In one embodiment, a side source device receives an original packet on a transmission control protocol (TCP) connection from an original source device to an original destination device, the original packet having original data and one or more forwarding properties specific to the original packet, and forwards the original packet from the side source device on a path toward the original destination device. The side source device also generates a side packet with side data different from the original data, the side packet having the same one or more forwarding properties specific to the original packet, and forwards the side packet on the path toward the original destination device, the side packet intended for reception and processing of the side data by a side destination device that is on the path toward the original destination device. In another embodiment, the side destination device receives, processes, and drops the side packet.

An example method of decrypting electronic messages includes receiving, by an authentication module of a decryptor device, authentication requests from a plurality of destination clients. The method also includes receiving, by a decryption module of the decryptor device, encrypted electronic messages from the plurality of destination clients. The encrypted electronic messages are derived from a common electronic message sent by a common source client. The method further includes authenticating, based on an authentication table, the plurality of destination clients. The authentication table stores user credentials that are used to authenticate destination clients. The method also includes for each encrypted electronic message received from an authenticated destination client of the plurality of destination clients, decrypting the encrypted electronic message using a common private key and providing the decrypted electronic message to the authenticated destination client. The private key is stored at the decryptor device.

Managing the loading of third-party tools on a website is described. Configuration is received for loading the third-party tools. An intermediary server receives a request for a page that is hosted at an origin server. The intermediary server retrieves the page and modifies the page including automatically including a third-party tool manager to the retrieved page. The third-party tool manager includes a set of one or more client-side scripts that, when executed by the client network application, collects, and transmits information to the intermediary server for loading the third-party tools. The intermediary server loads the third-party tools based on the received information and the configuration. The intermediary server causes event data to be transmitted to third-party tool servers that correspond with the third-party tools.

A file sharing method and apparatus. The method includes uploading, by a first terminal, each encrypted file to a server for saving, and receiving a uniform resource locator (URL) that is returned by the server and corresponds to a location for saving each encrypted file, generating a key package that includes a shared key and a URL that correspond to a file to be shared, and providing the key package for a second terminal, so that the second terminal acquires a corresponding encrypted file by using the URL in the key package, and decrypts the acquired encrypted file by using the shared key in the key package.

Described herein is a system, method, and non-transitory computer readable medium related to a service provider using a third party identity provider to authenticate a user with improved security. An authentication token is received from the identity provider, and can be verified against internal configuration information. The internal configuration information includes data that is not included in the authentication token, and therefore, is not vulnerable to some security attacks, such as a man-in-the-middle attack. After the authentication token is verified, the internal configuration information and authentication token may be used to create a custom identifier, referred to as an identity ID. The identity ID may be used by the service provider to verify user access to resources.

Sensitive data is sent through insecure network regions across different software defined networks (SDNs) over an encrypted path without requiring encryption applications at the source or destination hosts. One or more special-purpose encryptors are strategically placed within each SDN, which can act as an encryptor or decryptor, of both the data packet content and the header. Using the controller and a special encryption service application, the encrypted IP packets are forwarded from an encryptor, closest to the source, towards a decryptor, closest to the destination, utilizing a tagging method. Each encryptor has a static and globally unique tag. Each controller advertises to other controllers its encryptor information: IP of the encryptor, the IP block of the users the encryptor is responsible for and the unique encryptor tag(s). Each forwarder along the flow path is instructed by its respective controller how to forward packets towards the destination according to the tag.

A framework for transferring workloads between security regions of an infrastructure service. For example, techniques for transferring workloads between security regions across a private network based on signatures associated with the security regions.

Exemplary embodiments relate to techniques for anonymizing information in an end-to-end (E2E) encrypted environment; the information may include, for example, statistical data about unique page/message views, view counts, view time, what users selected on the message or page, etc. Exemplary embodiments may prevent an E2E system server from being able to identify which user is associated with which record. Various examples are described, including an embodiment in which an originating client generates the data, encrypts it, and sends it to a random contact. The contact decrypts the data, re-encyrpts it, and sends it to another random contact. The procedure continues for a set amount of time or for a set number of hops. Other embodiments relate to wrapping the data in various layers of encryption and sending the data to clients in a chain. The encrypted layers prevent clients along the chain from being able to view the anonymized data.

A security system makes secure exchanges between a services platform and a communicating thing, which includes a control device. The system further includes a server, referred to as a “mediation” server, which receives a message, referred to as a “first” message, from the services platform, encrypts the first message, and sends the encrypted first message to the communicating thing. The communicating thing is also fitted with an IC card that is distinct from the control device and that decrypts the encrypted first message and sends the decrypted first message to the control device. The encryption and decryption operations are performed by at least one secret key shared between the mediation server and the IC card.

To decrease a load on a network and a storage system, encryption operations can be offloaded to a server locally connected to the storage system. The server receives requests to perform encryption operations, such as LUN encryption or file encryption, for a host. The server obtains an encryption key unique to the host and performs the encryption operation using the encryption key. The server then notifies the host that an encrypted LUN or encrypted file is available for use. The host is able to utilize the encrypted data because the encryption was performed with the host's unique key. Since the server is locally connected to the storage system, offloading encryption requests to the server reduces the load on a network by reducing the amount of traffic transmitted between a host and the storage system.