Symantec Corporation

Nortonlifelock Inc.

Ramakrishnan Meenakshi Sundaram

Bruce McCorkendale

Justin Harmon

Srini Chillappa

Jin Lu

Arun Karthick M A M

The disclosed computer-implemented method for securing Universal Plug and Play connections may include (1) detecting, by a network device within a local network, an attempt by a remote device to establish a connection with a client device within the local network via a UPnP protocol, (2) identifying a forwarding rule applied by the network device on the client device based at least in part on an identity of the client device, (3) determining at least one restriction placed on UPnP connections between the client device and remote devices by the forwarding rule, and then in response to determining the restriction placed on UPnP connections between the client device and remote devices by the forwarding rule, (4) enforcing the restriction on the connection attempted by the remote device with the client device via the UPnP protocol. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for securing universal plug and play connections

The disclosed computer-implemented method for tagging client devices may include (i) receiving from a router at least one network packet that indicates that a client device has attempted to connect to the router and that includes device information identifying the client device, (ii) prompting, automatically in response to receiving the network packet indicating that the client device has attempted to connect to the router, a user to tag the client device with a descriptive name to facilitate management of the client device, (iii) receiving, in response to prompting the user to tag the client device, a tag that indicates a specific descriptive name for the client device, and (iv) transmitting, automatically in response to receiving the tag, the specific descriptive name to at least one of the router and a cloud security server. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for tagging client devices

The disclosed computer-implemented method for managing wireless-network deauthentication attacks may include (1) detecting, at the wireless access point, a deauthentication signal, transmitted over a wireless network that is managed at least in part by the wireless access point, that prompts a target computing device to disconnect from the wireless network, (2) determining both that the deauthentication signal is directed to the target computing device and that the deauthentication signal was not initiated by the wireless access point, (3) determining, based at least in part on the determination that the deauthentication signal was not initiated by the wireless access point, that the deauthentication signal represents an illegitimate deauthentication signal, and (4) performing, in response to determining that the deauthentication signal represents an illegitimate deauthentication signal, a security action to mitigate effects of the illegitimate deauthentication signal on the target computing device. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for managing wireless-network deauthentication attacks

A router-level computer security component validates multiple endpoint computer security components on multiple endpoint devices in a local area network, based on whether given endpoints each have a specific anti-malware scanning engine and set of signatures used by the router-level component. To validate a given endpoint, the router-level component transmits a code sample which will trigger scanning by the specific anti-malware scanning engine in conjunction with a specific signature of the set, resulting in a specific detection result. In response to receiving the specific, expected detection result in return, the router-component validates the endpoint. The router-level component monitors incoming traffic in the local area network, and load balances security processing of the network traffic of each incoming data stream, based on the security capabilities of the corresponding target endpoint, and the security capabilities and available computational bandwidth of the multiple validated endpoint components and the router-level component.

Local area network ecosystem of verified computer security resources

A computer-implemented method for managing smart building systems may include (1) detecting a set of smart devices comprising first and second smart devices in a smart building network, (2) maintaining a smart device management repository by, for each smart device, maintaining information indicating capabilities of the smart device and tracking a location of the smart device, (3) detecting a change in a state of the first smart device, (4) using the smart device management repository to evaluate a proximity of the first smart device to the second smart device and determine that a capability of the second smart device is correlated with the change in state of the first smart device, and (5) triggering a management action in the smart building network based on both the proximity of and the correlation between the first and second smart devices. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for managing smart building systems

The disclosed computer-implemented method for performing security actions based on people's actual reactions to interactions may include (i) detecting an interaction (e.g., an interaction with a digital communication) of a monitored person (e.g., a child), (ii) estimating the monitored person's expected reaction to the interaction, (iii) using contemporaneous sensor data to estimate the monitored person's actual reaction to the interaction, and (iv) performing a security action based at least in part on a comparison of the monitored person's expected reaction and the monitored person's actual reaction. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for performing security actions based on people's actual reactions to interactions

The disclosed computer-implemented method for protecting computing devices from imposter accessibility services may include (1) registering a security application with the computing device as an accessibility service that has special permissions on the computing device that are not available to other applications, (2) ensuring that the security application is the first registered accessibility service on the computing device, and (3) performing, by the security application, a security action after ensuring that the security application is the first registered accessibility service. Various other methods, systems, and computer-readable media are also disclosed.

Growing community of inventors

Chennai, India

Ramakrishnan Meenakshi Sundaram