Hewlett-packard Development Company, L.P.

Other

Hewlett Packard Enterprise Development LP

Jonathan Griffin

Andrew Patrick Norman

Adrian John Baldwin

Daniel Cameron Ellam

Matthew Murray Williamson

Liqun Chen

John Melvin Brawn

Matthew Williamson

Helen Balinsky

Scott A White

Chris I Dalton

Joshua Serratelli Schiffman

Aled Justin Edwards

Nassir Mohammad

Christopher L Dalton

Christopher Ian Dalton

Richard Brown

Gurchetan Grewal

Robert B Taylor

Yolanta Beresnevichiene

Richard Smith

Luke T Mather

John P Scrimsher

Michael Child

Andy Norman

There is disclosed a method, computer program product and a system for regulating execution of a suspicious process, comprising determining a file system location of an executable file associated with the suspicious process, encrypting the file, and creating a wrapper for the file with the same file name and location as the file associated with the suspicious process.

Regulating execution

In an example, a method includes analysing data collected from a service. A value representative of the number of anomalies in the data is generated, this value then being compared with a threshold. Depending on whether the value is greater or less than the threshold, a performance parameter of the monitoring service may be evaluated.

Evaluation of a performance parameter of a monitoring service

Examples associated with digital composition hashing are described. One example method includes receiving a digital composition file from a user. The digital composition file may include a top-level design and a hierarchy of sub-level designs. A hashed structure may be generated from the digital composition file, where a node in the hashed structure for the first sub-level design is generated based on hashes of sub-level designs below the first sub-level design in the hierarchy. The hashed structure and a hash of the digital composition file are stored in association with the user.

Digital composition hashing

In one example in accordance with the present disclosure, a computing device is described. The computing device includes an encryption device to encrypt, using an encryption key, a document to be rendered. A generating device generates multiple shares of a decryption key using a secret-sharing scheme. A threshold number of the multiple shares allows decryption of the document. A transmit device transmits different shares of the multiple shares to different devices. The document is rendered when the threshold number of multiple shares are rejoined at a rendering device.

Encryption key shares to different devices for rendering

Examples disclosed herein relate to determining whether to allow access to an IP address based on a security level and domain name access information. In one implementation, a processor intercepts a response to a Domain Name System request related to a domain name and updates a security level based on the request and/or response. The processor may determine whether to forward or block the response based on the security level and a comparison of the domain name to stored information related to previous domain name access.

IP address access based on security level and access history

Examples associated with application approval are described. One example includes receiving an application package. The application package contains an application from a service provider and a privacy description for the application from a review provider. The application operates on private data controlled by a user. The application package is validated to ensure components of the application package is properly credentialed. An application summary for the user is generated from the privacy description. The application summary describes what portions of private data will be accessed by the application and how portions of the private data will be transmitted. An authorization is received from the user, and execution of the application is controlled based on the authorization of the user.

Application approval

Examples disclosed herein relate to selecting a security mitigation action based on device usage. In one implementation, a processor selects a security mitigation action for a device based on information related to usage of the device and associated usage limitations associated with the selected security mitigation action. The processor may output information related to the selected security mitigation action.

Security mitigation action selection based on device usage

An apparatus includes a first processing resource to execute a program code, and a second processing resource separate from the first processing resource. The program code includes an embedded execution unit. The execution unit, during execution of the program code, calculates a first security value for a part of the program code. The second processing resource runs a validation program. The validation program receives the first security value, checks the first security value against a second security value calculated from a corresponding part of a reference copy of the program code to obtain a check result, returns the check result to the execution unit. The execution unit performs a security-related action in response to a check result indicating a mismatch between the first security value and the second security value.

Checking a security value calculated for a part of a program code

Example implementations relate to facilitating scanning of protecting computing resources. In example implementations, a computing device receives a scan indicator that indicates an external agent is prepared to scan a protected resource of the computing device; identifies a protected action that may be performed by the data processor, the protected action facilitating scanning the protected resource of the computing device by the external agent, the protected action comprising a change in a state of the protected resource; performs the protected action; and provides the external agent with data indicating a current state of the protected resource.

Facilitating scanning of protected resources

A system for analyzing an environment to identify a security risk in a process, comprising a model engine to generate a model of the environment using multiple components defining adjustable elements of the model and including components representing a patching process for the environment, a risk analyzer to calculate multiple randomized instances of an outcome for the environment using multiple values for parameters of the elements of the model selected from within respective predefined ranges for the parameters, and to use a results plan to provide data for identifying a security risk in the patching process using the multiple instances.

Method and system for analyzing an environment

A method of restricting transmission of data packets from a host entity in a network, including: transmitting outgoing packets to destination hosts whose identities are contained in a record stored in a working set of host identity records; over the course of repeated predetermined time intervals, restricting, to a predetermined number, destination hosts not identified in the working to which packets may be transmitted; upon transmission of a packet to a host whose identity is not contained in a record in the working set, adding a record containing the host's identity to the working set and attributing a time to live to the record; deleting each record from the working set whose time to live has expired.

Propagation of malicious code through an information technology network

One embodiment of an apparatus for monitoring from a first location in a computer network traffic emanating from a source at a second location in the network, the apparatus comprising means at the first location for detecting traffic emanating from the source and means for monitoring the number, per unit time, of distinct destinations of the traffic that lie outside a first set specifying familiar destinations of the traffic. This monitoring process can trigger various responses such as the isolation of the source from the network. Other systems and methods are also provided.

Methods of, and apparatus for, monitoring traffic emanating from a source in a network

A method of operating a computing entity in a network having a log mapping computing entity network addresses to vulnerabilities, the method comprising the steps of: using the entity's network address, searching the log to establish what vulnerabilities the entity has; and if the log indicates the entity has a vulnerability, sending data identifying a user of the entity to an administrator of the network.

Network management

A method of identifying a software vulnerability on a computer system is disclosed in which the computer system has software stored thereon and is connected to a management system over a computer network. The method comprises the steps of: applying an interrogation program to the software, the interrogation program being capable of exploiting a known software vulnerability if it is present in the software to which the interrogation program is applied; in the event that the software vulnerability is exploited by the interrogation program, operating the interrogation program to generate a set of management information from which can be derived the identification of the computer system; and sending the management information to the management system.

Method of identifying software vulnerabilities on a computer system

A computing platformprovides multiple computing environmentseach containing a guest operating systemprovided by a virtual machine applicationOptionally, each computing environmentis formed in a compartmentof a compartmented host operating system. A trusted deviceverifies that the host operating systemand each guest operating systemoperates in a secure and trusted manner by forming integrity metrics which can be interrogated by a user. Each computing environment is isolated and secure, and can be verified as trustworthy independent of any other computing environment.

Growing community of inventors

Bristol, United Kingdom

Jonathan Griffin