Intel Corporation

Citibank, N.a.

Uri Kahana

Alan D Ross

Tarun Viswanathan

Eran Birk

Oded Margalit

Max Leibovich

Mickey Hovel

Ilia Shevrin

Hormuzd M Khosravi

John B Vicente

Abhilasha Bhargav-Spantzel

Mohammad R Haghighat

Gideon Prat

Oliver W Chen

Joseph Tal

A model checking system configures a formal compliance document with remediation actions to correct security conflicts in an IAM system. The system applies a model checker on an abstract model of the IAM system to identify security conflicts and identifies remediation actions from the formal compliance document. The system applies the model checker after applying the first remediation action and determines whether the first remediation action creates another security conflict. If a remediation action is identified that does not create a new security conflict, then the system applies the identified remediation action. The formal compliance document is updated accordingly. When an operator revises code for a policy change, the system will apply the model checker on an abstract model of the IAM system with the code revision to identify security conflicts. If new security conflicts are not created in the simulation, then the system may deploy the code revision.

Security remediation

A model checking system detects violations and conflicts in security and verification policies by running model checking processes. The system detects privilege escalation attacks in misconfigured identification and access management ('IAM') policies by modeling security policy documents and IAM actions as logical formulas and then running model checking on the model. The system translates non-Boolean variables, such as string variables, into Boolean variables in order to apply an SAT model checker. The model checker also determines whether a policy violation can be achieved in a finite number of steps by elevating privileges of some compromised principal over multiple iterations of the model checking process, or proves absence thereof.

Security policy validation

Technologies for providing policy-based secure containers for multiple enterprise applications include a client computing device and an enterprise policy server. The client computing device sends device attribute information and a request for access to an enterprise application to the enterprise policy server. The enterprise policy server determines a device trust level based on the device attribute information and a data sensitivity level based on the enterprise application, and sends a security policy to the client computing device based on the device trust level and the data sensitivity level. The client computing device references or creates a secure container for the security policy, adds the enterprise application to the secure container, and enforces the security policy while executing the enterprise application in the secure container. Multiple enterprise applications may be added to each secure container. Other embodiments are described and claimed.

Policy-based secure containers for multiple enterprise applications

This disclosure is directed to a context-aware proactive threat management system. In general, a device may use internal activity data along with data about external activities (e.g., provided by remote resources) for threat assessment and mitigation. A device may comprise, for example, a hostile environment detection (HED) module to coordinate threat assessment and mitigation. The HED module may accumulate internal activity data (e.g., from security services in the device), and external activity data regarding a system environment and/or a physical environment from the remote resources. The HED module may then assess threats based on the activity data and determine automated and/or manual mitigation operations to respond to the threats. In one embodiment, visualization features may also be used to, for example, visualize threats to a user, visualize automatic/manual mitigation operations, request user confirmation regarding the performance of manual mitigation operations, etc.

Context-aware proactive threat management system

Techniques for dynamic endpoint secure location awareness may include dynamically sending a location query in response to a change in location for a mobile device. A location response may be received. The platform security engine may determine whether the mobile device is located in a secure location based on the location response. Other embodiments are described and claimed.

Techniques for dynamic enpoint secure location awareness

Some demonstrative embodiments include devices, systems and/or methods of maintaining connectivity over a Virtual-Private-Network (VPN). For example, a system may include a server to communicate with at least one computing device via a VPN tunnel, to receive from the computing device a mode indication indicating that the computing device is in a standby mode, to receive from at least one application server one or more packets intended for the computing device when the computing device is in the standby mode, based on at least one filtering criterion, to detect at least one targeted packet to be provided to the computing device, and to transfer the targeted packet to the computing device via the VPN tunnel.

Growing community of inventors

Givat-Ada, Israel

Uri Kahana