Abstract: Example methods and systems disclosed herein facilitate the introduction and use of client-specified object encryption within a computing environment using remote third-party storage systems, where data objects stored on the remote third-party storage systems were previously either stored in unencrypted form or encrypted with a single key tied to an account that owns the data. In some embodiments, the encryption is introduced into the system in gradual stages, so as to minimize or entirely eliminate data availability downtime. In some embodiments, the introduction of client-specified object encryption involves registration of a user function on the third-party storage system, where the user function handles object decryption in response to requests of content consumers for data objects stored by the third-party storage system.

Abstract: A request for use of an application programming interface (API) is received. Context associated with the request is determined. Based on the context, a challenge is generated, which can be used for determining whether to permit the use of the API. A response to the challenge is received. Based on the response, the request can be facilitated for using the API.

Abstract: Methods and systems for deploying images to computing systems include predicting an environment for a plurality of processing nodes. Image deployment to the plurality of processing nodes is simulated to determine a subset of the plurality of processing nodes for deployment. One or more images is pre-loaded to the subset of the plurality of processing nodes in advance of a deployment time.

Abstract: Systems and methods are disclosed for data protection in a cluster of data processing accelerators (DPAs) using a policy that partitions the DPAs into one or more group of DPAs in the cluster. A host device instructs the DPAs to organize themselves into non-overlapping groups according to a policy for each DPA in the cluster. The policy indicates, for each DPA, one or more other DPAs the DPA is to establish a communication link with, to implement the grouping. Once grouped, the host device and a DPA can access all resources of the DPA. DPAs in the same group as a first DPA can access non-secure resources, but not secure resources, of the first DPA. DPAs in a different group from the first DPA cannot access any resources of the first DPA. A scheduler in the host device can allocate processing tasks to any group in the cluster.

Abstract: Systems, methods, and computer products are described herein for identifying data inconsistencies within database tables associated with an application. A master data inconsistency evaluator receives data including at least one selection parameter within at least one database table. By the master data inconsistency evaluator evaluates the at least one selection parameter by comparing the at least one selection parameter with other database tables associated with the application to identify data inconsistencies. The master data inconsistency evaluator repairs the data inconsistencies to further facilitate an error free transaction.

Abstract: Disclosed herein are methods, computer readable media, and devices for performing software updates. In one embodiment, a method is disclosed comprising initializing a storage space of a secure storage device into a plurality of portions; copying an update program to a first portion in the portions and copying update data to a second portion of the portions; generating a first golden measurement for the first portion and a second golden measurement for the second portion; measuring the first portion; updating or rolling back an update to the secure device in response to determining that the measuring of the first portion does not match the first golden measurement of the first portion; and verifying an update operation upon determining that the measuring of the first portion matches the first golden measurement of the first portion.

Abstract: A network intrusion system for a protected network includes a ruleset module configured to receive metadata for rules. The metadata describes, for each of the rules, a set of associated network vulnerabilities. The ruleset module is configured to access vulnerability information describing a set of cumulative vulnerabilities that each is present in at least one network device within the protected network. The network intrusion system includes a rule management module configured to, for each rule of the plurality of rules: identify the set of associated network vulnerabilities described by the metadata for the rule, determine whether there is a match between any of the set of associated network vulnerabilities and the set of cumulative vulnerabilities, and, in response to determining that there is no match, transmit a first command signal to a network security module. The first command signal instructs the network security module to disable the rule.

Abstract: Techniques for security management in communication systems are provided. For example, a method comprises maintaining a list of networks that support access for a set of restricted local operator services, checking whether a set of conditions for triggering access to the set of restricted local operator services is satisfied, receiving a request for access to the set of restricted local operator services, and initiating, upon satisfaction of the set of conditions, a search of the list of networks to find a network for access to the set of restricted local operator services.

Abstract: Systems and methods for securely pairing a transmitting device with a receiving device are described. The systems and methods may communicate with a first device via a first communication method over a wireless communication network. The systems and methods may transmit, to the first device via a second communication method, a first sensory pattern representing a first key. In addition, the system and methods may communicate with the first device via the first communication method using the first key.

Abstract: Various embodiments provide an approach to controlled access of websites based on website content, and profile for the person consuming the data. In operation, machine learning techniques are used to classify the websites based on community and social media inputs, crowdsourced data, as well as access rules implemented by parents or system administrators. Feedback from users/admins of the system, including the instances of allowed or denied access to websites, in conjunction with other relevant parameters, is used for iterative machine learning techniques.

Abstract: The present disclosure relates to computer-implemented methods, software, and systems for managing cloud application in a transparent multiple availability zone cloud platform. A request to access a cloud application running on the multiple availability zone cloud platform is received. The request can include an application location for accessing the cloud application. A network address corresponding to the application location is determined. In response to determining the network address, a first availability zone of the multiple availability zone cloud platform that is currently active to process the request is determined. A plurality of network locations corresponding to a host component of the application location is determined by a first load balancer. A network location of the plurality of network locations for processing the request is identified based on load balancing criteria.

Abstract: Example methods and systems for logical network health check. One example may comprise obtaining network configuration information and network realization information associated with a logical network; processing the network configuration information and the network realization information to determine the following: (a) network configuration health information specifying a network configuration issue and a first remediation action; and (b) network realization health information specifying a network realization issue and a second remediation action; and providing, to a user device, multiple user interfaces (UIs) specifying the first health information and the second health information along with a visualization of the logical network. In response to detecting an instruction initiated by the user device using at least one of the multiple UIs, the first remediation action or the second remediation action may be performed.

Abstract: The invention discloses a dual-modes switching method for blocking a network connection, comprising: a data packet collecting step of collecting data packets transmitting from all network nodes in a network segment, a data packet analyzing step of analyzing the data packets collected to obtain network node identification data, a list comparing step of comparing the network node identification data with identification data registered in an information device list to determine an illegal network node, an illegal-network-node-type determining step of determining what kind of type the illegal network node is, and a network connection blocking step of switching a first network connection blocking mode and a second network connection blocking mode according to the type of the illegal network node, thereby blocking the network connection of the illegal network.

Abstract: An image capturing device may capture image data for processing to form an image. The image capturing device may perform a hashing procedure on the image data, wherein performing the hashing procedure generates a hash value of the image data. The image capturing device may provide, to an image authentication device, the hash value of the image data, wherein the hash value of the image data is to be used by the image authentication device to validate the image based on a request to authenticate the image received from a receiving device. The image capturing device may process the image data to form the image for display to a user. The image capturing device may provide, after providing the hash value of the image data to the image authentication device, the image for display to the user.

Abstract: A system, computer program product and method for providing high delivery performance in a value chain network utilizing a finite capacity planning and scheduling model.

Abstract: A computer-readable medium contains cybersecurity configuration settings (CCS) generating file(s) including instructions when executed cause a processor of a computer located at a node in a networked system having computers including at least one computer system class to generate CCS. The CCS generating file includes group policy objects (GPOs) applicable to all computers, policy setting scripts that are applicable to <all the computer s, and group policy definition files which provide a policy setting library for the computer class. Execution of the CCS generating file at the node automatically generates the CCS for cybersecurity protection of the node. The computer class can include computer classes that include ?2 different operating systems, and there can be a CCS generating file for each computer class. The CCS generating file can be a single multi-class CCS generating file that includes a plurality of CCS generating files.

Abstract: A predetermined access control policy is generated with reference to a lineage table and a metadata table to be stored in a policy table, and an access control policy which should be applied or recommended to treated data is provided with reference to the policy table.

Abstract: Data processing systems and methods, according to various embodiments, are adapted for efficiently processing data to allow for the streamlined assessment of risk ratings for one or more vendors. In various embodiments, the systems/methods may use one or more particular vendor attributes (e.g., as determined from scanning one or more webpages associated with the particular vendor) and the contents of one or more completed privacy templates for the vendor to determine a vendor risk rating for the particular vendor. As a particular example, the system may scan a website associated with the vendor to automatically determine one or more security certifications associated with the vendor and use that information, along with information from a completed privacy template for the vendor, to calculate a vendor risk rating that indicates the risk of doing business with the vendor.

Abstract: Systems and methods are described for improving assessment of security risk based on a user's personal information. Registration of personal information of a user of an organization is received at a security awareness system. Post receiving the registration of the personal information, at least one of an exposure check or a security audit of the personal information of the user is performed by the security awareness system. A personal risk score of the user is then generated or adjusted based at least on a result of one of the exposure check or the security audit.

Abstract: A multi-endpoint event graph is used to detect malware based on malicious software moving through a network.

Abstract: The invention relates to a computer-implemented system for security monitoring of Member accounts in a cloud environment. The Member accounts are provided as instances of cloud services in one or more monitored clouds by one or more cloud service providers. The system is programmed to automatically deploy software agents to the Member accounts. The software agents are configured to monitor activities in the Member accounts and to push security and operations data to a SIEM platform. The security and operations data may comprise alerts and activity logs for the Member accounts, public internet protocol (IP) addresses used by the Member accounts, and identifying information for individuals and information technology (IT) assets associated with the Member accounts. The system includes a user interface to define customized alerts based on the security and operations data, and the system generates and sends the customized alerts to a system administrator or security analyst.

Abstract: One embodiment provides a method, including: receiving a target unstructured document for determining whether the target unstructured document comprises biased information; identifying an objective of the target unstructured document by extracting, from the target unstructured document, (i) entities and (ii) relationships between the entities; creating a structured knowledge base, wherein the creating comprises (i) creating an entry in the structured knowledge base corresponding to the target unstructured document, (ii) identifying other unstructured documents having a similarity to the target unstructured document, and (iii) generating an entry in the structured knowledge base corresponding to each of the other unstructured documents; applying a bias detection technique on the structured knowledge base; and providing an indication of whether the target unstructured document comprises bias.

Abstract: A method may include obtaining, from a user device, a request to access a control system among various control systems. The method may further include determining whether a user associated with the user device is authorized to access the control system based on user information associated with the user in a database. The method may further include generating, in response to determining that the user is authorized, a user code associated with a predetermined time period for accessing the control system. The method may further include transmitting the user code to the user device and the control system. The user code may authenticate a user session between the user device and the control system. The method further includes transmitting, in response to the predetermined time period expiring, a command that terminates the user session between the control system by the user device.

Abstract: A method may include receiving an event from an event source. The event may correspond to event data. The event source may be a container executing an image. The image may correspond to image metadata including attributes describing the image. The method may further include combining the event data with the image metadata to obtain enriched data, detecting, using the enriched data, a deviation from a policy, and in response to detecting the deviation from the policy, performing an action to enforce the policy.

Abstract: The present disclosure relates to systems and methods for identifying highly sensitive modules and taking a remediation or preventative action if such modules are accessed by malicious software. For example, the likelihood that a module is used for an exploit, and is thus sensitive, is categorized as high, medium, or low. The likelihood that a module can be used for an exploit can dictate whether, and to what degree, an application accessing the module is “suspicious.” However, in some instances, a sensitive module may have legitimate reasons to load when used in certain non-malicious ways. The system may also consider a trust level when determining what actions to take, such that an application and/or user having a higher trust level may be less suspicious when accessing a sensitive module as compared to an application or user having a lower trust level.

Abstract: Management of IoT devices through a private cloud. An IoT device is coupled to a gateway. A request from the IoT device to connect to a private cloud, wherein the private cloud is used to manage IoT devices, is received at a private cloud control center agent. An identification of the IoT device is determined. The IoT device is onboarded, using the identification, for management through the private cloud. A device profile of the IoT device is generated. The flow of data to and from the IoT device is regulated through application of IoT rules according to the device profile of the IoT device.

Abstract: In a device including a processor and a memory, the memory includes executable instructions that, when executed by the processor, cause the processor to control the device to perform functions of receiving an access control setting for granting access to an access-controlled resource and a dynamic tag characterizing a member group subject to the access control setting; accessing a data source storing member data including an attribute associated with each member, the attribute including a parameter related to a time or time period. The dynamic tag is mapped to the member data based on (1) the parameter of the attribute and (2) a time or time period associated with the dynamic tag, to identify mapped members forming the member group, wherein the mapped members identified based on a same dynamic tag vary depending on the time or time period associated with the dynamic tag, to identify the member group.

Abstract: Methods, systems, and computer storage media for providing resource policy management based on a pre-commit verification engine are provided. Pre-commit verification operations are executed to simulate committing a policy, in a distributed computing environment, for test request instances, without actually committing the policy. In operation, a policy author communicates a policy and one or more test request instances. Based on the policy and the test request instances, an access control manager simulates committing the policy for the test request instances to the computing environment. Simulating committing the policy for test request instances is based on an existing set of policies including a live version of the policy and contextual information corresponding to the policy and the test request instances for the computing environment in which the policy will be applied.

Abstract: A system for determining a software package for deployment based on a user request receives a request from the user to access software packages to perform a particular task. The system determines particular software packages for the user, based on an experience level of the user in performing the particular task. The system determines whether a security vulnerability is associated with the determined software packages by scanning the source code of the determined software package and searching for instances where a code portion includes open ports vulnerable to unauthorized access. If it is determined that no security vulnerability is associated with the determined software packages, the system deploys the determined software packages to a computing device from which the user sent the request.

Abstract: A method for managing a consent receipt under an electronic transaction, comprising: receiving a request to initiate a transaction between the entity and the data subject; providing a privacy policy associated with the entity and based at least in part on the request to initiate the transaction between the entity and the data subject; accessing the privacy policy associated with the entity; storing one or more provisions of the privacy policy associated with the entity; providing a user interface for consenting to the privacy policy associated with the entity; receiving a selection to consent to the privacy policy associated with the entity and based at least in part on the request to initiate the transaction between the entity and the data subject; generating, by a third-party consent receipt management system, a consent receipt to the data subject; and storing the generated consent receipt.

Abstract: A communication method includes receiving, by an access network (AN) node, indication information from a mobility management device. The indication information is indicative of a security policy of a quality of service (QoS) flow. The method also includes obtaining, by the access network node based on the indication information, security information of a radio bearer corresponding to the QoS flow. The security information is indicative of a security policy of the radio bearer. The method further includes sending, by the access network node, an identifier of the radio bearer and the security information of the radio bearer to a terminal.

Abstract: Systems, methods, and other embodiments associated with a framework for compliance report generation are described. In one embodiment, a method includes receiving a data source definition of a set of data sources comprising data for populating compliance reports. The example method may also include retrieving a compliance report definition for a compliance report for a reporting entity. The example method may also include constructing and rendering a user interface populated with a set of user interface elements generated based upon the set of data sources and the compliance report definition. The example method may also include generating the compliance report according to the compliance report definition. The compliance report is populated with data from the set of data sources. The compliance report is sent over a computing network to a remote computing device of the reporting entity.

Abstract: A policy-based printing system is implemented to allow access to a private domain to print using a public domain. The private domain includes private servers that store documents. The public domain includes servers and a printing device. A public policy server uses a domain list and a protocol connection with a private authentication server to validate a user and identify which private domain to access. The public policy server receives requests from the printing device to process a print job of a document in the private domain. If the private server is off-line, then the printing device prints the document and a cost reimbursement request is submitted to account for the printed document.

Abstract: The present disclosure describes systems and methods for reducing rule set sizes via statistical redistribution throughout a plurality of network security appliances. A rule set may be generated for each security appliance that includes (i) a first set of rules based on known attacks, identified as rules for mandatory inclusion in the rule set; and (ii) a subset of the second set of rules, identified as rules for potential inclusion in the rule set, selected randomly according to a distribution percentage, score, or weight for each potentially included rule. Higher scored rules, which may be more likely vectors for potential attack, may be distributed to a greater number of appliances; while lower scored rules that may be less likely or represent more speculative attacks may be distributed to fewer appliances.

Abstract: In one embodiment, a system for managing a virtualization environment includes host machines implementing a virtualization environment, a plurality of clusters of the host machines, a virtualized file server (VFS) comprising a plurality of file server virtual machines (FSVMs), and a VFS cluster manager (CM) configured to distribute storage items among the clusters and receive cluster storage statistics for one or more shares of the VFS. The CM is further configured to, in response to a request from a first FSVM to identify a storage location for a storage item, identify a cluster at which the storage item is to be located based on the cluster storage statistics, identify a second FSVM at which the storage item is to be located based on compute usage statistics of one or more FSVMs in the identified cluster, and send an address of the second FSVM to the first FSVM.

Abstract: Methods, systems, and media for determining and presenting information related to embedded sound recordings are provided.

Abstract: Some embodiments of the invention provide a method for performing intrusion detection operations on a host computer. The method receives a data message sent by a machine executing on the host computer. For the data message's flow, the method identifies a set of one or more contextual attributes that are different than layers 2, 3 and 4 header values of the data message. The identified set of contextual attributes are provided to an intrusion detection system (IDS) engine that executes on the host computer to enforce several IDS rules. The IDS engine uses the identified set of contextual attributes to identify a subset of the IDS rules that are applicable to the received data message and that do not include all of the IDS rules enforced by the IDS engine. The IDS engine then examines the subset of IDS rules for the received data message to ascertain whether the data message is associated with a network intrusion activity.

Abstract: A method by a security system implemented by one or more electronic for detecting attacks on one or more databases. The method includes analyzing database logs of one or more databases to determine transaction characteristics of each of the one or more databases, selecting, for each of a plurality of database accesses to the one or more databases, one or more security rules to apply to that database access, wherein different security rules are selected for different ones of the plurality of database accesses depending on the determined transaction characteristics of the database being accessed, and causing, for each of the plurality of database accesses, the one or more security rules selected for that database access to be applied to that database access.

Abstract: Technology related to application deployment across network devices including smart network interface cards. In one example, a method includes distributing an application across a plurality of locally connected computing subdomains. The subdomains can include a mixture of general and special purpose computing subdomains, such as for example, a main computer and an associated smart network interface devices or systems, such as for example a smart network interface card (NIC). The subdomains can each run hypervisors that are bridged to allow a single virtual machine to operate across the subdomains. The application can include multiple portions. For example, an application can be split by different functionalities. The application portions can be tagged to indicate which subdomain they are to be executed within. If the chosen subdomain has available the requisite resources, the application can be detached and distributed to the chosen subdomain.

Abstract: In some examples, a system associates, with a plurality of virtual resources deployed in a cloud environment, properties representative of characteristics of the virtual resources, the properties comprising a performance level of a virtual resource. The system receives a request to create a virtual resource in the cloud environment, and, in response to determining that properties of the virtual resource to be created for the request satisfy a criterion with respect to properties of a given virtual resource of the plurality of virtual resources, selects the given virtual resource as a candidate virtual resource for the request.

Abstract: Systems, methods, and computer-readable media for application placement can include the following processes. A security score service determines a respective security posture score for each of a plurality of candidate hosts of an enterprise network. A user then identify a set of performance parameters and security parameters for a host in an enterprise network to execute a workload thereon. An application placement engine selects a host from the plurality of candidate hosts having a security posture score matching the performance parameters and the security parameters for executing the workload. An application deployment engine places the workload on the host.

Abstract: A system is provided. The system includes a computing resource, a cable insertable into the computing resource, a locking element and a controller. The locking element is configured to assume a locked condition in which the cable is locked to the computing resource or prevented from insertion into the computing resource and an unlocked condition in which the cable is removable from the computing resource and permitted to be inserted into the computing resource. The controller is configured to define rules for users. The rules are associated with respective identifiers (IDs) of each of the users and establish criteria associated with each user for causing the locking element to assume one of the locked and unlocked conditions.

Abstract: Technologies for performing security monitoring services of a network functions virtualization (NFV) security architecture that includes an NVF security services controller and one or more NFV security services agents. The NFV security services controller is configured to transmit a security monitoring policy to the NFV security services agents and enforce the security monitoring policy at the NFV security services agents. The NFV security services agents are configured to monitor telemetry data and package at least a portion of the telemetry for transmission to an NFV security monitoring analytics system of the NFV security architecture for security threat analysis. Other embodiments are described and claimed.

Abstract: A method of providing infrastructure protection for a network that includes IP addresses as low as a single IP address. An end user sends traffic to an IP address of a projected server publicly available as an anycast address, and sends traffic to the protected network. The traffic is routed via one of several scrubbing centers using the public IP address as anycast address, and the scrubbing center provides infrastructure protection by scanning and filtering the incoming traffic for illegitimate data. After filtering, the legitimate traffic is encapsulated, e.g., via including virtual GRE tunnel information that includes a secret IP address known only to the scrubbing center and the protected server that receives the network traffic. The protected server decapsulates the network packet and responds back to the end user via the scrubbing network.

Abstract: Systems and methods include, in a cloud node executing a security service, causing a mobile device to perform a validation check to determine if the mobile device is any of fake, counterfeit, jailbroken, and rooted; responsive to successful validation, allowing traffic to and from the mobile device through the security service; and responsive to unsuccessful validation, preventing traffic to and from the mobile device through the security service. The systems and methods can further include, prior to the causing, requiring the mobile device to install and launch an application, wherein registration with the security service requires the application; and performing the validation check via the application and a fake check service.

Abstract: Systems and methods for network authorization are described herein. An example method can include receiving a user credential from a host device connected to a network, authenticating the user credential, and in response to authenticating the user credential, determining an authorization policy associated with the host device. The method can also include polling a network overlay control plane of the network to obtain a network location information associated with the host device, identifying at least one network device of the network using the network location information, and transmitting the authorization policy to the at least one network device.

Abstract: A policy-based printing system is implemented to allow access to a private domain to print using a public domain. The private domain includes private servers that store documents. The public domain includes servers and a printing device. A public policy server uses a domain list and a protocol connection with a private authentication server to validate a user and identify which private domain to access. The public policy server receives requests from the printing device to process a print job of a document in the private domain. The public server may associate a public personal identification number (PIN) with a corporate PIN for the printing operations. In the event of split printing, the public server generates another public PIN for use with another printing device.

Abstract: A system for detecting security threats in deployed software packages receives a request from a user to access software packages to perform a particular task. The system selects particular software packages based on an experience level of the user in performing the particular task. The system deploys the particular software packages to a computing device associated with the user. The system monitors the deployed software packages to determine whether a security vulnerability is introduced to the computing device by the deployed software packages. In response to determining that the security vulnerability is introduced to the computing device by the deployed software packages, the system recalls the deployed software packages by remotely uninstalling the deployed software packages from the computing device.

Abstract: Techniques for providing a securing platform for service provider network environments are disclosed. In some embodiments, a system/process/computer program product for providing a securing platform for service provider network environments includes communicating with an orchestrator and/or another network element on a service provider network to identify a subscriber with a new IP flow using a security platform; associating the subscriber with the new IP flow at the security platform; and determining a security policy to apply at the security platform to the new IP flow based on the subscriber.

Abstract: According to one embodiment, a method, computer system, and computer program product for displaying information on a public device is provided. The present invention may include displaying, based on information received from a connected mobile device, user information and dummy information on a display device. The present invention may further include displaying an indicator alongside the user information and a dummy indicator alongside the dummy information. The present invention may further include transmitting user information and dummy information to a display device, synchronizing display of the user information to the display device, and synchronizing haptic feedback based on a received visual pattern. The present invention may further include generating dummy information according to the type of information.