Servicenow, Inc.

USA As Represented by Secretary of the Navy

Ashton Mozano

Vincent Seguin

Anson Barber Mayers

Mohamed Sofiane Talmat

Joel Rorik Fischer

Jose Virgilio Romero-Mariona

Lauren Karina Choi

Michael Christopher John Albinson

Charlie Sharp

Tom Nguyen

Mihail Schoolov

An indication associated with a request to access a protected object by a subject is received. Using one or more processors, application level behavioral patterns of the subject, context of the request by the subject, usage patterns associated with the protected object, and a current system state are automatically analyzed using one or more machine learning models to determine an analysis result associated with whether to grant the subject access to the protected object. An access control mechanism for the protected object is automatically modified based on the analysis result.

Learning cognitive access control service

A certificate credential and an associated signature is received. The certificate credential and the associated signature are authenticated at an operating system level. Whether the certificate credential has expired is validated at an application level via an external certificate authority. Access to encrypted data is allowed based at least in part on the authentication and the validation of the certificate credential.

Customer-controlled authentication

An indication that a secure connection has been established with a key management service is received. The secure connection is associated with an automatically generated session encryption key utilized for encryption of data communication through the secure connection. In response to the indication that the secure connection has been established with the key management service, a determination is made to perform a rotation of a local encryption key utilized in encrypting locally stored data. The rotation of the local encryption key is performed based at least in part on the automatically generated session encryption key.

Database key management

A request to sign a provided payload is received, wherein the payload includes an automation script specified to execute on one or more management service instances. The automation script is validated, including by modifying the payload to add metadata data associated with the validation. An encrypted version of a digital signature private key that was received is sent to a credential system. An unencrypted version is received and used to sign the modified payload. The signed modified payload is provided in response to the request to sign the provided payload. The signed modified payload is configured to, in response to a request to execute the automation script on the one or more of the management service instances, be verified using a public key corresponding to the digital signature private key and allow a validation of the automation script at least in part by using the included added metadata.

Validated payload execution

A system and method involve determining that one or more data packets received from a first device on a communications network are one of data at rest and data in transit, performing one of an encryption operation and a decryption operation on the data packets, and storing the data packets in a memory device if they are data at rest or transmitting the data packets over the communications network if they are data in transit. If the data packets are data in transit, the method may involve, prior to transmission, encapsulating information into a frame of the data packets to indicate they are data in transit. The data packets may be compressed prior to encryption. The determination that the data packets are one of data at rest and data in transit may be based upon a value of at least one data field of the data packets.

Growing community of inventors

San Diego, CA, United States of America

Ashton Mozano