Hewlett-packard Development Company, L.p.

Hewlett Packard Enterprise Development LP

Adrian John Baldwin

Daniel Cameron Ellam

Jonathan Griffin

Patrick Goldsack

David Plaquin

Brian Quentin Monahan

Remy Husson

Valiuddin Y Ali

Jeffrey Kevin Jeansonne

Nigel John Edwards

Joshua Serratelli Schiffman

Richard A Bramley, Jr

Antonio Lain

James Robert Waldron

Helen Balinsky

Keith Alexander Harrison

Scott A White

Chris I Dalton

Nelson Liang An Chang

Maugan Villatel

Patrick L Gibbons

Dallas M Barlow

Mike Provencher

Nassir Mohammad

Christopher Ian Dalton

Simon Kai-Ying Shiu

Robert B Taylor

Tevin Richards

Abdel Boulmakoul

Cheh Goh

Chris Tofts

Ronny Chevalier

Robert Stephen Craig

Philipp Reinecke

Gaetan Wattiau

Guillaume Hiet

Pierre Belgarric

Simon Shiu

James Salter

Casassa Mont Marco

Richard Alden Bramley Jr

In an example, an apparatus is described. The apparatus comprises processing circuitry comprising a control module. The control module determines whether a computing device communicatively coupled to the control module is in a specified state for executing a machine learning model controlled by a third party entity. In response to determining that the computing device is in the specified state, the control module is to send, to an attestation module in a data processing pipeline associated with the computing device, an indication that the computing device is in the specified state.

Controlling execution of machine learning models

An apparatus and method is described comprising: classifying service ticket data relating to a service request into a service topic, wherein the service ticket data is obtained from the service request relating to a device; determining, for the service request, an extent to which the service topic matches a telemetry data class, wherein the telemetry data class relates to activities at the device; and providing an output according to said determination.

Telemetry data

An example computing device includes a user interface, a network interface, a non-volatile memory, a processor coupled to the user interface, the network interface, and the non-volatile memory, and a set of instructions stored in the non-volatile memory. The set of instructions, when executed by the processor, is to perform a hardware initialization of the computing device according to a setting, establish a local trust domain and a remote trust domain, use a local-access public key to issue a challenge via the user interface to grant local access to the setting, and use a remote-access public key to grant remote access via the network interface to remote access to the setting.

Access to firmware settings with asymmetric cryptography

An example computing device includes a memory accessible at startup of the computing device, a buffer, and a set of instructions. The memory stores a configuration setting that is configurable by the application of a change request. The memory also stores a first public key and a second public key. The buffer stores change requests submitted by a remote entity, including a first change request to make a first setting change and a second change request to make a second setting change. The first change request is signed by a first private key corresponding to the first public key, and the second change request is signed by a second private key corresponding to the second public key. The set of instructions retrieves a change request from the buffer, determines whether the change request is authenticated by a public key, and if authenticated, applies the change request.

Signed change requests to remotely configure settings

Examples associated with ransomware attack monitoring are described herein. One example includes a monitor module to monitor files stored on the system for sequences of file accesses that match a predefined pattern of file accesses. An investigation module is activated based on a sequence of file accesses that match the predefined pattern. The investigation module logs actions taken by processes to modify files. A reaction module pauses a set of processes operating on the system based on the logging performed by the investigation module, and resumes legitimate processes.

Ransomware attack monitoring

There is disclosed a method, computer program product and a system for regulating execution of a suspicious process, comprising determining a file system location of an executable file associated with the suspicious process, encrypting the file, and creating a wrapper for the file with the same file name and location as the file associated with the suspicious process.

Regulating execution

A method of validating software including maintaining, in a trusted computing system, a copy of at least portions of data of the software, the software comprising data in an untrusted computing system. The method includes, with the trusted computing system, specifying selected data from data included in the copy as hash data, generating an executable file for generating a hash based on the specified hash data, executing the executable file to generate a check hash using the specified selected data from the copy as the hash data, and determining whether the software is valid based, at least in part, on a comparison of the check hash to an access hash generated by execution of the executable file by the untrusted computing system using the specified selected data from the untrusted computing system as the hash data.

Software validation for untrusted computing systems

A device platform, in some examples, comprises a security processor that may create a private/public cryptographic key pair, and data representing evidence of creation of the key pair, provide access to the key pair and data from an operating system component of the device platform, where the public key part of the key pair may be used to verify management commands. The device platform may validate the key pair and data in a trusted execution state.

Hardware security

In an example, a method includes analysing data collected from a service. A value representative of the number of anomalies in the data is generated, this value then being compared with a threshold. Depending on whether the value is greater or less than the threshold, a performance parameter of the monitoring service may be evaluated.

Evaluation of a performance parameter of a monitoring service

Examples associated with digital composition hashing are described. One example method includes receiving a digital composition file from a user. The digital composition file may include a top-level design and a hierarchy of sub-level designs. A hashed structure may be generated from the digital composition file, where a node in the hashed structure for the first sub-level design is generated based on hashes of sub-level designs below the first sub-level design in the hierarchy. The hashed structure and a hash of the digital composition file are stored in association with the user.

Digital composition hashing

A controller for a fulfilment service operation is described in which the controller, before initiating fulfilment of the job, operates to determine if an authorised user is present at a fulfilment service device and to determine if the user intends to remain attendant at the fulfilment service device for the duration of fulfilment of the job. If the user moves away from the fulfilment service device, the controller operates to pause the job. If the user remains away from the fulfilment service device for a period of time, the controller operates to cancel the job.

Controller for a fulfilment service operation

Examples associated with process verification are described. One example includes a process operating in a general operating environment of the system. From an isolated environment, a protection module modifies the behavior of the process by modifying data associated with the process while the process is in operation. The protection module verifies whether the behavior of the process has changed in accordance with the modification. The protection module takes a remedial action upon determining the process has been compromised.

Process verification

In an example, there is provided a method for attesting to a management state of a device platform configuration, based on a signed data structure that represents a device management status and a time-based value from a secure cryptoprocessor of the device. The signed data structure is sent to a management system for validation based on a comparison to the state of the cryptoprocessor at the time of signing the data structure.

Platform configurations

Examples disclosed herein relate to determining whether to allow access to an IP address based on a security level and domain name access information. In one implementation, a processor intercepts a response to a Domain Name System request related to a domain name and updates a security level based on the request and/or response. The processor may determine whether to forward or block the response based on the security level and a comparison of the domain name to stored information related to previous domain name access.

IP address access based on security level and access history

In an example, a machine-readable medium includes instructions that, when executed by a processor, cause the processor to order, as part of an execution of a trusted process, a plurality of processes into a sequence comprising a first process, at least one intermediate process, and a last process. The machine-readable medium may further comprise instruction to cause the processor to generate, as part of an execution of the first process, a value based on a code portion of the process following the first process in the sequence, and to generate, as part of an execution of each intermediate process, a respective value based on the value generated by the process preceding the intermediate process in the sequence and based on a code portion associated with the process following the intermediate process in the sequence.

Growing community of inventors

Bristol, United Kingdom

Adrian John Baldwin