Hewlett-packard Development Company, L.p.

Other

Joshua Serratelli Schiffman

Boris Balacheff

Gurchetan Grewal

Thalia Laing

Luke T Mather

Valiuddin Y Ali

Jeffrey Kevin Jeansonne

Richard A Bramley, Jr

Nassir Mohammad

Adrian John Baldwin

David Plaquin

Christopher Charles Mohrman

Shivaun Albright

Rosilet Retnamoni Braduke

Sandro Secci

Helen Balinsky

James M Mann

Chris I Dalton

Chris Richard Gunning

Jonathan Griffin

Vali Ali

Richard Bramley

Daniel Cameron Ellam

Endrigo Pinheiro

Pierre Belgarric

Rudolf Wegener

Gaetan Wattiau

Carey Huscroft

Mamadou Diambar Ndour

Patrick Jacques Andre Marie De Marcillac

Patrick Jacques Andre Marie Daney De Marcillac

Jack Yeh

Patrick Daney De Marcillac

Richard Alden Bramley Jr

Systems and methods are provided for a computing device with a basic input/output system (BIOS) comprising BIOS settings that are to be changed by BIOS actions. An application may request a BIOS action to change a BIOS setting. Using a received key from the BIOS, a processor of the computing device may implement a kernel driver to sign the request from the application in response to determining that the application is authorized to request the BIOS action. Further, the BIOS may perform the BIOS action without requiring an administrative password upon receiving the signed action request from the kernel driver.

BIOS action request for authorized application

According to aspect of the disclosure, there are provided methods and apparatus for connecting a peripheral device to a computer system, including an apparatus for interfacing with a peripheral device, the apparatus comprising a port configured to couple to the peripheral device, a processor, a memory coupled to the processor and comprising a software module comprising instructions that when executed on the processor protect the device from a peripheral device coupled to the port, and a hardware security controller coupled to the port, the hardware security controller configured to monitor execution of the software module by the processor and to disable the port in response to determining that the software module is not executing.

Protected peripheral ports

The disclosure provides a method for verifying authenticity of a component in a product. The method may comprise collecting data relating to a characteristic of the component. The method may further comprise comparing the data to a profile for the component. The profile may comprise an expected characteristic for the component. The method may further comprise determining whether the collected data matches the expected characteristic. The disclosure further provides an apparatus and program.

Authenticity verification

An example computing device includes a user interface, a network interface, a non-volatile memory, a processor coupled to the user interface, the network interface, and the non-volatile memory, and a set of instructions stored in the non-volatile memory. The set of instructions, when executed by the processor, is to perform a hardware initialization of the computing device according to a setting, establish a local trust domain and a remote trust domain, use a local-access public key to issue a challenge via the user interface to grant local access to the setting, and use a remote-access public key to grant remote access via the network interface to remote access to the setting.

Access to firmware settings with asymmetric cryptography

According to aspect of the present disclosure there are provided methods and apparatus for printing to a group of printers in a network, including a method comprising provisioning each printing device of the plurality of printing devices with a respective private cryptographic key, defining a first group of printing devices comprising a first subset of the plurality of printing devices, generating a first group public key for the defined first group of printing devices, the first group public key generated based on public cryptographic keys corresponding to the respective private cryptographic keys provisioned to the first subset of the plurality of printing devices, and providing the first group public key to a user.

Group printing

Secure code image delivery may include encrypting, using an invariant content encryption key, an invariant portion of a code image for a set of electronic devices to generate an encrypted invariant potion of the code image. A first variant of a variant portion of the code image may be encrypted using a first variant content encryption key to generate a first encrypted variant portion. A second variant of a variant portion of the code image may be encrypted using a second variant content encryption key to generate a second encrypted variant portion. A code image bundle may be generated including the encrypted invariant portion, the first encrypted variant portion, and the second encrypted variant portion.

Secure code image distribution

A method for determining a connection status of a device to a cable within a network environment is provided. The method comprises obtaining a signal from a non-data carrying wire of the cable by a detector that is digitally isolated from data transmitted in a data carrying wire of the cable within the network environment, modifying the signal transmitted by the non-data carrying wire to the device and evaluating the modified signal to determine a connection status of the device to the cable.

Status of device connections

In an example, a method of encryption is described to include generation of a content encryption key and a key encryption key. In that example, the content encryption key is wrapped based on a key wrap operation using the key encryption key and the wrapped content encryption key is encrypted using a policy encryption key. Further in that example, the policy encryption key is encrypted using a public key corresponding to a print apparatus. In an example, a method of decryption is described. The example method of decryption performs recovery of a policy object using a private key corresponding to a print apparatus. In that example, the policy object includes a wrapped key that is unwrapped using a key encryption key to recover a content encryption key usable to decrypt an encrypted electronic document.

Key encryption key wrapping

In some examples, a method for generating a low data rate signal for transmission from a first network domain to a second network domain, the second network domain logically separated from the first network domain by a firewall, can include encoding a signal from a first device logically positioned within the first network domain to form a data signal, and transmitting the data signal over an out-of-band communications channel from the first network domain to the second network domain.

Low data rate signalling

An example system with a pre-OS (Operating System) environment, the pre-OS environment includes a private memory that is isolated from a processor of the system. The pre-OS environment also includes an embedded controller (EC) coupled to the private memory, where the EC includes an embedded key. The EC is to execute instructions to generate an encryption key based on the embedded key; generate a signature key; obtain data; produce an integrity-verification tag based on a hash of the obtained data, where the hash employs the signature key; encrypt the obtained data based on the encryption key; store the encrypted data in the private memory; and store the integrity-verification tag in the private memory in association with the stored encrypted data.

Data protection in a pre-operation system environment based on an embedded key of an embedded controller

A method for providing a set of certificates encoding authorisations, the method comprising processing respective ones of multiple authorisation requests at a trusted signing authority apparatus to verify respective digital signatures applied to the requests, the multiple authorisation requests received over a first communication link between the trusted signing authority apparatus and an administration apparatus, validating one or more authorisation request parameters of respective ones of the authorisation requests, generating a certificate encoding an authorisation at the trusted signing authority apparatus and transmitting the generated certificate to the administration apparatus or a requesting apparatus over a second communication link.

Authentication of entitlement certificates

A method for regulating modification of a distributed digital ledger at a node comprises controlling access to a cryptographic key used to enable modification of the distributed digital ledger according to a policy maintained by at least one owner of the distributed digital ledger.

Regulating modification

An apparatus includes a solid-state a solid-state non-volatile computer memory; and a controller coupled to the memory. The controller to: generate a data set including a tag that indicates that the data set is valid; write the data set into a block of the memory, wherein the block includes multiple addressable locations set to a common first binary value before the write; generate a subsequent data set including a tag that indicates that the subsequent data set is valid; update the tag of the written data set to indicate that the written data set is invalid, wherein the update includes setting an addressable location corresponding to the tag to second binary value different from the first binary value; write the subsequent data set to addressable locations in the block of memory other than the addressable locations of the invalid data set.

Validity of data sets stored in memory

A controller for a fulfilment service operation is described in which the controller, before initiating fulfilment of the job, operates to determine if an authorised user is present at a fulfilment service device and to determine if the user intends to remain attendant at the fulfilment service device for the duration of fulfilment of the job. If the user moves away from the fulfilment service device, the controller operates to pause the job. If the user remains away from the fulfilment service device for a period of time, the controller operates to cancel the job.

Controller for a fulfilment service operation

A network printing system comprising a user device to encrypt a print job using a public key of a user and to transmit the encrypted print job to a print server. The system may further comprise the print server to re-encrypt the encrypted print job using the re-encryption key. The system may further comprise the printer to decrypt the re-encrypted print job using a private key of the printer and print the decrypted print job.

Growing community of inventors

Bristol, United Kingdom

Joshua Serratelli Schiffman