Mcafee, Inc.

Intel Corporation

Securify, Inc.

Musarubra US LLC

Security, Inc.

Geoffrey Cooper

John Richard Guzik

Kieran Gerard Sherlock

Michael W Green

David Frederick Diehl

Luis Filipe Pereira Valente

Robert Ma

Manuel Nedbal

Hemang Satish Nadkarni

Robert Allen Shaw

Luis Valente

Bob Shaw

Jesse R Walker

Karanvir S Grewal

Sven Schrecker

Howard C Herbert

Derek Patton Pearcy

Kirk D Brannock

Xiaoning Li

Vinay Mahadik

Ramnath Venugopalan

Guy L AlLee, Jr

David A deVries

David M Amols

Stephen H Price

Mark Hoy

Ned M Smith

David W Grawrock

Ernie F Brickell

David Wheeler

Guy L AILee, Jr

Harry Alexander Richardson

A method in an embodiment includes detecting a change for a virtual machine in a virtual server of a virtual network infrastructure, determining whether a virtual security appliance is configured in the virtual server, and sending a request to create the virtual security appliance in the virtual server. The method further includes allowing the virtual machine to initiate when the virtual security appliance is created in the virtual machine. The virtual security appliance performs security inspections on network packets sent from the virtual machine. In more specific embodiments, the method further includes creating an intercept mechanism in the virtual server to intercept the network packets from the virtual machine. In further embodiments, one or more security policies identify one or more virtual security appliances to process the network packets from the virtual machine.

Providing a virtual security appliance architecture to a virtual cloud infrastructure

The present disclosure combines Software Defined Networks (SDN) concepts with Security concepts. The coordination between SDN and Security provides a myriad of advantageous use cases. One exemplary use case involves providing a fast path at network speeds using SDN by routing network traffic to bypass a security appliance once the security appliance determines that the security appliance no longer needs to inspect the network traffic. Another exemplary use case involves remote provisioning of security zones.

Providing a fast path between two entities

Technologies for device commissioning include a rendezvous server to receive, from a buyer device, a request to transfer ownership of a compute device to the buyer device. The rendezvous server verifies the provenance of the compute device based on a block chain and establishes a secure session with the compute device in response to verification of the provenance. The block chain identifies each transaction associated with ownership of the compute device.

Technologies for device commissioning

The present disclosure is directed to systems and methods of providing a trusted ownership re-key with attestation in a device. The device includes processor circuitry that incorporates TEE circuitry. The TEE circuitry generates an AAIK and encrypts the AAIK using HMAC. The TEE circuitry forms a first message using the HMAC, a public DAK assigned to the device, and a device signature. The TEE circuitry sends an encrypted first message to the manufacturer. The manufacturer validates the device based on the public DAK and generates a second message that includes the HMAC and a manufacturer signature. The encrypted second message is communicated to the TEE circuitry. Upon receipt the TEE circuitry validates the AAIK data in the second message against the most recent AAIK and generates a third message that includes the HMAC, the original AAIK, the RHK and the manufacturer attestation. The AAIK thus remains unknown to both the current owner and the manufacturer.

Systems and methods of trusted ownership re-key with attestation

An appliance includes a processor, a medium, a registration application, and a monitoring application. The registration application includes instructions in the medium that, when read and executed by the processor, configure the registration application to write a transaction identifier to a start message, the transaction identifier identifying the appliance, write a dataset of interest identifier to the start message, and send the start message to a database. The dataset of interest identifies a group of appliances including the appliance. The monitoring application includes instructions in the medium that, when read and executed by the processor, configure the monitoring application to monitor operations executed on the appliance, write data resulting from the operations to a data message, and send the data message anonymously to the database. The data message is signed with a member key associated with the group of appliances.

Anonymous device operation

A computing device is provisioned to be remotely managed by a current owner. The device has an initial cryptographic basis of trust, and an owner identifier that facilitates establishment of communication with the current owner of the device. The ownership may change one or more times while the device may remain inoperative. Later, the device receives a transfer-of-ownership indication, which it verifies against the initial basis of trust to establish a new current owner. The device may then communicate with a device management service of the new current owner based on the transfer-of-ownership indication.

Device provisioning service

A method is provided in one example embodiment that includes receiving metadata from a host over a metadata channel. The metadata may be correlated with a network flow and a network policy may be applied to the connection. In other embodiments, a network flow may be received from a host without metadata associated with the flow, and a discovery redirect may be sent to the host. Metadata may then be received and correlated with the flow to identify a network policy action to apply to the flow.

System and method for redirected firewall discovery in a network environment

Particular embodiments described herein provide for an electronic device that can be configured to couple to a terminal, verify an account with an account institution using Direct Anonymous Attestation (DAA), and request an action related to the account using DAA. In an example, the DAA is accomplished using enhanced privacy identification (EPID). The account institution can be a banking institution, and the requested action can be to add an electronic representation of monetary funds to the account. In another example, the device is a payment card, the terminal is a point of sale terminal, and the requested action is related to a sale of goods or services.

Payment system

A custody transfer of a device can include sending a start of transfer request to an attestation device over a short range wireless communication channel, a nonce is received from the attestation device in association with the start of transfer request, and the nonce is signed at the particular gateway device. The signed nonce is sent to the attestation device, a transfer confirmation message is received from the attestation device, and a transfer message is sent to a management system to report a transfer in custody of the attestation device involving the particular gateway device and another gateway device.

Attestation device custody transfer protocol

An apparatus is provided that includes at least one processor device, an energy storage module to power the apparatus, memory to store a secret such that powering down and restarting the apparatus causes the secret to be lost, logic executable by the at least one processor device to generate attestation data using the secret that data abstracts the secret, and a communications interface to send the attestation data to another device.

Simplified sensor integrity

Technologies are provided in example embodiments for analyzing an encrypted network flow. The technologies include monitoring the encrypted network flow between a first node and a second node, the network flow initiated from the first node; duplicating the encrypted network flow to form a copy of the encrypted network flow; decrypting the copy of the encrypted network flow using a shared secret, the shared secret associated with the first node and the second node; and scanning the network flow copy for targeted data.

Encrypted data inspection in a network environment

Growing community of inventors

Palo Alto, CA, United States of America

Geoffrey Cooper