There is described a device and method of removing unwanted data from original data for prohibiting unwanted data transfer between a first device and a second device along a communication pathway. The communication pathway includes at least one data channel and at least one control channel. The method includes providing programmable hardware at a position along the at least one control channel. Original data applied to the device includes control data and associated protocol data, the control data including wanted and unwanted data. The control data is checked to determine whether the associated protocol data conforms to at least one predetermined protocol mode criteria at the programmable hardware. The programmable hardware is terminated where the control data is deemed to be unwanted data. The resulting data which is left over is substantially free of unwanted data, enabling associated protocol data transmission along the data channel.

A method for detecting an attack, in particular a cyber-attack, on a control device of a vehicle, with the step of: checking communication data that is transmitted via at least one communication channel of the vehicle that is connected to the control device, wherein the checking of the communication data that is transmitted via the at least one communication channel of the vehicle that is connected to the control device includes the examination of whether the communication data transmitted via the at least one communication channel of the vehicle fulfils data requirements that are defined by one or a plurality of changeable rules.

A data-processing device includes a computing unit and an interface unit using a packet-based communication protocol, in particular PCI Express. The data-processing device also includes an intrusion detection unit that is connected via a signal connection to a filter device of the interface unit, and/or to a secure element, in the form of a Trusted Execution Environment, of an authentication arrangement related to the communication protocol. The intrusion detection unit evaluates input signals received via the signal connection for a rule infringement in a set of intrusion detection rules The filter device, at least part of which is hardware, is designed to forward only the communication data meeting an approval condition from the interface unit to an additional component of the data-processing device according to configuration information predetermined in the data-processing device and containing the approval condition. At least one intrusion detection rule relates to the infringement of the approval condition and/or to an authentication error.

Concepts and technologies directed to agentless personal firewall security in virtualized datacenters are disclosed herein. Embodiments can include a computer system that can host a hypervisor via a memory and a processor. Upon execution, the processor can cause the computer system to perform operations. The operations can include receiving an inbound communication request to a virtual machine associated with the hypervisor. The operations also can include identifying a virtual port associated with the virtual machine based on the inbound communication request. The operations can include determining that the inbound communication request lacks an identity of a virtual application process that executes on the virtual machine. The operation also can include building a virtual machine memory map. The operation also can include forcing exposure of the virtual application process based on the virtual machine memory map.

Techniques for providing a securing platform for service provider network environments are disclosed. In some embodiments, a system/process/computer program product for providing a securing platform for service provider network environments includes communicating with an orchestrator and/or another network element on a service provider network to identify a subscriber with a new IP flow using a security platform; associating the subscriber with the new IP flow at the security platform; and determining a security policy to apply at the security platform to the new IP flow based on the subscriber.

A computer system has a separation mechanism which enforces separation between at least two execution environments such that one execution environment is a gatekeeper which interposes on all communications of the other execution environment. The computer system has an attestation mechanism which enables the gatekeeper to attest to properties of the at least two execution environments. A first one of the execution environments runs application specific code which may contain security vulnerabilities. The gatekeeper is configured to enforce an input output policy on the first execution environment by interposing on all communication to and from the first execution environment by forwarding, modifying or dropping individual ones of the communications according to the policy. The gatekeeper provides evidence of attestation both for the application specific code and the policy.

A system and a method of emulating a second cloud computing environment on a first cloud computing environment are disclosed herein. The first cloud computing environment includes an innovation platform having a private domain name system. The private domain name system is split between a customer subnet and a private subnet. The customer subnet is limited to communications with only the private subnet. The customer subnet executes an application thereon. The application is targeted for use on the second cloud computing environment.

Provided are methods, apparatus, and system for policy based wide area network. A network of network appliances is configured with a policy configuration. Each network appliance is configured to validate each wide area network packet against the policy configuration. The validation can include verifying that the packets meet the SD-WAN network segment requirements and security rules including verifying that the source and destination address of the packet meet the firewall zone requirements. Each wide area network packet contains a policy header that is checked by the sending and receiving network appliance against the policy configuration.

Application-initiated network traffic is intercepted and analyzed by an application firewall in order to identify streams of traffic for a target application. An application signature generator preprocesses the raw data packets from the intercepted network traffic by tokenizing the data packets and then weighting each token according to its importance for application identification. The weighted features for each data packet are clustered using an unsupervised learning model, and the resulting clusters are iteratively refined and re-clustered using a proximity score between the clusters and feature vectors for key tokens for the target application. The application signature generator generates a signature for the clusters corresponding to the target application which the application firewall implements for filtering network traffic.

A vehicle component for providing at least one service in a vehicle, having: a processing unit for carrying out data processing in order to perform the at least one service, a data interface for connection to at least one data transmission network of the vehicle in order to receive and/or transmit data for data processing during performance of the service, and in order to receive a service discovery message for service coordination in the data transmission network, and a prefilter unit for carrying out a relevance test of the received service discovery message in order to forward the service discovery message to the processing unit as a function of the relevance test.