequently store, an indication the set of restrictions is valid when the dataset permissions of use information does not conflict. Permissions of use information may be organized into persona data objects assigned to various user profiles.

Abstract: An intelligent disaster prevention system and an intelligent disaster prevention method are provided. The intelligent disaster prevention system includes a server and an electronic device coupled to the server. The server detects the electronic device in a disaster area and obtains a location information of the electronic device. The server obtains real-time disaster information from a website. The server obtains a real-time aerial image corresponding to the disaster area. The server selects a first refuge from a plurality of refuges corresponding to the disaster area according to the location information, the real-time disaster information, and the real-time aerial image, and calculates an evacuation route from the location information to the first refuge. The electronic device receives the first refuge and the evacuation route, and displays the first refuge and the evacuation route on a map.

Abstract: A mesh receiver has a wakeup receiver for reception of a wakeup sequence formed by keyed RF or a sequence of wireless packets and gaps, a transmitter forming low speed RF wakeup sequence to other mesh stations, a mesh receiver for reception of high speed WLAN packets, the transmitter sending a wireless ACK packet in response to a wakeup sequence, the mesh receiver thereafter receiving wireless packets from a remote station, the mesh transmitter sending an ACK, the mesh station thereafter identifying a next hop station, and sending a wakeup sequence to that station, after receipt of an ACK, sending the data, the mesh receiver and mesh transmitter thereafter going to sleep.

Abstract: Presented herein are techniques that provide for a way to associate a policy, or signal the policy for a user equipment (UE), directly from the UE traffic, inband or, in other words, within the data plane. The policies are effectively embedded in the address of the UE traffic. When the Neutral Host Network (NHN) receives the UE traffic, the policy can be determined directly from the address associated with the UE traffic. This provides for a unique way of integrating a service chain identifier in the Internet Protocol address of the UE to identify the services/policies to be applied to UE traffic in a stateless manner.

Abstract: A key originating device generates a subject key that is managed by a policy. The subject key may be generated and the policy configured at the instruction of a user, an application, or a service, such as a provisioning service. The policy that manages the subject key identifies at least one or more entities that are authorized to receive the subject key. The subject key is provided varying layers of encryption as it is communicated between the originating device, an escrow services, and an authorized entity.

Abstract: The secret calculation system comprises three secret calculation apparatuses. An ith secret calculation apparatus (i=1, 2, 3) comprises a holder that holds (S[i], T[i]) and (S?[i], T?[i]) as distributed values of an n-bit number W and an n-bit W? (n is any natural number), respectively; a first multiplicator that derives a logical conjunction of S[i] and S?[i]; a second multiplicator that derives a logical conjunction of T[i] and T?[i]; and a first subtractor that derives a difference between the logical conjunction derived by the first multiplicator and the logical conjunction derived by the second multiplicator.

Abstract: A system and method that provides for the routing and delivery of services to consumers by providers is disclosed. The system enables providers to advertise and list the products and services they provide, and customers to solicit bids or to otherwise seek to engage a provider to perform a service or from whom to purchase a good. The system may store customer and provider information in databases to be searched to identify a match between customer and provider. The system transmits navigation information to the provider's device to travel to the final destination. The navigation information includes an intermediary destination the provider must reach before being presented with the final destination. The system may include a notification feature to notify a customer or third party regarding the location of the provider or the status of a requested service or delivery.

Abstract: Proof onions for transactions for smart contracts are stored. Details of the transactions are stored on blockchains separate from the proof onions. The proof onions are evidence structures for the steps taken to create any transaction for the smart contract. The proof onions include a plurality of signatures or other cryptographic proofs. A proof request that is associated with at least a first transaction of the transactions is received. A first proof onion of the proof onions that corresponds to the first transaction is retrieved. A plurality of public keys associated with the first proof onion is obtained. The plurality of public keys is used to validate the first proof onion. In response to the validation of the first proof onion, the proof request is responded to with at least an indication of the validity of the first transaction.

Abstract: A method for generating debuggable obfuscated script includes embedding into a Web page, a query to a data store of a client for a key disposed within fixed storage of the client, further embedding into the Web page both an encrypted network reference to an un-obfuscated, clear form of a script, the encrypted network reference being decryptable with the key, and also an un-encrypted reference to an obfuscated form of the script and yet further embedding into the Web page, a selection directive selecting and decrypting the encrypted network reference to retrieve the un-obfuscated form upon loading the Web page on the condition that the key is found in the fixed storage, but otherwise selecting the un-encrypted reference to retrieve the obfuscated form. The method additionally includes serving the Web page to the client.

Abstract: Methods and systems for a device identification system may be provided. The device identification system may determine an identity of a user device associated with a transaction. The identity may be determined by network address information, hard link information, soft link information, and/or other such information. The network address information may include IPv4 information, IPv6 information, a device ID, and/or other such information. The identity of the user device may be determined and a transaction conducted from the user device may be assigned a fraudulent transaction risk score according to the information. Transactions that are determined to be at a high risk of fraud may be reviewed or otherwise flagged and/or canceled.

Abstract: The present invention provides an information processing apparatus including: a destination setting unit configured to set a destination of an issuance request for an electronic certificate of a public key; a transmitting unit configured to transmit the issuance request to the destination at a time specified by a user; and an acquiring unit configured to acquire, from an external apparatus that is the destination, the electronic certificate that is issued on the basis of the issuance request transmitted to the destination. The information processing apparatus further includes a display control unit configured to display a setting screen on a display unit, the setting screen being a screen for receiving a setting of the destination. The display control unit prevents the setting screen from being displayed while the setting for transmitting the issuance request at the time specified by the user is in an enable state.

Abstract: An information processing apparatus includes a determination unit, a first acquisition unit, and a controller. The determination unit receives, from a first terminal apparatus, a request for use issued to a document management apparatus and specifies an authentication mode necessary for the use. The first acquisition unit acquires information indicating an authentication mode supported by the first terminal apparatus. The controller performs, in a case where the authentication mode indicated by the acquired information does not match the specified authentication mode, control to output to the first terminal apparatus information on a second terminal apparatus that supports the specified authentication mode.

Abstract: A method implemented by a sending host entity comprises sending, by the sending host entity, a data packet to a receiving host entity, a source identifier field of the data packet comprising an anonymized identifier of the sending host entity, the anonymized identifier being a temporary identifier of the sending host entity, and sending, by the sending host entity to a distributed mapping system, a request for the distributed mapping system to send information identifying the sending host entity to the receiving host entity.

Abstract: The present disclosure relates to a verification code obtaining method. In one example method, a verification code obtaining request is sent by an application to a server. The application is installed on a terminal. Applications installed on the terminal further include an input method application and a Short Message Service (SMS) message application. An SMS message that includes a verification code and that is sent by the server is received by the SMS message application. The verification code in the SMS message is read by the input method application. The terminal does not allow an application other than the input method application and the SMS message application to read an SMS message in the terminal.

Abstract: A processing system may obtain an operations set associated with database sources of a database system from a client entity, the operations set including a statement, the statement including a query, identify data sets from the operations set, transmit, a request to a first owner to permit access to a first data set, and a request to a second owner to permit access to a second data set, and receive approvals from the first and second owners. The processing system may retrieve a first portion of data stored in the first data set and a second portion of data stored in the second data set in accordance with the approvals, execute the operations set in accordance with the first portion of data and the second portion of data to generate a result set, and provide the client entity access to the result set.

Abstract: Multicast messaging may be managed in a machine-to-machine/Internet of things context, such as a CoAP network, via the inclusion of server selection criterion in multicast request messages and/or resource directory registration management. Server selection criteria may be explicit or implicit. An explicit criterion may be expressed, for example, as an IP address, a server identifier relative to a group context, or a Bloom filter. An implicit criterion may, for example, relate to the context of the request or the requestor, and include such information as data accuracy, data type, application, operating system, network location, geolocation, resource creation time, and resource update time. Server selection criteria may be maintained by a resource directory and/or via a user interface.

Abstract: A method and an apparatus for trusted measurement, where the method includes: obtaining a first processing result by performing a first-manner processing on a code segment, and using a result obtained by performing a second-manner processing on the first processing result as a reference value; obtaining, at a first moment when the system is running, a second processing result by performing the first-manner processing on the code segment, and obtaining a first measurement value by performing the second-manner processing on the second processing result; and determining whether the first measurement value and the reference value are equal, and when the first measurement value and the reference value are equal, the system is trusted, where the code segment in the memory is a code segment that does not change with normal running of the system during one start-up and a running process of the system.

Abstract: A method, apparatus, and computer program product are disclosed for locally monitoring Internet of Things (IoT) devices without the need to interact via an IoT network intermediary. An example method includes receiving signals transmitted by one or more devices and identifying, by a communication device, a nearest device of the one or more devices based on the received signals. The method subsequently includes intercepting, by the communication device, advertisements transmitted by the nearest device, and causing display, based on the intercepted advertisements, of state information of the nearest device.

Abstract: A method for generating debuggable obfuscated script includes embedding into a Web page, a query to a data store of a client for a key disposed within fixed storage of the client, further embedding into the Web page both an encrypted network reference to an un-obfuscated, clear form of a script, the encrypted network reference being decryptable with the key, and also an un-encrypted reference to an obfuscated form of the script and yet further embedding into the Web page, a selection directive selecting and decrypting the encrypted network reference to retrieve the un-obfuscated form upon loading the Web page on the condition that the key is found in the fixed storage, but otherwise selecting the un-encrypted reference to retrieve the obfuscated form. The method additionally includes serving the Web page to the client.

Abstract: A method for cryptographic material management is provided. The method includes receiving into a computing device, through an API of the computing device, a designation of which of a plurality of key-producing cloud services sources each of a plurality of keys and which of a plurality of key-consuming cloud service providers uses each of the plurality of keys for encrypting or decrypting data. The method includes directing, from the computing device through a first plurality of end modules each interfaced to a specific API of a specific one of the plurality of key-producing cloud services, production of one or more of the plurality of keys. The method includes directing, from the computing device through a second plurality of end modules each interfaced to a specific API of a specific one of the plurality of key-consuming cloud service providers usage of one or more of the plurality of keys.

Abstract: A system and method for single authentication to a multi-tenancy single-page application hosted in a plurality of different datacenters. The method comprises: receiving, from a client device, a login request to access the single-page application; receiving an access token in response to an authentication of a user of the client device, wherein the access token designates at least tenant identification data; determining a datacenter of the plurality of different datacenters executing an instance of the single-page application supporting a tenant of the authenticated user; retrieving, from the determined datacenter, a single web page of the single-page application, wherein the retrieved signal web page includes at least references to resources pointing to a location of the determined datacenter; and serving the web single page to the client device.

Abstract: Computing systems, devices, and associated methods of operation of filtering packets at virtual switches implemented at hosts in a distributed computing system are disclosed herein. In one embodiment, a method includes receiving, at the virtual switch, a packet having a header and a payload and processing, at the virtual switch, the received packet based on multiple match action tables arranged in a hierarchy in which first and second layers individually contain one or more match action tables that individually contain one or more entries each containing a condition and a corresponding processing action.

Abstract: Methods and systems for a device identification system may be provided. The device identification system may determine an identity of a user device associated with a transaction. The identity may be determined by network address information, hard link information, soft link information, and/or other such information. The network address information may include IPv4 information, IPv6 information, a device ID, and/or other such information. The identity of the user device may be determined and a transaction conducted from the user device may be assigned a fraudulent transaction risk score according to the information. Transactions that are determined to be at a high risk of fraud may be reviewed or otherwise flagged and/or canceled.