Cisco Technology, Inc.

Nds Corporation

Synamedia Limited

Yaron Sella

Michal Irit Devir

Harel Cain

Kevin Holcomb

Erez Waisbard

Aviad Kipnis

Itsik Mantin

Raghuram S Sudhaakar

Steve Epstein

Perry Smith

Subhasri Dhesikan

Yaacov Belenky

Avi Fruchter

David Wachtfogel

Moshe Kravchik

Itay Harush

David Wende

Chaim Shen-Orr

Hillel Michael Solow

Yossi Tsuria

Joel Abraham Obstfeld

Yossef Tsuria

Avraham A Poupko

Moshe Shlissel

Andrew Robert Sinton

Leonid Sandler

Yishai Sered

Yair Mirsky

Len Sundy

Alexander Kreines

Benyamin Hirschberg

Gilad Taub

Andrew Michael McPhee

Victor Halperin

Dov Falik

Gene Itkis

Avraham Poupko

Yigal Reiss

Ben Walton

In one embodiment, methods, systems, and apparatus are described in which data to be used by a processor is stored in a memory. Network communications with a data center are enabled via a network interface. The processor maintains a reporting policy for reporting anomalous events to the data center, the reporting policy having at least one rule for determining a reporting action to be taken by the processor in response to an anomalous event. The processor further monitors the IoT device for a report of an occurrence of the anomalous event. The processor performs the reporting action according to the at least one rule, in response to the report of the occurrence of the anomalous event. An episodic update to the reporting policy from the data center may be received at the processor, which modifies the reporting policy in accordance with the update. Related methods, systems, and apparatus are also described.

Alert throttling

In one embodiment, a sender node in a serial network identifies a message identifier for a packet to be sent by the sender node. The sender node selects a cyclical redundancy check (CRC) initialization vector associated with the message identifier. The sender node generates a CRC value for the packet, based on the selected initialization vector. The sender node sends the packet via the serial network. The sent packet includes the message identifier and the generated CRC value. In turn, a receiver node that receives the packet uses the generated CRC value to authenticate the sender node.

Using CRC for sender authentication in a serial network

The secure chain of trust steps to boot-up a computing device are split between the shutdown procedure of the computing device and the boot-up procedure of the computing device to reduce the time required for the computing device to boot-up. The main image associated with a central processing unit of the computing device is validated during the shutdown procedure of the computing device such that the operating system for the central processing unit is available when the computing device receives an action to power on. The boot-up time for the computing device is reduced, which allows the computing device to boot-up within an established time frame.

Split chain of trust for secure device boot

Many modern devices and machines (e.g., Internet of Things (IoT) devices and connected vehicles (CV)) include wireless interfaces that permit external devices to communicate with the devices and machines. These wireless interfaces can be attacked by malicious actors who can affect the operation of the devices or machines. Embodiments herein describe a user controlled actuator (e.g., a knob, set of buttons, switches, etc.) for responding to a wireless attack. Using the actuator, the user can set a response level depending on the threat. Each threat level can elicit a predefined action or set of actions from a control system in the device or machine.

User interface for responding to wireless attacks

A system includes a network gateway in communication with a plurality of servers, a household behavior model processor which models a household behavior model based at least on expected usage of each of a plurality of network appliances, wherein each one appliance of the plurality of network appliances is associated with one of the plurality of servers, and behavior of users associated with the network gateway, an anomaly detector which determines, on the basis of the household behavior model, if an anomalous control message which has been sent to one of the plurality of network appliances from one of the servers has been received at the network gateway, and a notification server which sends a notification to an application on an administrator's device upon receipt of the anomalous control message at the network gateway. Related systems, apparatus, and methods are also described.

Smart home security system

In one embodiment, a video stream is received, and a spatially distinct region of a frame in the received video stream to be modified is identified, the spatially distinct region of the frame being encoded separately from any other region in the frame. A segment of the spatially distinct region of the frame to be modified is extracted. The extracted segment of the spatially distinct region is modified. The extracted segment of the spatially distinct region into a single-segment spatially distinct region is encoded. A network abstraction layer (NAL) header is associated with the encoded single-segment spatially distinct region. The encoded single-segment spatially distinct region and its associated NAL header is inserted into the received video stream following the identified spatially distinct region of the frame to be modified. Related methods, systems and apparatus are also described.

Framework for embedding data in encoded video

In one embodiment, a vehicle having a plurality of network interfaces communicates with a first communication network via a first one of the network interfaces. The vehicle receives performance data regarding the first communication network and one or more other communication network, wherein the received performance data is associated with a particular location. The vehicle determines in advance of arriving at the particular location that the vehicle should switch from communicating with the first communication network to communicating with a selected one of the one or more other communication network, based on the received performance data. At the particular location, the vehicle switches from communicating with the first communication network via the first network interface to communicating with the selected communication network via a second one of the plurality of network interfaces.

Optimizing communications across multiple network interfaces of a connected vehicle

In one embodiment of a method, system, and apparatus described herein, an encoded video is received. At least one set of areas of a spatially distinct region of a video frame to be modified is selected. An entropy layer from the spatially distinct region of a video frame. A state of the removed entropy layer and the location of a first area of the set of areas of the spatially distinct region of the video frame is stored. One area of the set of areas is decoded, the decoding occurring recursively until all areas of the set of areas of the spatially distinct region of the video frame for predicting and decoding the one area are decoded. A modification of the decoded one area is performed. The modified decoded one area is re-encoded according to a re-encoding condition. The stored state of the entropy layer is retrieved, and the entropy layer is re-applied at the first area to the spatially distinct region of the video frame which comprises the set of areas. Related methods, systems and apparatus are also described.

In one embodiment, a first apparatus includes a processor and an interface, wherein the interface is operative to receive a request from a second apparatus to commence a keyed-hash message authentication code (HMAC) computation, the processor is operative to perform a first computation computing a first part of the HMAC computation using a secret key K as input yielding a first value, the interface is operative to send the first value to the second apparatus, the interface is operative to receive a second value from the second apparatus, the second value resulting from the second apparatus processing the first value with at least part of a message M, the processor is operative to perform a second computation based on the second value and the secret key K yielding an HMAC value, and the interface is operative to send the HMAC value to the second apparatus.

Collaborative computation of HMAC

In one embodiment, an apparatus includes a processor to receive a primary video, select first sections of the primary video in which to include units of data for use in watermarking, select second sections of the primary video, each second section including a first data item without which at least one video unit of the primary video cannot be rendered or rendered correctly, replace each first section with at least two watermark variants, replace each second section with at least two watermark variant decoys, wherein the apparatus is operative to operate in an environment including an end-user device operative to select one of the watermark variants for each first section and one of the watermark variant decoys for each second section for rendering as part of an interleaved video stream including the primary video in order to embed units of data of an identification in the interleaved video stream.

Reinforced interleaved watermarking

In one embodiment, a method including dividing a reference mask into a plurality of reference mask divisions, determining a plurality of motion vectors respectively associated with a plurality of slice divisions, wherein the plurality of reference mask divisions respectively correspond to the plurality of slice divisions, modifying a blurring kernel in accordance with the plurality of motion vectors, yielding a plurality of modified blurring kernels that are respectively associated with the plurality of slice divisions, and performing at least one action to yield an altered reference mask, including for the plurality of reference mask divisions and the plurality of modified blurring kernels: convolving a reference mask division with a weighted function of at least a modified blurring kernel associated with a slice division, of the plurality of slice divisions, to which the reference mask division corresponds.

Self-similar reference masks for persistency in a video stream

In one embodiment, a method for ransomware-aware file backup is implemented on a computing device and includes: backing up a target population of files from a target file location in a backup transaction, computing a backup delta score for the backup transaction, where the computing comprises comparing backup data from the backup transaction with backup data from a previous backup transaction, determining whether the computer backup delta score exceeds a pre-defined threshold, and upon the computed backup delta score exceeding the pre-defined threshold: determining that the backup transaction is indicative of a ransomware infection, and performing at least one counter-measure in response to the ransomware infection.

Intelligent backup system

In one embodiment, a system is described, the system including a network gateway in communication with a plurality of original equipment manufacturer (OEM) servers, a household behavior model processor which models a household behavior model based at least on expected usage of each of a plurality of OEM network appliances, wherein each one appliance of the plurality of OEM network appliances is associated with one of the plurality of OEM servers, and behavior of users associated with the network gateway, an anomaly detector which determines, on the basis of the household behavior model, if an anomalous control message which has been sent to one of the plurality of OEM network appliances from one of the OEM servers has been received at the network gateway, and a notification server which sends a notification to an application on an administrator's device upon receipt of the anomalous control message at the network gateway. Related systems, apparatus, and methods are also described.

In one embodiment, a method, system and apparatus for watermarking MPEG-2 compressed video is described, the method, system and apparatus including detecting a pair of neighboring blocks in a MPEG-2 encoded I-frame, determining if the pair of neighboring blocks have dct_dc_differential fields with different values that are within a given threshold value of each other, and embedding a watermark payload bit in the neighboring blocks as a positive result of the determining, the embedding including ordering dct_dc_differential fields of the neighboring blocks such that ordering the dct_dc_differential fields in a first manner encodes a one bit and ordering the dct_dc_differential fields in a second manner encodes a zero bit. Related embodiments of methods, systems, and apparatuses are also described.

Growing community of inventors

Beit Nekofa, Israel

Yaron Sella