Various systems and methods for user-authorized onboarding of a device using a public authorization service are described herein. In an example, a 3-way authorization protocol is used to coordinate device onboarding among several Internet of Things (IoT) Fog users (e.g., devices in a common network topology or domain) with principles of least privilege. For instance, respective onboarding steps may be assigned for performance by different Fog ‘owners’ such as respective users and clients. Each owner may rely on a separate authorization protocol or user interaction to be notified of and to give approval for the specific onboarding actions(s) assigned. Further techniques for implementation and tracking such onboarding actions as part of an IoT network service are also disclosed.

Embodiments of the invention are directed to the utilization of trust tokens to perform secure message transactions between two devices. A trust token transmitted in a message from one device may include first data that is digitally signed by a trust provider computer, and second data that is digitally signed by the device itself. Upon receipt of a message containing a trust token, the recipient may utilize the first data to verify with the trust provider computer that the sender of the message is a trusted party. The trust provider computer may provide the recipient device the public key of the sender. The recipient may utilize the second data and the provided public key to verify that the sender signed the message and that the message is unaltered. These techniques may increase detection of relay, replay, or other man-in-the-middle attacks, decreasing the likelihood that such attacks will be successful.

The present disclosure relates to systems, devices and methods for device security and trust score determinations. In one embodiment, a method includes requesting, by a first device, trust score data for a second device, wherein the first device requests trust score data from a trust score management server, and receiving, by the first device, trust score data from the trust score management server. The method also includes generating a first trust score for the second device and transmitting the first trust score for the second device with a trust score management server. The method also includes configuring, by the first device, at least one control parameter for operation of the first device with the second device based on the first trust score, wherein configuring adjusts a previous control parameter to restrict operation of the first device relative to the second device. Device and systems are provided to enhance network security.

A security platform of a data network is provided that includes security services for computing devices in communication with the data network. The security platform may apply a security policy to the computing devices when accessing the Internet via a home network (or other customer network) and when accessing the Internet via a public or third party network. To provide security services to computing devices via the home network, the security platform may communicate with a security agent application executed on the router (or other gateway device) of the home network. In addition, each of the devices identified by the security profile for the home network may be instructed or otherwise be provided a security agent application for execution on the computing devices. The security agent application may communicate with the security platform when the computing device connects to the Internet over a third party or public access point.

A method and apparatus may include configuring, by a network node, a user equipment to use an aggregation of radio technologies. At least one radio bearer is established between the user equipment and the network node and is routed over an access point of an alternate wireless network. The method may also include determining whether trustworthy security is provided by the access point of the alternate wireless network. The method may also include instructing the user equipment to turn off ciphering based on the determining, wherein the ciphering is turned off for the at least one radio bearer between the user equipment and the apparatus. The method may also be used for configuring specific ciphering on selective radio bearers.

A method at a network element for processing a first message destined for an intelligent transportation system station, the method including receiving from a sending entity, or generating, the first message at the network element; based on a source or contents of the first message, performing one of: discarding the first message; or modifying the first message to provide an indication to the intelligent transportation system station of checks the intelligent transportation system does not need to perform, thereby creating a second message; and forwarding the second message to the intelligent transportation system station.

Systems, apparatus, methods, and techniques for an ego vehicle to respond to detecting misbehaving information from remote vehicles are provided. An ego vehicle, in addition to reporting misbehaving vehicles to a misbehavior authority via a vehicle-to-anything communication network, can, take additional actions based in part on how confident the ego vehicle is about the evidence of misbehavior. Where the confidence is high the ego vehicle can simply discard the misbehaving data and provide an alternative estimate for such data from alternative sources. Where the confidence is not high the ego vehicle can request assistance from neighboring vehicles and roadside units to provide independent estimates of the data to increase confidence in the evidence of misbehavior.

Systems, apparatuses, and methods are described for establishing, or re-establishing, trust for a network device. A user device may send, via a network device, a service request to establish trust for the network device in a network. The service request may comprise, or may allow look up of, identifying information for the network device, such as a network address. Trust of the network device may be established, at least in part, by confirming the network address (or other identifying information) associated with the network device, and/or by confirming certain devices that are in communication with the network device. An authentication token may be sent to the network device for reconnecting to the network.

A method initializes a spatial web of trust for a sensor platform array by positioning multiple sensor groups within a restricted workspace, such that adjacent sensor platform pairs are formed from corresponding platforms of the groups within a close-field range. Sensor-specific identification keys are exchanged between respective adjacent sensor platforms, with the groups progressively repositioned to form unique adjacent sensor platform pairs within the close-field range. The method includes progressively exchanging the keys until each platform has exchanged a respective key with every other platform in the array, thereby initializing the spatial web of trust. A system for initializing the spatial web of trust for a UAV swarm includes the UAV swarm in communication with a base station over an encrypted communications link. Each UAV includes a CPU, a sensor suite, and memory on which is recorded instructions for the method.

In an embodiment, a method for allocating privileges on a computer network includes calculating a permission level based at least in part on a login context associated with a login request for connection to a network from a user via a client device, adjusting the calculated permission level such that a resulting first adjusted permission level does not exceed a previous permission level assigned to the client device, assigning the first adjusted permission level to the client device, collecting activity data representative of network activity by the user while logged in to the network, and classifying, using a classifier model, at least a portion of the activity data to generate a second adjusted permission level for the client device.