Verizon Digital Media Services Inc.

Verizon Patent and Licensing Inc.

Tin Zaw

Bhavesh Upadhyaya

Robert J Peters

Reed Morrison

Alexander Michael Daniel

Thomas Handley

Disclosed is a device for configuring and implementing network security for a connected network node, and for shifting the network security closer to the attack point of origin. In particular, the device may activate attack protections on different Multi-Access Edge Computing ('MEC') devices that are physically located near or at the attack point of origin. The device may detect an attack signature based on one or more received data packets, and may provide a response with an extended header field, the attack signature, and/or other attack protection instructions. The responses may be passed to an address of a suspected attacker. MEC devices along the network path may detect and receive the responses, and implement attack protections in response. The responses may also be passed to a multicast or broadcast address that the MEC device may use to receive responses.

Systems and methods for providing shifting network security via multi-access edge computing

Streaming improvements are provided by using computing, caching, and/or other resources that are provided at different network edges in a Multi-access Edge Computing ('MEC') enhanced network. A MEC device, at a network edge, may customize a stream passing to a client device via the network edge by identifying a break in an original stream manifest passing to the client device, and by inserting a link for the client device to request and play content that is selected by the MEC device during the break. The MEC device then passes the modified stream manifest, instead of the original stream manifest, to the client device. The MEC device may also be triggered, via a prioritization message from a host in the network, to prefetch, cache, and serve a stream from the network edge to a client device accessing the network via that network edge.

Customized and extremely low latency streaming from the network edge

Some embodiments provide a self-configuring firewall for automatic detection and mitigation of security weaknesses. The self-configuring firewall performs passive and active vulnerability detection. Passive detection involves scanning software resources and configurations under firewall protection for vulnerabilities present in the software and software configurations. Active detection identifies vulnerabilities by subjecting the software resources and configurations to simulated malicious traffic. The identified vulnerabilities are mapped to attack signatures. The self-configuring firewall enables the attack signatures which in turn allow the firewall to detect traffic containing attacks directed to exploiting the vulnerabilities.

Automatic detection and mitigation of security weaknesses with a self-configuring firewall

Some embodiments provide automated and intelligent security configuration at the network edge. A server tasked with distributing content provider content automatically detects and modifies attributes in the content provider content in order to close potential security vulnerabilities prior to redistributing that content on behalf of the content provider to different recipients. The vulnerabilities can arise from the content provider misconfiguring attributes or omitting certain security attributes when creating the content. The server can provide a default or customized set of protections, wherein the customized protections are specific to each content provider or the content of each content provider.

Automatically detecting and correcting missing and misconfigured security attributes

Some embodiments provide an origin whose content is distributed by a third party content distributor control over invoking attack protections from the third party content distributor. The origin independently monitors requests and messaging the content distributor passes to the origin as a result of the content distributor needing to retrieve content from the origin before redistribution or because requested content is dynamic or uncacheable. Upon detection of an attack, the origin signals the content distributor to perform one of several attack protections on its behalf. In this manner, the origin leverages the content distributor distributed platform architecture to shield itself from attack. Based on the origin signaling, the content distributor rate limits, blocks, redirects, or performs other attack protections to reduce the load on the origin server.

Origin controlled attack protections in a distributed platform

Some embodiments implement end-to-end certificate pinning for content intake from various content providers and for content distribution to various end users. To ensure secure retrieval of content provider content, the content distributor pins the content provider to one or more certificate authorities. Accordingly, the content distributor only retrieves content from a sender identified as the content provider when the sender identity is verified with a certificate issued by a certificate authority pinned to the content provider. To ensure secure delivery of content from the content distributor to an end user, the content distributor modifies the pinset of the user browser to pin the content distributor to one or more certificate authorities. Thereafter, the user browser only accepts content from a sender identified as the content distributor when the sender identity is verified with a certificate issued by a certificate authority pinned to the content distributor in the browser pinset.

Growing community of inventors

Los Angeles, CA, United States of America

Tin Zaw