Abstract: Some embodiments provide a method for connecting a client of a first network to a service of a second network. The method includes registering the service of the second network. The method then receives, from a client of the first network, a request to communicate with the service, the client not having an address of the service. The method further assigns an IP address to the service and sends the IP address to the client. Additionally, the method sends, to an inter-network hub that connects the first network and the second network, a message in order for the inter-network hub to establish a first tunnel between the inter-network hub and a first gateway associated with the client and a second tunnel between the inter-network hub and a second gateway associated with the service.

Abstract: System and techniques are described which apply a method for automatic database schema migration. An initial database is installed, according to rules that define tables of data, in an adaptive private network (APN) having a centralized management system including a network control node (NCN) coupled through the APN to a plurality of client nodes, wherein the NCN provides timing and control to the client nodes. An update to the initial database is received, wherein the initial database includes a first table of data stored in a first set of columns and the updated database includes a modified first table having a second set of columns that has a different number of columns as compared to the first table is automatically detected. One or more columns from the second set of columns that are different than the first set of columns are updated for data content.

Abstract: Methods, apparatuses and systems for cloud-based disaster recovery are provided. The method, for example, includes receiving, at a cloud-based computing platform, first internet protocol (IP) information relating to a first network environment associated with a server used by a client machine; translating the first IP information, without having to interpose a camouflage layer into the first IP information, and generating second IP information based on the translated first IP information, the second IP information used for creating a second network environment for the server; creating the second network environment for the server; and deploying the server in the created second environment.

Abstract: A device may determine that a network function of a network is to use a secure communication protocol. The network function may be configured to facilitate communication via the network. The device may identify a component of a resource configuration that is to instantiate the network function. The device may instantiate, using the component, a proxy for the network function. The device may configure the proxy to obtain a certificate that is associated with the secure communication protocol. The device may cause the proxy to use the certificate to communicate with another proxy that is associated with the network function to perform an operation associated with the network function.

Abstract: A computer-implement method comprises: selecting a trusted computing node via smart contract on a blockchain; completing remote attestation of the selected trusted computing node; writing secret information to an enclave of the selected node; causing a thin device to establish a private connection with the selected node without revealing the secret information; and causing the selected node to act as a proxy on the blockchain for the device. Another method comprises: receiving a signed device access request from a device owner; validating, by a verification node, the received request; executing, by a verification node, a smart contract on a blockchain based on the received request; and producing, based on the executed smart contract, an output command to access the device for the device to validate, decrypt and execute.

Abstract: Aspects of the technology provide methods for simulating a failure in a tenant network. In some aspects, a monitoring appliance of the disclosed technology can be configured to carry out operations for receiving packets at a virtual device in the monitoring appliance, from a corresponding network device in the tenant network, and instantiating a firewall at the virtual device, wherein the firewall is configured to selectively block traffic routed from the network device to the virtual device in the monitoring appliance. The monitoring appliance can simulate failure of the network device by blocking traffic from the network device to the virtual device using the firewall, and analyze the tenant network to determine a predicted impact a failure of the network device would have on the tenant network. Systems and machine-readable media are also provided.

Abstract: Secure access to a corporate application in an SSH session using a transparent SSH proxy. In some embodiments, a method may include receiving, at a secure access cloud point of delivery (PoD), from a client application on a client device, a request to access a corporate application that is deployed in a corporate datacenter. The method may also include forwarding, from the secure access cloud PoD, to a connector that is also deployed in the corporate datacenter, the request. The method may further include brokering, by the connector and the secure access cloud PoD, authentication of a user, authorization of access by the user, and an SSH session between the client application and the corporate application using a transparent SSH proxy, with the client application being unaware that the SSH session is brokered by the connector and the secure access cloud PoD.

Abstract: Methods of facilitating communication between clients and servers are contemplated. Embodiments of the inventive subject matter make it possible for a client to establish a packet-based connection with a server by first authenticating with a web backend. This can enable, for example, a client to establish a packet-based connection with a server though a web browser.

Abstract: In various embodiments, a service worker processes network requests by proxying the network requests via a content distribution network. The service worker intercepts a network request from a client application, generates a duplicate network request, and changes certain elements of the duplicate network request. The intercepted request can be an initial document request used to load a webpage or a subsequent request that includes an application programming interface (API) call. The service worker transmits the duplicate network request to a content distribution network that proxies the duplicate request to a cloud computing system, thereby accelerating that request.

Abstract: Systems, devices, media, and methods are presented for device independent secure messaging. The systems and methods generate an encrypted message by encrypting message content, designated for a specified recipient, with an encryption key. The systems and methods select a set of recipient keys, associated with the specified recipient, from a plurality of member keys. For each recipient key, the systems and methods encrypt the encryption key to generate a set of encrypted keys and transmit the encrypted message and an encrypted key of the set of encrypted keys to one or more client devices associated with the specified recipient. The systems and methods then receive an acknowledgement indicating a termination status of the encrypted message.

Abstract: Provided is a computer-implemented method and a transmission apparatus for transmitting data between a first network and a second network having high and low security requirements, wherein a first session is set up between the first and second networks, a first data packet is transmitted from a transmitting unit in the first network via a first one-way communication unit to a receiving unit in the second network, and a second session is set up and a second data packet is transmitted from a transmitting unit in the second network via a second one-way communication unit to a validation unit, the second data packet is validated in the validation unit on a prescribed rule, positive validation of the second data packet results in a third session being set up, and the second data packet is transmitted from the validation unit to a receiving unit in the first network.

Abstract: Technologies for streaming device role reversal include a source computing device and a destination computing device coupled via a communication channel. The source computing device and destination computing device are each configured to support role reversal. In other words, the source computing device and the destination computing device are each capable of switching between receiving and transmitting digital media content over the established communication channel. The source computing device is configured to initiate the role reversal, pause transmit functionality of the source computing device, and enable receive functionality of the source computing device. The destination computing device is configured to receive a role reversal indication from the source computing device, locally process the content, transmit a content stream to the source computing device, and display the content stream on an output device of the source computing device. Other embodiments are described and claimed herein.

Abstract: A DDOS attack preventer implements an unconventional way of detecting and preventing DDOS attacks. The attack preventer receives and analyzes requests from a particular IP address or device. The attack preventer will track various characteristics of each request (e.g., characteristics of the data in the requests, characteristics of the input used to generate the requests, and characteristics of the device used to generate the requests). The attack preventer will analyze these characteristics to determine whether the requests are human-generated or machine-generated. If the requests are human-generated, the attack preventer services the requests. If the requests are machine-generated, the attack preventer rejects the requests.

Abstract: Embodiments are described herein for systems and methods for continuously monitoring a network structure of one or more networks using a cloud-based network monitoring system, and rearranging, using the cloud-based network monitoring system, the network structure of the one or more networks to protect confidential and/or prioritized assets of the one or more networks based at least in part on the monitoring of the network structure of the one or more networks. In certain embodiments, the cloud-based network monitoring system is configured to continuously monitor a network structure of one or more networks, and to automatically rearrange the network structure of the one or more networks to protect confidential and/or prioritized assets of the one or more networks based at least in part on the continuous monitoring of the network structure of the one or more networks.

Abstract: For a host that executes one or more guest virtual machines (GVMs), some embodiments provide a novel virtualization architecture for utilizing a firewall service virtual machine (SVM) on the host to check the packets sent by and/or received for the GVMs. In some embodiments, the GVMs connect to a software forwarding element (e.g., a software switch) that executes on the host to connect to each other and to other devices operating outside of the host. Instead of connecting the firewall SVM to the host's software forwarding element that connects its GVMs, the virtualization architecture of some embodiments provides an SVM interface (SVMI) through which the firewall SVM can be accessed to check the packets sent by and/or received for the GVMs.

Abstract: A system, method, and computer-readable medium are disclosed for enforcing security policies. Enforcing security policies includes monitoring electronically-observable user interactions of an entity, the electronically-observable user interactions comprising corresponding user behavior of the entity; converting the electronically-observable user interactions into electronic information representing the user behavior; and, applying an organization specific security policy based upon the electronic information representing the user behavior, the organization specific security policy comprising an automatically generated organization specific rule.

Abstract: A communications network security system includes a robustness agent that operates within a communications interface of a device at one or more nodes of the network to analyze and filter messages coming from or going onto the network. At each of the nodes, the robustness agent determines one or more sets of message characteristics associated with each of the messages passing through the agent, and the agent is configured to allow certain types of messages (e.g., messages with certain predetermined sets of characteristics) to be passed through the agent, prevent messages with other predetermined characteristics from being passed through the agent, such as by halting (discarding or filtering) these messages, and/or passes still other messages having other sets of message characteristics to a volume filter to be counted.

Abstract: The present specification relates to a communication method and a communication device, and a random access method of a user equipment (UE), according to one embodiment of the present specification, comprises the steps of: sensing a random access trigger in a connected state; determining the type of the random access trigger when the random access trigger is sensed; and performing congestion control if the type of the random access trigger is a preset type.

Abstract: A method for rotating internet protocol (IP) addresses in a virtual private network (VPN), the method comprising receiving, at a first VPN server, a first data request and a second data request during an established VPN connection between a user device and a second VPN server; retrieving, during the established VPN connection, first data associated with the first data request using a first exit IP address; and retrieving, during the established VPN connection, second data associated with the second data request using a second exit IP address, different from the first exit IP address. Various other aspects are contemplated.

Abstract: An example method facilitates dynamic runtime execution of computer code that is selectively injected into messages in accordance with predetermined configuration rules for automatic execution at a message destination. The injection of code into messages, such as messages exchanged during an authenticated computing session, by a policy enforcement system, can be used to efficiently effectuate enhance computing environment security and computing resource use. For example, in a specific embodiment, code for detecting a browser-close event and then terminating a computing session can be automatically executed client side via a browser extension or plugin, thereby helping to eliminate the accumulation of stale computing sessions; thereby mitigating associated security risks and computing resource consumption of stale computing sessions. In another example embodiment, injected code encrypts session cookies, such as via a Time based One Time Password (TOTP).

Abstract: Methods, apparatus, and computer-accessible storage media for providing a volume-based block storage service and application programming interfaces (APIs) to the service. A block storage service and block storage service APIs may allow processes (applications or appliances) on the service client network to leverage remote, volume-based block storage provided by the service provider. The APIs may provide a standard interface to volume-based block storage operations on a remote data store. The service provider, the service clients, and/or third parties may develop various applications and/or appliances that may, for example, be instantiated in service clients' local networks and that leverage the block storage service via the APIs to create and manage volumes and snapshots on the remote data store and to upload and download data from the volumes and snapshots on the remote data store.

Abstract: The present disclosure provides a wireless charging method, device, and system, and a device to be charged. The method includes: a wireless charging device receiving a request instruction sent by a device to be charged, the request instruction being configured to request the wireless charging device to provide a type of a power supply device to the device to be charged; the wireless charging device sending the type of power supply device identified by the wireless charging device to the device to be charged according to the request instruction. The type of power supply device including a fast charging type and a normal type, a maximum output power provided by the fast charging power supply device is greater than or equal to a preset value, and a maximum output power provided by the normal power supply device is less than the preset value.

Abstract: A control device includes a communication unit configured to acquire control information on a vehicle from an information processing device in a wired or wireless communication, and a processing unit configured to execute a process of starting vehicle control based on the control information. The processing unit continues or suspends the process of starting vehicle control depending on a result of an authentication process on usage authority of the control information, and the authentication process is executed while the process of starting vehicle control is executed.

Abstract: Embodiments relate to systems and methods for securely provisioning login credentials to an electronic device on a network, e.g., a consumer premises device (CPE) device, such as, among other devices, a modem. The login credential may be used, for example, for securely provisioning and configuring a CPE device.

Abstract: The subject matter of this specification can be implemented in, among other things, a method that includes accessing a plurality of target tasks for a computing system, the computing system comprising a plurality of resources, wherein the plurality of resources comprises a first server and a second server, accessing a plurality of configurations of the computing system, wherein each of the plurality of configurations identifies one or more resources of the plurality of resources to perform the respective target task of the plurality of target tasks, and performing, for each of the plurality of configurations, a simulation to determine a plurality of performance metrics, wherein each of the plurality of performance metrics predicts performance of at least one of the plurality of resources executing the plurality of target tasks on the computing system.

Abstract: A system provides for automatically populating a sign-on page with sign-on credentials and automatically submitting the sign-on credentials without revealing at least one of the sign-on credentials to a user. The system includes an access management server which stores sign-on credentials for accessing the application. An application access tool, which is associated with a browser extension of a web browser executed on the user's device, provides a network address for a sign-on page of the application, and the system automatically redirects the user to this sign-on page. The system uses a source code database to identify object identifiers in html source code of the sign-on page that corresponds to form fields or other objects in the sign-on page for appropriately entering and submitting sign-on credentials in the sign-on page. The credentials are entered in an anonymized format that is not readable to the user.

Abstract: A method, apparatus and system for providing security for a container network having a plurality of containers includes establishing a network stack for each of the plurality of containers of the container network, determining network and policy information from active containers, based on a set of pre-determined inter-container dependencies for the plurality of containers learned from the determined network and policy information, configuring container access in the container network to be limited to only containers of the plurality of containers that are relevant to a respective communication, and configuring inter-container traffic in the container network to be directed only from a source container into a destination container in a point-to-point manner such that exposure of the inter-container traffic to peer containers is prevented.

Abstract: A system includes a subscription storage that stores an APN for identifying a home base station and the service class available for a UE as subscription information, in correspondence with a mobile terminal identifier for identifying UE; a positional information update request receiver for receiving a positional information update request of UE 70 from an MME; and a positional information response transmitter that extracts the available service class included in the positional information update request, from the subscription storage and transmits a positional information update response included with the extracted service class to MME. With this configuration, it is possible to provide a mobile communication system in which, for a plurality of services of a home base station, the owner of a home base station can set the access right for each of the services, and communication data is transferred based on the set access right.

Abstract: Systems and methods of dynamic searching, price comparison, and optimization utilizing novel search engines are provided. A search engine enables searching across multiple virtual private servers in a tailored group of geographical locations. Back-end architecture including one or more databases and tracking tools compares prices of a product or service in the tailored group of geographical locations. The system provides the lowest price for the product or service in the tailored group of geographical locations to a user in any geographical location. The search engine may be provided via a front-end mobile application. A user can drag a sticker icon over any search result to request price information for the product or service shown in the search result and be directed to a pop-up showing the price information for the product or service and/or a website providing the lowest price for the product or service.

Abstract: There is disclosed in one example a computing apparatus, including: a hardware platform including a processor and a memory; a closed operating system including instructions within the memory to sandbox userspace applications; and a sandboxed userspace application, including: instructions to provide a user interface and user application code; and an agentless security library within the sandboxed userspace application, the agentless security library including instructions to provide security or privacy services to the sandboxed userspace application with minimal direct interaction from the user interface and user application code.

Abstract: A control device includes a communication unit configured to acquire control information on a vehicle from an information processing device in a wired or wireless communication, and a processing unit configured to execute a process of starting vehicle control based on the control information. The processing unit continues or suspends the process of starting vehicle control depending on a result of an authentication process on usage authority of the control information, and the authentication process is executed while the process of starting vehicle control is executed.

Abstract: A system for protecting public cloud-hosted virtual resources features cloud visibility logic. According to one embodiment, the cloud visibility logic includes credential evaluation logic, data collection logic, correlation logic and reporting logic. The credential evaluation logic is configured to gain authorized access to a cloud account within a first public cloud network. The data collection logic is configured to retrieve account data from the cloud account, while the correlation logic is configured to conduct analytics on the account data to determine whether the cloud account is subject to a cybersecurity threat or misconfiguration. The reporting logic is configured to generate an alert when the cloud account is determined by the correlation logic to be subject to the cybersecurity threat or misconfiguration.

Abstract: A method by a web application layer proxy communicatively coupled between a client and an origin server for performing automated POST resubmission. The method includes intercepting a request by the client for a resource provided by the origin server, obtaining an interstitial page in response to receiving an indication from a bot detector component that the client needs to be identified, where the interstitial page includes challenge code for interrogating the client and code for automatically submitting a form included in the interstitial page if the client successfully acquires a token, encrypting a payload of the request, adding the encrypted payload to a hidden input field of the form included in the interstitial page, and sending the interstitial page with the encrypted payload added to the hidden input field of the form to the client as a response to the request.

Abstract: An appliance includes one or more network interfaces To facilitate secure communications between a client device and a server. The secure communications involve secure session connections between the client device and the appliance, and between the appliance and another appliance. A secure session connection processor is configured to determine, using information in a secure session connection request received from the client device, whether client authentication is required by the server. The secure connection request is provided to the other appliance if the information indicates that client authentication is required by the server. Communications received from the client device are decrypted using a key shared with the client device, and the decrypted communications sent to the other appliance are encrypted using a key shared with the other appliance.

Abstract: A network analysis terminal is described that operates within a vehicle cabin to generate passenger connectivity experience metrics. The terminal monitors packets communicated through at least one cabin network between a content server and passenger terminals. The terminal receives packets monitored by the network interface and identifies passenger terminal identifiers that are addressed by content of the packets. Names of vehicle passengers associated with the packets are identified using the passenger terminal identifiers as indexes to retrieve the names of vehicle passengers from an information repository that maps names of vehicle passengers to passenger terminal identifiers. Passenger connectivity experience metrics are generated based on measurements performed on the packets over time.

Abstract: Cloud service security management in cloud computer environment uses a first computer cloud entity with first security capabilities and under security management coordinated by a first security management service point in compliance with predefined first security requirements. Security management of a second computer cloud entity is coordinated by a second security management service point in compliance with predefined second security requirements. In the managing of the security of the cloud service in the cloud computer environment: a trusted relationship is established between the first and second security management service points, general security requirements for the cloud service are obtained; and a first security policy is defined for the first security management service point, based on the general security requirements for the cloud service, the first security capabilities and the first security requirements, for the running of the cloud service by the first computer cloud entity.

Abstract: Systems and methods are disclosed for prioritizing a list of applications. The systems and methods include identifying, with a messaging application, a list of applications that are configured to share authentication information with the messaging application; determining a priority value of each application on the list of applications; generating for display, with the messaging application, a graphical user interface that represents a selection of applications from the list of applications based on the priority value of each application on the list; and for each application represented in the graphical user interface, generating for display a user-selectable option to authorize the messaging application to share authentication information with the respective application.

Abstract: Embodiments described include systems and methods for aggregating a plurality of skills provided by a plurality of digital assistants. A server can generate a skill agent having a plurality of skills corresponding to skills performed by a plurality of digital assistants. A request can be received for content for a user of the device and the server can identify one or more skills to generate the content included within the request. A first digital assistant can be selected using the skill agent to handle the request based on the identified one or more skills to generate the content. The server can request the first digital assistant to perform the identified one or more skills and provide a response to the request that includes content generated responsive to the first digital assistant performing the identified one or more skills.

Abstract: Hierarchical scanning begins with communicating probes over the Internet to ports and networks addresses to determine publicly accessible devices. Based on responses to those probes, follow-up probes are determined to obtain additional information about the publicly accessible devices. The probes are transmitted from a system that is external to the networks corresponding to the network addresses. This provides an external view of the scanned networks and facilitates a probing paradigm that scales beyond a few networks.

Abstract: In accordance with an example embodiment of the present invention, there is provided an apparatus, comprising at least one processor configured to execute a computer executable program stored in a memory comprised in the apparatus, wherein the computer executable program thereby causes the apparatus to at least open a first connection to a data source device, open a second connection to a proxy device, the second connection employing a first protocol and a cross origin resource sharing context, and receive from the proxy device information of the data source device.

Abstract: A system and a method for preserving intrusion event/s captured by camera/s. A method includes determining a first event and switching a camera from a first mode to a second mode based on the first event. The method further includes detecting a second event and capturing the second event based on the detection. The method also includes transmitting a copy of the captured second event to one or more devices.

Abstract: A software-defined networking (“SDN”) capable forwarding switch includes ports for receiving and/or outputting data packets and a packet pipeline including a forwarding table. The forwarding table is configured to contain a number of flow table entries (“FTEs”), that determine the forwarding switch's configuration and control behavior. The switch further includes a control engine configured to manipulate the forwarding switch's forwarding tables by adding, updating, and/or removing FTEs in the forwarding tables. An FTE of a forwarding table is configured to contain a specific action part that includes an action instruction to create a control packet and to send it to the control engine. The control packet includes embedded control instructions that cause the control engine to change the forwarding switch's configuration and/or control behavior.

Abstract: A method for providing mobile messages includes generating a message based on received content. A first functional bind to an aggregator is identified. A second functional bind to the aggregator is also identified. The first functional bind and the second functional bind are distinct communication connections to the aggregator. First message recipients are associated with the first functional bind, and second message recipients are associated with the second functional bind. The message is provided in parallel to the aggregator for the first message recipients through the first functional bind and for the second message recipients through the second functional bind.

Abstract: The disclosure provides an approach for establishing authentication between components in a network. Embodiments deploying a node of a monitoring appliance in response to a request and providing a token for accessing a network manager to the node of the monitoring appliance. Embodiments include generating, by the node of the monitoring appliance, a certificate of the node of the monitoring appliance and providing the certificate of the node of the monitoring appliance to the network manager with the token for accessing the network manager. Embodiments include adding, by the network manager, based on the token for accessing the network manager, the certificate of the node of the monitoring appliance to a first trust store and providing, by the network manager, a network manager certificate to the node of the monitoring appliance. Embodiments include adding, by the node of the monitoring appliance, the network manager certificate to a second trust store.

Abstract: A system may include a first network in which user device(s) and a HIP server are communicably coupled. The first network may include a secure data administrator, such as a medical data system, that stores secure data. In some implementations, at least one of the user devices may include a web module and communicate with a web server through a second network. At least one of the user device may be restricted from communicating with the secure data administrator, so the user device may request data stored in the secure data administrator through the HIP server. The user device may base the requests for the data on information received from the web server.

Abstract: At least one application may include instructions comprising application instructions and a plurality of separate pipeline definition instructions. The application instructions may be within a virtual container including at least one program that is generically executable in a plurality of different continuous integration and delivery (CI/CD) environments. Each of the plurality of separate pipeline definition instructions may be configured for each of the plurality of different CI/CD environments such that each pipeline definition may operate only in the CI/CD environment for which it is created. Each pipeline definition may be configured to cause the CI/CD environment for which it is created to execute the at least one program.

Abstract: A communication control device selects, based on scenario information, one or more of a plurality of reverse proxy devices that transfer information transmitted and received between an information processing device and a mounted device of a moving body. The communication control device performs operation control of the selected reverse proxy device. The communication control device selects the scenario information used for operation of the reverse proxy device based on an operation start signal transmitted from the mounted device, and transmits the scenario information to the mounted device.

Abstract: A mobile computing device is configured to allow a user to launch native SaaS applications from different vendors using a single-sign-on without having to modify or hook the native SaaS applications. A VPN application operates as man-in-the-middle (MITM) for identity provider requests from SaaS services. The VPN application is initially authenticated with the identity provider, and receives an IDP authentication token which is stored. The IDP authentication token is used for authentication requests from SaaS services.

Abstract: The host computer securitization architecture, which comprises: an offline source server, an offline provisioning server configured to connect with a portable mobile securitization server via a wired communication, an administration server configured to monitor and interact with at least one portable mobile securitization server, at least one portable mobile securitization server configured to connect via a wired communication to a host computer, said portable mobile securitization server comprising: a connector to mechanically connect and establish a removable wired communication between the mobile server and the host computer, a first wired bidirectional communicator with the host computer, a second of bidirectional communicator with a data storage peripheral or a data network and a unit securing the communication between the host computer and the data storage mobile server or the data network, this communication being established between the first and the second communicator, a blockchain comprising

Abstract: The present invention relates to methods and apparatus for detecting, minimizing and/or preventing message processing faults and in particular message processing fault avalanches at a single processing device and among a cluster of message processing devices. An exemplary method embodiment includes: enabling message blocking at a Session Border Controller (SBC) for Session Initiation Protocol (SIP) messages including a first key value in response to a first threshold number of SIP messages including the first key value having caused a SIP message processing failure; receiving, at the SBC, a SIP message including at least one key value; determining if message blocking is enabled for one or more key values included in the SIP message; and dropping by the SBC the SIP message in response to determining that message blocking is enabled for one or more key values included in the SIP message, but otherwise processing the SIP message by the SBC.