CenturyLink Intellectual Property LLC

Example systems and methods permit threat intelligence to be determined and used at a local, regional, and/or global level in a communications network. A threat intelligence system may collect traffic information from local computing systems and analyze it for malicious traffic. If a measure of malicious traffic in a local computing system is reached, mitigation actions may be taken in that local computing system. In addition, threat measures may be amplified in other local computing systems, other regions, or globally in the network, in order to more quickly react to a known threat as it may spread in a network.

Systems and methods are provided to utilize information from a directory service to determine, at a layer-one network policy server, the appropriate layer-two network policy server to which an authentication request should be routed. For example, a first directory service group may be created that includes all users using a first authentication type, a second directory service group may be created that includes all users using a second authentication type, etc. The layer-one network policy server may periodically synchronize with the directory service to download information about users in the different directory service groups, update a markup language document with that information, and use the markup language document to help route incoming authentication requests to the correct layer-two network policy server for a particular authentication type. In addition, a priority may be set (and changed) by an administrator favoring one or more authentication types in a network.

Examples of the present disclosure describe systems and methods for providing security against IP spoofing. In aspects, network traffic associated with one or more data requests may be received by a device in a computing environment. The network traffic may be evaluated using one or more automated logic systems or algorithms to identify suspicious or malicious behavior. The automated logic systems or algorithms may implement one or more analyses, such as asymmetric routing analysis, hardware device analysis, user and/or network behavior analysis, etc. Upon identifying suspicious or malicious behavior, the automated logic systems or algorithms may apply a filter to one or more computing devices. For example, a filter for blocking network traffic associated with the suspicious or malicious behavior may be applied to a computing device that is in close geographic and/or logical proximity to an attacking computing device.

Novel tools and techniques are provided for implementing secure network configuration and/or secure network access using a user device. In various embodiments, after establishing a secure wireless connection with a local network device, in some cases, by scanning and decoding a barcode (including connectivity data for connecting with the local network device) that is affixed to, or displayed on a display device on, a surface of the local network device, the user device may configure the local network device with settings and configurations. The user device may also provide a new wireless device with connectivity data for connecting with the local network device, in some cases, by scanning and decoding another barcode on the new wireless device to establish a secure connection to send the connectivity data. The user device and/or the new wireless device may then access a network established by the (configured) local network device.

Systems and methods for enabling secure RFID/NFC communications and thwarting relay attacks are described. A device that includes an RFID or NFC tag (such as a credit card with an NFC tag or a key fob with an RFID tag) includes a sensor system configured to detect, in response to the device receiving a request for information from a tag reader, one or more physical inputs. For example, the sensor system may include a photoresistor that detects light around the device, the presence of which indicates that the device is probably not in the user's wallet or pocket (and therefore probably is not experiencing a relay attack). When the device determines that the sensor output satisfies one or more criteria (such as when sensor system detects light around the device), the device transmits the information to the tag reader; otherwise the device does not transmit the information.

Example systems and methods permit threat intelligence to be determined and used at a local, regional, and/or global level in a communications network. A threat intelligence system may collect traffic information from local computing systems and analyze it for malicious traffic. If a measure of malicious traffic in a local computing system is reached, mitigation actions may be taken in that local computing system. In addition, threat measures may be amplified in other local computing systems, other regions, or globally in the network, in order to more quickly react to a known threat as it may spread in a network.

Configuration changes to the configurations of end devices in a network may be made by configuration devices, which may set up connections with the end devices and send configuration commands to the end devices. In such a system, the compromising of a configuration device may make it possible for an attacker to reconfigure end devices. Systems and methods to improve network security via a consensus-driven configuration plane are provided.

Novel tools and techniques might provide for implementing secure communications for IoT devices. In various embodiments, a gateway or computing device might provide connectivity between or amongst two or more Internet of Things (“IoT”) capable devices, by establishing an IoT protocol-based, autonomous machine-to-machine communication channel amongst the two or more IoT capable devices. For sensitive and/or private communications, the gateway or computing device might establish a secure off-the-record (“OTR”) communication session within the IoT protocol-based, autonomous machine-to-machine channel, thereby providing encrypted machine-to-machine communications amongst the two or more IoT capable devices, without any content of communications that are exchanged amongst the IoT capable devices over the secure OTR communication session being recorded or logged. In some cases, the secure OTR communication session utilizes cryptographic protocols including, without limitation, one or more of AES symmetric-key algorithm, Diffie-Hellman key exchange, SHA-1 hash function, forward secrecy, deniable authentication, malleable encryption, and/or the like.

Systems and methods for mitigating DNS amplification attacks are provided. In one example, a threat intelligence system collects data about the requests received by a DNS server, and/or responses generated by the DNS server. The threat intelligence system triggers a threat mitigation action upon detecting evidence (in one or more forms) of a DNS amplification attack. The threat mitigation action may include filtering DNS responses generated by the DNS server. The filtering rule may indicate that a DNS response in which the payload size is above a threshold payload size is to be dropped. In examples, the payload threshold size is dynamically set by the threat intelligence system using a machine learning model to minimize the filtering of DNS responses for valid DNS queries, while maximizing filtering of DNS responses for malicious DNS queries.

Systems and methods are provided to utilize information from a directory service to determine, at a layer-one network policy server, the appropriate layer-two network policy server to which an authentication request should be routed. For example, a first directory service group may be created that includes all users using a first authentication type, a second directory service group may be created that includes all users using a second authentication type, etc. The layer-one network policy server may periodically synchronize with the directory service to download information about users in the different directory service groups, update a markup language document with that information, and use the markup language document to help route incoming authentication requests to the correct layer-two network policy server for a particular authentication type. In addition, a priority may be set (and changed) by an administrator favoring one or more authentication types in a network.