Hewlett-packard Development Company, L.p.

Hewlett Packard Enterprise Development LP

Bryan Stephenson

Jun Li

John J Mendonca

Ersin Uzun

Amit Raikar

Gregg Bernard Lesartre

Gary Belgrave Gostin

Mark Edward Shaw

Sharad Singhal

Ram Swaminathan

Craig William Warner

Guy Lowell Kuntz

Paul Bouchier

Richard Dickert Powers

Todd J Kjos

Rheid Schloss

Brian Matthew Johnson

Vipul Gandhi

Brendan A Voge

Ryan Lee Weaver

Caio Northfleet

Jon R Sawyer

Glen Edwards

Samuel L Scarpello, Jr

Jennifer Jie Fu

Andrea Eakin

Julio Cesar Damasceno

Leon Hong

Julie Kosakowski

Paulo Romero Martins Maciel

Ron MacDonald

Bruno Leonardo Barros Silva

Andre Ricardo Da Silva Souza

Robert Graham Clark

Hamid Reza Motahari-Nezhad

Hamid Reza Motahari Nezhand

Timothy John Kelsey

Nelson Souto Rosa

Fernando Antonio Aires Lins

Douglas Chivers

Robson Wagner Albuquerque De Medeiros

Examples described herein include receiving a key request from a requestor, determining a validity of the key request, and sending the key to the requestor based on the determination of the validity of the key request. In some examples, the key request is for a key to an encrypted disk partition of a protected computing device and comprises a unique identifier associated with the encrypted disk partition.

Keys for encrypted disk partitions

A method for secure distribution of data in an interchange network, comprises having a network in which data records stored on at least one computer; and including an authorization service, where the authorization service grants a contractor access to at least a portion of the data records; and a watermarking module that adds one or more artificial records to said portion. The artificial records cannot be distinguished from the data records by the contractor and are valid for processing in the same way as the data records.

Methods for secure data distribution

A functional model of a business process which is annotated with security requirements is provided. Platform-specific executable code and at least one configuration file for a given security enforcement component to enforce the security requirements of the model are then generated automatically.

Enforcement of security requirements for a business model

Data assurance capabilities are received that are related to at least one individual persistent object type in a plurality of persistent object types linked to persistent objects stored on the service provider server. In addition, data assurance specifications are received from a customer, the data assurance specifications being based on the data assurance capabilities. Computer-readable data assurance policies for the at least one persistent object type are generated based on the received data assurance specification. The computer-readable data assurance policies then are combined with a corresponding template of data assurance capabilities for the at least one individual persistent object type to generate an enforceable customer-specific data policy.

Data assurance

An encryption key may be fragmented into n encryption key fragments such that k&#x3c;n fragments are sufficient for reconstructing the encryption key. The encryption key fragments may be distributed across data stores located within first and second geographic regions. For example, at least k of the encryption key fragments may be distributed across data stores realized at N different availability zones within the first geographic region such that less than k of the encryption key fragments are distributed to each of the N availability zones within the first geographic region. Similarly, at least k of the encryption key fragments may be distributed across data stores realized at M different availability zones within the second geographic region such that less than k of the encryption key fragments are distributed to each of the M availability zones within the second geographic region.

Encryption key fragment distribution

Disclosed is a system for protecting security of a provisionable network, comprising: a network server, a network client communicatively coupled with the server, a pool of resources coupled with the server for employment by the client, a resource management system for managing the resources, and an intrusion detection system enabled to detect and respond to an intrusion in said network.

System for protecting security of a provisionable network

A method comprises receiving, by a processor, a copy of a database containing records, each record having a plurality of attributes. The method also comprises determining, by the processor, whether a first attribute in each record results in a predetermined value in modulo P when hashed with a key and determining, by the processor, whether a second attribute in each record results in the predetermined value in modulo P when hashed with a key. For a first record whose first attribute results in the predetermined value in modulo P when hashed with a key and a second record whose second attribute also results in the predetermined value in modulo P when hashed with a key, the method further comprises swapping by the processor the second attributes between the first and second records.

Permuting records in a database for leak detection and tracing

A method comprising fingerprinting, by the at least one processor, a first copy of a database with a fingerprint. The fingerprint has at least one part in common with another fingerprint used in another copy of the database, and at least one part unique to the first copy of the database. The fingerprinting comprises swapping attributes between multiple records in the first copy of the database.

Fingerprinting a database

A method comprises receiving a database containing records. The method further comprises determining a number of artificial records to add to the database to achieve a false negative mark detection rate less than a specified threshold. The method also comprises marking the database by adding the determined number of artificial records to the database. Each artificial record contains at least one value that, when used, is detectable by a third party. The false negative rate comprises a probability of failing to detect the mark in a discovered subset of the database.

Artificial record added to a database

A present invention integrated intrusion detection method integrates intrusion detection information. In one embodiment, intrusion detection information is gathered from a plurality of different types of intrusion detection sensors. The information is processed in a manner that provides a consolidated correlation of the information. A response is assigned to the information and the response is implemented.

Integrated intrusion detection system and method

A method for providing security for a network intrusion detection system in a provisionable network, the method comprises evaluating the system security of the provisionable network and applying a system lockdown in the provisionable network in accordance with the results of the evaluation.

Method for protecting security of network intrusion detection sensors

A method of managing modification of configuration states of a plurality of resources of multiple types in a dynamic data center is disclosed. A modification policy is created for the resources. Moreover, a new modification for a configuration state of resources of a particular type is obtained. The new modification is automatically performed to the configuration state of the resources of the particular type based on the modification policy. A resource pool is utilized so that performance of the new modification to the configuration state is achieved without degrading a level of service provided by the resources of the particular type. Further, the resource pool includes a plurality of available resources of multiple types.

Method of managing modification of configuration states of resources in a dynamic data center

One embodiment disclosed relates to a method for provisioning subnets. The subnets are grouped into subnet groups based on logical properties of the subnets. Each network consumer is assigned those subnet groups that are accessible to that network consumer. The network consumer is then provided with an interface for constrained selection of a particular subnet.

System and method for subnet configuration and selection

A partitionable computer system and method of operating the same is disclosed. The partitionable computer system has a state machine, a processor, and a device controller. The state machine can be configured to monitor the status of a partition of the partitionable computer system. The information provided by the state machine can be used to provide security within the partitionable computing system.

Security measures in a partitionable computing system

Growing community of inventors

Alviso, CA, United States of America

Bryan Stephenson