226 results about "Policy enforcement" patented technology

An artificial intelligence driven system of systems may include a layered architecture for providing transaction support to various types of enterprises. A governance layer implements automated governance and policy enforcement through specialized governance modules utilizing generative AI technology. An enterprise layer supports enterprise functions by integrating management and control platforms with digital infrastructure. An offering layer creates and manages system offerings via content generation, personalization, and smart product modules. A transactions layer enables automated transaction orchestration through API integration, execution, and fulfillment modules. An operations layer manages AI systems through generation, training, verification and orchestration modules. A network layer provides adaptive networking capabilities through routing, protocol selection and communication modules. A data layer processes fused data from multiple sources using machine learning and AI systems. A resource layer manages computing, storage, and other resources through specialized resource modules.

A privacy network and unified trust model runs privacy algorithms that can completely obfuscate any data or rendering the data opaque and meaningless so they can be freely aggregated and shared without risk of security or privacy breach. The obfuscated algorithms can be applied to obfuscated data to produce obfuscated output. The obfuscated output is identical to what would have been produced had the algorithms been applied to data and then obfuscated with the same privacy algorithm. Information from disparate sources is virtually aggregated, linked, analyzed, transformed and used without revealing any meaningful information to any person or any system—even to the processors performing the computation.

Provided herein are techniques to facilitate dynamic policy enforcement for cloud-based applications in an enterprise environment. In one example, a method may include obtaining, from a cloud network of a cloud-based application, an authentication request associated with an enterprise user that is seeking to utilize the cloud-based application, wherein the authentication request comprises an application identifier and a vulnerability index associated with the cloud-based application; identifying one or more vulnerabilities of the cloud-based application based on the application identifier and the vulnerability index; determining an access level for which the cloud-based application is allowed to access the enterprise network based, at least in part, on one or more vulnerabilities of the cloud-based application and one or more access rules associated with the cloud-based application; and sending a response to the cloud network indicating the access level for which the cloud-based application is allowed to access the enterprise network.

Disclosed herein are systems and methods for enabling decentralized, schema-driven interoperability across distributed computing environments through the use of a Standard Knowledge Language (SKL). An Enterprise Mesh Platform (EMP) interprets and executes SKL specifications—such as capabilities, objects, mappings, policies, and workflows—as composable, machine-interpretable contracts that define data structures, logic, and governance protocols. The system supports dynamic versioning, validation, semantic linking, and recursive execution of SKL-defined components. A mesh-wide analytics server coordinates execution, issue detection, and resolution propagation. Capabilities can be orchestrated, remediated, and adapted in real-time based on SKL-defined relationships, while preserving compliance and traceability. The disclosed architecture facilitates federated development, adaptive system integration, and fine-grained policy enforcement across complex digital ecosystems.

An AI-driven financial planning system for real-time market adjustment, consisting of: a neural inference coprocessor configured to execute deep financial forecasting models, including recurrent neural networks and attention-based encoders, on the device, and wherein the processor dynamically updates portfolio parameters in response to market signals exhibiting volatility differences above a statistical threshold calculated using an exponentially weighted moving standard deviation; a financial data acquisition module configured to continuously receive and analyze heterogeneous data streams, including market indices, interest rates, stock and bond price fluctuations, economic indicators, regulatory updates, and financial news sentiment feeds; a behavioral analytics engine configured to create a dynamically evolving user-specific financial behavior profile based on real-time analysis of transaction history, income-expenditure cycles, psychometric test results, and temporal lifestyle patterns using supervised and unsupervised machine learning algorithms; A goal optimization module configured to transform high-level, user-defined financial goals into quantitatively tracked multi-level goals. It uses a reinforcement learning framework that predicts optimal asset allocations across multiple time horizons. a real-time strategy simulation engine configured to perform Monte Carlo simulations and deep Q-learning-based assessments to simulate the resilience of proposed financial strategies under different macroeconomic regimes and trigger redistribution events based on predefined confidence thresholds; a compliance-aware execution interface configured to interact with financial institutions through encrypted API channels, ensuring policy enforcement using a smart contract validator and a hardware-enabled secure transaction signing unit; and a recommendation display unit configured to render dynamic dashboards for visualizing investments, reallocation warnings, confidence intervals, and sensitivity sliders, and where user interaction with the unit flows back into the behavioral model for real-time learning.

An AI-driven, cloud-based system (100) for real-time biomedical and pharmaceutical compliance and risk management, including: (a) a compliance knowledge module configured to ingest, interpret and structure regulatory data using natural language processing (NLP) and generate machine-readable compliance rules; (b) a real-time monitoring and event recording module configured to collect and normalise operational data from distributed biomedical and pharmaceutical systems, including laboratory information management systems (LIMS), manufacturing execution systems (MES) and IoT-enabled devices; (c) an intelligent risk assessment and prediction module configured to correlate operational data with compliance rules, calculate dynamic risk scores and predict potential compliance violations using machine learning models; (d) an automated policy and workflow enforcement module configured to initiate remedial actions, assign tasks and log activities based on predefined standard operating procedures (SOPs); (e) an audit readiness and reporting module configured to generate compliance logs, audit trails and standardised regulatory reports in real time; and (f) an adaptive learning and feedback optimization module configured to refine rule sets and predictive models based on feedback, historical data and regulatory updates; g) the modules are integrated into a cloud infrastructure to enable real-time, scalable and predictive compliance and risk management across biomedical and pharmaceutical processes.

A cloud deployment automation system consisting of: a deployment automation device housed in a rack-mountable enclosure, the device comprising: a multi-core orchestration processor configured to execute deployment logic as compiled execution graphs; a storage module operatively coupled to the orchestration processor, the storage storing a set of deployment templates, real-time execution states, telemetry logs, and policy configurations; a secure credential management processing unit embedded in the device, configured to generate, store, and rotate cloud access tokens, API keys, and user-specific credentials, and to provide encrypted access to those credentials during deployment execution; an in-memory workflow execution engine executed by the orchestration processor, configured to analyze a user-defined deployment configuration that includes a declarative specification of infrastructure resources and compile that configuration into a directed acyclic graph (DAG) that represents the resource deployment order, dependency mapping, and rollback relationships, a cloud provider interface subsystem communicatively connected to multiple heterogeneous cloud platforms via appropriate API adapters, the subsystem enabling the orchestration processor to send provisioning requests and receive status events from the platforms; a customizable workflow compiler unit configured to convert graphical workflow definitions or domain-specific language (DSL) scripts into execution sequences that can be used by the workflow execution engine, where the workflow compiler unit supports conditional branching, asynchronous operations, and runtime variable resolution; and A policy enforcement control unit integrated into the deployment automation device, with the policy engine configured to apply organization-specific compliance rules, tagging conventions, security group configurations, and runtime resource limits to all deployment actions in a context-aware manner prior to execution.

Systems and methods for enforcing tag-based policy on dynamic workloads include monitoring, via a cloud-based system, traffic associated with one or more customers of the cloud-based system; receiving a packet from a workload associated with a customer of the one or more customers; performing a tag lookup at one or more nodes of the cloud-based system based on the packet; enforcing one or more policies based on the tag lookup. Based on no tags being found for the workload during the tag lookup at the one or more nodes, the nodes are adapted to drop the packet; query the one or more cloud connectors for workload information; and receive, in a next packet, all tags and a version associated with the workload.

Methods, apparatuses, systems, and machine-readable media are disclosed for improving packet filtering efficiency by reducing processing time and / or by reducing memory usage. Any of various types of data structures, such as flat hash maps and / or ruletrees, may be used by a packet filtering appliance to search for cybersecurity policy packet filtering rules that should be applied to in-transit packets. The packet filtering appliance may search the index data structures for matches of search objects, in the form of values that the packet filtering appliance extracts from in-transit packets, to threat indicator matching criteria of the policy rules. Each of the index data structures may map rule identifiers (rule IDs) of policy rules to keys that are based on (or that comprise) the matching criteria of those rules.

A trusted communications environment includes a primary participant with a group creator and a distributed ledger, and a secondary participant with communication credentials. An Internet of Things (IoT) network includes a trusted execution environment with a chain history for a blockchain, a root-of-trust for chaining, and a root-of-trust for archives. An IoT network includes an IoT device with a communication system, an onboarding tool, a device discoverer, a trust builder, a shared domain creator, and a shared resource directory. An IoT network includes an IoT device with a communication system, a policy decision engine, a policy repository, a policy enforcement engine, and a peer monitor. An IoT network includes an IoT device with a host environment and a trusted reliability engine to apply a failover action if the host environment fails. An IoT network includes an IoT server including secure booter / measurer, trust anchor, authenticator, key manager, and key generator.

This disclosure describes methods, devices and systems for abnormal network data identification and policy enforcement. An example method includes obtaining incoming network data from a network device, the networking data including operating information for the network device and packet metadata. The method also includes classifying the incoming network data using one or more machine learning models, including identifying abnormal network data from the incoming network data. The method further includes causing a policy rule to be generated based on the abnormal network data.

This disclosure describes methods, devices, and systems for network anomaly detection and policy enforcement. An example method includes obtaining metadata for a plurality of network packets. The method also includes detecting an anomaly in the plurality of network packets by analyzing the obtained metadata and the operating information. The method also includes generating, without user input, a policy rule based on the detected anomaly. The method further includes enforcing the policy rule at the one or more network devices.

Systems and methods are provided for customized grouping of end user devices using a new group identifier tag (GIT) in addition to role-based access (e.g., administrator or guest) and device identifier access (e.g., IP or MAC address). Two components may be implemented at a network access device, including a data plane component and a control plane component. For example, the control plane component may authenticate an end user device, store the MAC and IP addresses for authenticated end user devices, and define access roles for the end user device in the datapath. The data plane component may perform packet processing (e.g., forwarding and policy enforcement) pursuant to previously-defined rules. Whenever a packet arrives at the Network Access Device, the packet is forwarded according to the rules specified by the “role” and GIT present in the entry, allowing for improved processing and scalability of network traffic processing.

A system (100) for multi-channel purchase authorization with dynamic role validation, comprising: (a) a multi-channel request capture module configured to receive and standardise purchase requests initiated through a variety of communication channels, including corporate portals, mobile applications, emails and messaging platforms; (b) a role identification and contextual mapping module configured to dynamically retrieve user roles and contextual information based on real-time access management data and organizational hierarchy; c) a policy and rules module configured to evaluate purchase requests based on pre-configured and context-sensitive authorization policies, thresholds and compliance rules; (d) a dynamic role validation and escalation module configured to validate whether the requester has the authority to initiate or authorise a transaction and, if not, to automatically escalate the request to an appropriate authorised role; (e) an authorization workflow orchestration module configured to sequence approval steps, apply business logic, manage parallel or sequential workflows, and interface with external procurement systems; f) and an audit, logging and analytics module configured to record all request, validation and authorization actions in a tamper-proof log and generate real-time insights and compliance metrics, g) where the system enables real-time, role-based purchasing authorization across multiple channels with dynamic policy enforcement and escalation handling.

Methods and systems for managing a data processing system are disclosed. A management controller of the data processing system may obtain location data for the data processing system via an out-of-band communication channel. The management controller may identify policies based on the location data, and make an identification regarding whether the data processing system is operating out of compliance with respect to the policies. If the data processing system is operating out of compliance, then the management controller may perform an action set to update operation of the data processing system in a manner that improves compliance of the data processing system with respect to the policies. The data processing system may provide computer-implemented services based on the updated operation.

Disclosed herein are systems and methods for enabling decentralized, schema-driven interoperability across distributed computing environments through the use of a Standard Knowledge Language (SKL). An Enterprise Mesh Platform (EMP) interprets and executes SKL specifications — such as capabilities, objects, mappings, policies, and workflows — as composable, machine-interpretable contracts that define data structures, logic, and governance protocols. The system supports dynamic versioning, validation, semantic linking, and recursive execution of SKL-defined components. A mesh-wide analytics server coordinates execution, issue detection, and resolution propagation. Capabilities can be orchestrated, remediated, and adapted in real-time based on SKL-defined relationships, while preserving compliance and traceability. The disclosed architecture facilitates federated development, adaptive system integration, and fine-grained policy enforcement across complex digital ecosystems.

This invention introduces a sophisticated system for deploying projects on cloud platforms, combining Unikernels, Cyber Security Mesh Architecture (CSMA), MQTT protocol with SHA256 encryption, an Unikernel Orchestration Rules Engine (UORE), generative AI, and an innovative caching mechanism. Unikernels offer a secure, isolated environment for applications, reducing overhead and boosting performance. CSMA provides extensive security through analytics, identity management, and policy enforcement. The MQTT protocol, secured with SHA256, ensures the integrity and confidentiality of communications. UORE automates deployment, integrating a TLS terminator and data management for streamlined operation. Generative AI proactively resolves deployment challenges, particularly for complex applications, while the caching mechanism enhances performance and efficiency by minimizing latency. This integrated approach automates and secures the deployment process, enabling scalable, efficient, and real-time project creation and deployment in the cloud, thereby addressing the key challenges of cloud application hosting.

Enhanced security for Zero Trust networks is provided by SSH-customized tunnel clients / tunnel servers, a catalog service, and loopback address DNS mechanisms. Systems and methods provide Policy Enforcement Point (PEP) layer enhancements, strategically positioning the PEP between the user and the network resource. It manages network traffic flows and provides moderate control granularity, near-real-time enforcement decisions, low overheads, and broad applicability to TCP / IP traffic through modified tunneling implementations of Secure Shell (SSH). Unique use of SSH tunneling is utilized and adapted to selectively filter tunnel requests based on user entitlements, ensuring secure and authorized access to network resources. This method entails detailed assessment of tunneling requests, DNS manipulation, and the use of loopback address space for traffic redirection, all without requiring modifications to client-side applications. The approach significantly enhances network security by controlling access based on continuous verification of user entitlements, addressing the shortcomings of traditional network security models.

Techniques for extending local cellular WAN capabilities to a connected device are disclosed. In some embodiments, a system, a process, and / or a computer program product for extending local cellular wide area network (WAN) capabilities to a connected device includes selecting a first network communication device associated with a software-defined wide area network (SD-WAN) for policy enforcement, wherein the policy enforcement includes SD-WAN path selection; monitoring cellular network status information associated with a second network communication device of the SD-WAN; and synchronizing the cellular network status information associated with the second network communication device of the SD-WAN with the first network communication device associated with the SD-WAN, wherein the first network communication device associated with the SD-WAN uses the network status information for the policy enforcement.

Systems, methods, and devices are disclosed herein to identify and deploy policy changes from a policy source in a wireless communication network to enforcement points in the network based on trends identified by the policy source in KPIs reported by the enforcement points. In an implementation, enforcement points in the network report KPIs to the policy source. The KPIs are related to authorization attempts made by user equipment in the network. The policy source, upon receiving the KPIs, identifies a trend in the KPIs and identifies a policy change based on the KPIs. The policy source then deploys the policy change to the enforcement points. In various implementations, the policy source is a Policy Decision Point (PDP), and the enforcement points are Policy Enforcement Points (PEPs).

Assigning priority values to applications in advance facilitates later precedence ordering of the application identifiers when processing network traffic. The priority values can be assigned according to defined rules that satisfy a paradigm for application precedence in policy enforcement. When multiple application identifiers are determined from inspecting network traffic of a flow, a control plane process retrieves the assigned priority values and sorts the application identifiers according to the priority values. The control plane then communicates the sorted list of application identifiers to the data plane. The data plane enforces policies set for the applications identified in the list of application identifiers on the corresponding network traffic flow according to the order of precedence conveyed by the sorted list. This allows flexible and accurate policy enforcement on network traffic.

Provided is an architecture for facilitating creation and enforcement of policy templates. The architecture includes a policy template designer, a script generator, a policy enforcement engine, and a plurality of technology-specific interpreters. The policy template designer records, for creating a policy template, selection of a set of technologies. The script generator generates a policy template script indicative the set of technologies. The policy enforcement engine generates a set of provisioning scripts indicative of a set of resources to be provisioned by the set of technologies. The policy enforcement engine communicates the set of provisioning scripts to a set of technology-specific interpreters of the plurality of technology-specific interpreters. The set of technology-specific interpreters communicate with the set of technologies to provision the set of resources.

A data processing system and method, and a related device, relating to the technical field of artificial intelligence (AI). The data processing system comprises a general-purpose processor and an AI accelerator card. The general-purpose processor is used for sending an operation request comprising authorization authentication information and requesting to process an AI model deployed in the AI accelerator card. The AI accelerator card is constructed to be provided with a trusted execution environment (TEE), and the AI accelerator card is used for running a policy enforcement point (PEP) component deployed in the TEE, and is further used for receiving the operation request and determining whether the authorization authentication information in the operation request complies with a verification rule in the PEP component, and when the authorization authentication information complies with the verification rule, the first operation request is executed to execute a processing operation on the AI model. In this way, the PEP component is deployed in the TEE of the AI accelerator card, that is, the PEP is deployed in an execution environment closer to the AI model, so that the AI model can be effectively prevented from being illegitimately accessed by the general-purpose processor, thereby ensuring access safety of the AI model in the AI accelerator card.

This invention provides methods and systems for seamless mobile connectivity between public and private cellular networks. The system dynamically switches user devices between networks based on location, radio signal availability, or preconfigured policies that prioritize private networks when within range. For devices with physical SIM cards, an embedded applet enables switching between operator profiles, while ESIM profiles deploy applets for selecting among multiple identities within a profile. All cellular traffic, whether on public or private networks, is routed through a cloud-based system for centralized security and policy enforcement. Network selection may be influenced by defining the private network as the Home Public Land Mobile Network (HPLMN) or scanning available networks via applet capabilities. The system supports unified subscription, connectivity, and service management via a cloud-based portal, ensuring reliability and security across diverse network environments. This approach enhances mobility, security, and flexibility for enterprise and IoT applications.

Systems and methods for endpoint application metadata based policy enforcement include monitoring traffic via a cloud, the traffic being monitored inline between one or more endpoints and one or more destinations; identifying, within a request from an endpoint, endpoint process metadata associated with an endpoint process used to make the request; processing the endpoint process metadata; and performing one or more actions on the request based on the processing. The endpoint process metadata can be collected by a connector application executing on the one or more endpoints, and forwarded to the cloud in-band therefrom.

A device may include a processor configured to detect a Protocol Data Unit (PDU) session associated with a user equipment (UE) device. The processor may be further configured to obtain at least one congestion metric value for a base station associated with the PDU session; determine that the obtained at least one congestion metric value is less than a maximum throughput enforcement threshold; and override a maximum throughput enforcement policy on a User Plane Function (UPF) associated with the UE device, based on determining that the obtained at least one congestion metric value is less than the maximum throughput enforcement threshold.

Enforcement of a communication policy at a communication intermediary configured to communicate between a first communicating entity and a second communicating entity is provided. The communication intermediary includes packet routers. The enforcement includes identifying, by the packet routers of the communication intermediary, a secure plaintext label in each network packet of labeled network traffic received at the packet routers, evaluating whether the labeled network traffic satisfies an enforcement condition of the communication policy based on the secure plaintext label, instructing a network controller to operate on the labeled network traffic according to the communication policy, based on the operation of evaluating. Each network packet includes encrypted content configured to be inaccessible by the packet routers. The secure plaintext label is accessible by the packet routers and includes a data encoding of a portion of the encrypted content.

The technology is generally directed to determining whether candidate digital components violate a policy and using the determination to propagate policy labels. Candidate digital components may be filtered such that only a subset of the candidate digital components is provided to a machine learning model for further policy review. The machine learning model may provide a confidence score associated with the policy violation prediction. The policy violation prediction may be “violates policy” or “does not violate policy.” A label corresponding to the policy violation prediction may be associated with the digital component. The confidence score may be used when determining whether to use the policy violation prediction to propagate labels to other digital components. The labels may be propagated using a seed based enforcement system or a neighborhood based propagation system.

A method for monitoring and enforcing security policies in a device, the device comprising a data store installed with an operating system, the operating system having a user space and a kernel space, the method comprising the steps of: providing at least one packet filter module; providing a data bus; providing a security policy; providing at least one strategy implementation module; collecting kernel data from a kernel space, and processing and converting the collected kernel data into corresponding one or more events through a packet filtering module; sending the event to a data bus, storing the event in the data bus, and sending the event to a policy enforcement module; monitoring the device by evaluating the event using an evaluation algorithm and identifying a threat event; if the threat event is identified, identifying, by a policy enforcement module, one or more security policies; and implementing the identified security policy through a policy implementation module.

A system and computer-implemented method for routing an encrypted packet through a cloud enforcement network based on a metadata tag. The cloud enforcement network applies policy and routing attributions or tags outside of the encrypted packet payload in such a way as to not require an inner packet to first be decrypted. Traffic prioritization, data protection, and per application policies are achieved by using such metadata tags for internode routing without the need for DPI or decryption. Furthermore, the metadata itself can also be signed or encrypted depending on the provenance of the data. As such, applying meta-tagging external to an encrypted packet, the payload would not be needed to be decrypted during transit of the packet to express end-to-end policy and routing decisions.