Hewlett Packard Enterprise Development LP

Hewlett-packard Development Company, L.p.

Chris I Dalton

Boris Balacheff

Valiuddin Y Ali

James M Mann

Jose Paulo Xavier Pires

Dejan S Milojicic

Nigel John Edwards

Liqun Chen

Paolo Faraboschi

Ludovic Emmanuel Paul Noel Jacquin

David Plaquin

Fraser John Dickin

Adrian Shaw

Maugan Villatel

Simon Kai-Ying Shiu

Jeffrey Kevin Jeansonne

Mark David Lillibridge

Helen Balinsky

Keith Alexander Harrison

Lan Wang

Zhikui Wang

Adrian John Baldwin

Siani Lynne Pearson

Joshua Serratelli Schiffman

Jonathan Griffin

Geoffrey Ndu

Patrick Goldsack

Michael John Wray

Aled Justin Edwards

Chandrasekar Venkatraman

Andrew Patrick Norman

Martin Sadler

Carey Huscroft

John Melvin Brawn

Richard Brown

Venkataraman Kamalaksha

Kirk M Bresniker

Kishore Kumar M

Anna Fischer

Keith Mathew McAuliffe

Carl Gebhardt

Michela D'Errico

Leon Frank Ehrenhart

Dennis Heinze

Simon Kai Ying Shiu

Mark Lillibridge

Examples relate to verifying network elements. In one example, a computing device may: receive, from a client device, a request for attestation of a back-end network, the request including back-end configuration requirements; obtain, from a network controller that controls the back-end network, a controller configuration that specifies each network element included in the back-end network; provide each network element included in the back-end network with a request for attestation of a network element configuration of the network element; receive, from each network element, response data that specifies the network element configuration of the network element; verify that the response data received from each network element meets the back-end configuration requirements included in the request for attestation of the back-end network; and provide the client device with data verifying that the back-end network meets the back-end configuration requirements.

Verifying network elements

Examples include configuration of a memory controller for copy-on-write with a resource controller. Some examples include, in response to a determination to take a snapshot of memory accessible to a first component, a resource controller configuring a memory controller to treat location IDs, mapped to initial memory locations of the accessible memory, as copy-on-write for the first component and not for a second component independent of the resource controller after the configuring.

Configuration of a memory controller for copy-on-write with a resource controller

A method for regulating modification of a distributed digital ledger at a node comprises controlling access to a cryptographic key used to enable modification of the distributed digital ledger according to a policy maintained by at least one owner of the distributed digital ledger.

Regulating modification

Examples herein disclose monitoring an expected functionality upon execution of a system management mode (SMM) code. The examples detect whether a change has occurred to the SMM code based on the monitoring of the expected functionality. The change indicates that the SMM code is compromised.

Detecting a change to system management mode bios code

Techniques for a firewall to determine access to a portion of memory are provided. In one aspect, an access request to access a portion of memory within a pool of shared memory may be received at a firewall. The firewall may determine whether the access request to access the portion of memory is allowed. The access request may be allowed to proceed based on the determination. The operation of the firewall may not utilize address translation.

Firewall to determine access to a portion of memory

A method for secure hardware initialization during a start-up process comprises activating a protected portion of a physical memory, allocating a part of the protected portion of the physical memory for use by direct memory access, DMA, drivers and non-DMA related hardware initialization instructions, and using a memory management tool, allocating a first part of the physical memory, accessible by a device via the memory management tool, for use by data.

Secure hardware initialization

Example embodiments relate to executing services in containers. The examples disclosed herein include a computing device comprising instructions to load an inner portion of an operating system kernel in an inner region of a kernel space and an outer portion of the operating system kernel in an outer region of the kernel space. The example computing device may execute a service in a container in a user space. The container may be communicatively coupled with the outer region of the operating system kernel but divided from the inner portion of the operating system kernel.

Executing services in containers

Example implementations relate to a capability enforcement processor. In an example, a capability enforcement processor may be interposed between a memory that stores data accessible via capabilities and a system processor that executes processes. The capability enforcement processor intercepts a memory request from the system processor and enforces the memory request based on capability enforcement processor capabilities maintained in per-process capability spaces of the capability enforcement processor.

Capability enforcement processors

In an example, memory address encryption is facilitated for transactions between electronic circuits in a memory fabric. An electronic circuit may obtain a transaction integrity key and a transaction encryption key. The electronic circuit may encrypt an address using the transaction encryption key and a compute a truncated message authentication code (MAC) using the transaction integrity key.

Encryption for transactions in a memory fabric

In an example, transactions are secured between electronic circuits in a memory fabric. An electronic circuit may receive a transaction integrity key. The electronic circuit may compute a truncated message authentication code (MAC) using the received transaction integrity key and attach the truncated MAC to a security message header (SMH) of the transaction.

Secure transactions in a memory fabric

Examples set out herein provide a method comprising using first cryptographic key data specific to a computing device to verify a package of machine readable instructions to run on the computing device. The verified package may be executed to generate a random number using a true random number generator of the computing device, and to store the generated random number. Second cryptographic key data may be generated by a pseudorandom number generator of the computing device based on a seed comprising a combination of the random number as a first seed portion and a second seed portion. A portion of the second cryptographic key data may be sent to a certifying authority. The method may further comprising receiving a certification value based on the sent portion of the second cryptographic key data from the certifying authority and storing the certification value.

Cryptographic data

There is provided an example memory system comprising a plurality of memory modules, each memory module comprising a persistent memory to store root key information and encrypted primary data; a volatile memory to store a working key for encrypting data, the encrypted primary data stored in the persistent memory being encrypted using the working key; and a control unit to provide load and store access to the primary data. The memory system further comprises a working key recovery mechanism to retrieve first root key information from a first module and second root key information from a second module; and compute the working key for a given module based on the retrieved first root key information and the retrieved second root key information.

Secure memory systems

Examples relate to system call policies for containers. In an example, a method includes receiving, by a container platform, a container for running an application. The container has a metadata record that specifies an application type of the application. The container platform receives a data structure that specifies a set of system call policies for a set of application types and queries the data structure to determine a policy of the set of system call policies to apply to the container based on the application type in the metadata record. A kernel implements the policy for the container to allow or deny permission for a system call by the application running in the container based on a comparison of the system call to the policy.

System call policies for containers

Memory blocks are associated with each memory level of a hierarchy of memory levels. Each memory block has a matching key capability (MaKC). The MaKC of a memory block governs access to the memory block, in accordance with permissions specified by the MaKC. The MaKC of a memory block can uniquely identify the memory block across the hierarchy of memory levels, and can be globally unique across the memory blocks. An MaKC of a memory block includes a block protection key (BPK) stored with the memory block, and an execution protection key (EPK). If a provided EPK for a memory block matches the memory block's BPK upon comparison, access to the memory block is allowed according to the permissions specified by the MaKC.

Memory matching key capability

A bus between a requester and a target component includes a portion dedicated to carry information indicating a privilege level, from among a plurality of privilege levels, of machine-readable instructions executed on the requester.

Indicating a privilege level

Growing community of inventors

Bristol, United Kingdom

Chris I Dalton