Hewlett-packard Company

Cheyenne Property Trust

Sap Ag

Sap Se

Firetide, Inc.

Hewlett-packard Development Company, L.p.

Cheyenne Property Trust C/o Data Securities International, Inc.

Keith S Klemba

Helmut Fieres

Matthias Kaiser

Shuyuan Chen

Roger Merkling

Roger Merckling

Frankie James

Isaac Robert Nassi

Lawrence Alan Rosenthal

David Neil Cornejo

Anne H Anderson

Frances James

Thomas Michael Lee

Jan Loefstrand

Thomas A Palmer

Wesley Mukai

Christopher J Crall

Gregory P Carpenter

Syed Wasif Ur Rehman Gilani

Joseph N Pato

Scott Feamster

Gilles Leyrat

Implementations are directed to providing a data custodian region within a public cloud, the data custodian region being specific to a customer of an enterprise having services hosted on the public cloud, the public cloud including regional data centers, through which customer data passes and/or is stored, each data center being at a location within a region, storing at least one union definition that is used to control access, transfer, and storage of customer data within respective regional data centers, the at least one union definition being provided by a data custodian associated with the customer, monitoring a plurality of actions of respective workflows executed using the one or more computer-implemented services hosted on the public cloud, for each action, logging a data event within a repository of the data custodian region, and determining whether the data event complies with the at least one union definition.

Data custodian model and platform for public clouds

A cloud frame provides a framework comprising a monitoring and network services to support hardware nodes such as computing nodes and storage nodes. Cloud frames may be organized into a cluster of cloud frames. Hardware nodes in a cloud frame environment may conduct self-allocation of needed resources, which in turn may be provided by other hardware nodes in the cloud frame environment.

Method and system for a cloud frame architecture

Embodiments of the present invention improve information exchange, and in particular, the exchange of data objects between different software systems. In one embodiment, the present invention includes a method of exchanging information comprising analyzing the attributes of the objects. Objects may be stored in a repository and retrieved using attributes. In some applications, objects are received and sent to participants without accessing any information in the objects themselves. Different applications include object warehousing operable across different communication mediums that support different names or name spaces, classes, aliases, groups, geospatial information, or tokens, or combinations thereof.

Systems and methods for information exchange using object warehousing

Embodiments of the present invention improve interactive audio task execution in mobile systems such as vehicles, for example. In one embodiment, task interrupt handling is provided to allow user's to resume task execution at or near the point in the task where the interrupt occurred. In one embodiment, a user's confidence that secondary tasks are being performed accurately is improved by providing confirmation and help for users to be more accurate on their secondary tasks. Accordingly, users can increase their confidence and trust in the system and focus more attention on primary tasks, such as driving a vehicle. Some embodiments of the invention further provide for more comprehensive confirmation following an interruption.

Interactive audio task system with interrupt recovery and confirmations

Embodiments of the present invention provide improved event handling between systems. In one embodiment, the present invention includes software event handling method comprising receiving a first event from a first source system in a plurality of source systems, the first event including event information, accessing context information corresponding to the first event, generating a second event based on at least a portion of the event information and context information using one or more rules, assigning a priority to the second event, and sending the second event to a first target system in a plurality of target systems.

Context based event handling and execution with prioritization and interrupt management

System, apparatus, and methods are disclosed wherewith a group of independent wireless routing devices known as Service Points work cooperatively to form an ad hoc mesh communication network. The resulting Service Point Network is used to provide reliable address-directed communication services between devices attached by conventional means (wired or wireless) to respective Service Ports on any of the Service Points. Attached Utilizing Devices are not considered a part of the Service Point Network and need not contain any custom software or hardware related to the operations of the Service Point Network. To protect the security of network communications and the integrity of the network, the Service Points are assigned internal IP addresses and unique identifiers that need not be disclosed to the Utilizing Devices. The unique identifiers in turn are used to derive public and private encryption key pairs for each Service Point.

Wireless service points having unique identifiers for secure communication

Embodiments of the present invention improve information exchange, and in particular, the exchange of data objects between different software systems. In one embodiment, the present invention includes a method of exchanging information comprising receiving a first transport request, the transport request comprising one or more first transport attributes, wherein the one or more first transport attributes are associated with a first data object, storing the one or more first transport attributes and the first data object or a reference to the first data object in a repository, receiving a second transport request, the second transport request comprising one or more second transport attributes, and executing an algorithm for generating a response to the second transport request based on the first or second transport attributes.

System, apparatus, and methods are disclosed wherewith a group of independent wireless routing devices known as Service Points work cooperatively to form an ad hoc mesh communication network. The resulting Service Point Network is used to provide reliable address-directed communication services between devices attached by conventional means (wired or wireless) to respective Service Ports on any of the Service Points. Attached Utilizing Devices are not considered a part of the Service Point Network and need not contain any custom software or hardware related to the operations of the Service Point Network. Consequently, the networking technology used to form the Service Point Network is independent of the technology used for connecting devices to Service Points. Services for Utilizing Devices include both point-to-point as well as point-to-multi-point communication.

Wireless service point networks

A method and apparatus for uniquely and securely loading software to an individual computer includes requesting download of software components to a hardware platform and delivering a token from a token server responsive to the request. The token server is operated by an entity having rights to grant access to the software components. The token is passed to a system that builds software images. The system is operated by an organization that performs delivery of the software. The software components are assembled and decrypted with the system within an enabled secure process. A software image to be loaded onto the platform is created and bound to the hardware platform by encrypting the software image using an application specific encryption technique.

Method and apparatus for uniquely and securely loading software to an individual computer

An international cryptography framework (ICF) is provided that allows manufacturers to comply with varying national laws governing the distribution of cryptographic capabilities. In particular, such a framework makes it possible to ship worldwide cryptographic capabilities in all types of information processing devices (e.g. printers, palm-tops). The ICF comprises a set of service elements which allow applications to exercise cryptographic functions under the control of a policy. The four core elements of the ICF architecture, i.e. the host system, cryptographic unit, policy activation token, and network security server, comprise an infrastructure that provides cryptographic services to applications. Applications that request cryptographic services from various service elements within the ICF are identified through a certificate to protect against misuse of a granted level of cryptography. The host system comprises a set of system programs and services which provide the application with an execution environment. The host system's role within the ICF is twofold. First, the host system provides services to the application in the form of programming interfaces to access the functions offered by the cryptographic unit. Second, the host system provides support for the cryptographic unit in building trust relationships to the host system elements, such as the cryptographic programming interfaces, operating systems drivers, and memory management subsystems.

Host system elements for an international cryptography framework

An application which requests cryptographic services from various service elements within an international cryptography framework is identified through a certificate to protect against the misuse of a granted level of cryptography. A cryptographic unit, one of the framework core elements, builds several certification schemes for application objects. One or more methods are provided that establish a degree of binding between an application code image and issued certificates using the framework elements. Within the framework, the application is assured of the integrity of the cryptographic unit from which it is receiving services. One or more mechanisms are provided which allow the application to validate that the cryptographic unit has not been replaced or tampered with.

Application certification for an international cryptography framework

An object oriented tool monitors the step-by-step progress of security administration within an electronic work flow to implement access control measures, and security administration policies that may include additional checks and balances, such as second party review, escalated authorization requirements, and trusted audit facilities. A security administration architecture for distributed electronic data processing systems preferably includes a checkpoint object that provides uniform characterization of milestone or transition states in administration activity, and which may be inherited by or refined to an administration activity object. A checkpoint object manager that is instantiated as a trusted third party object manages the state progression of checkpoint objects. As a result of checkpointing, checkpoint objects are resumed with their state advanced, reversed, or unchanged by the checkpoint object manager as appropriate. The checkpoint object manager also assures that all checkpoints are logged and monitored, and that resumptions are authenticated.

Checkpoint object

A cryptographic framework consists of four basic service elements that include a national flag card, a cryptographic unit, a host system, and a network security server. Three of the four service elements have a fundamentally hierarchical relationship. The National Flag Card (NFC) is installed into the Cryptographic Unit (CU) which, in turn, is installed into a Host System (HS). Cryptographic functions on the Host System cannot be executed without a Cryptographic Unit, which itself requires the presence of a valid National Flag Card before it's services are available. The fourth service element, a Network Security Server (NSS), can provide a range of different security services including verification of the other three service elements. Several different configurations that support policy within a cryptographic system allow the framework to be adapted to various connection schemes involving, at least, the cryptographic unit and the policy, including dedicated applications, e.g. a policy provided in a cryptographic unit having either a built-in or local smart card reader, or a policy in a remote smart card reader; and shared applications, e.g. a policy provided in a host system local smart card reader.

Method and apparatus for enforcing the use of cryptography in an

An international cryptography framework (ICF) allows manufacturers to comply with varying national laws governing the distribution of cryptographic capabilities. The invention is concerned primarily with the application certification aspects of the framework where an application that requests cryptographic services from the ICF service elements is identified through some form of certificate to protect against the misuse of a granted level of cryptography. The levels of cryptography granted are described via security policies and expressed as classes of service. A cryptographic unit, one of the ICF core elements, can be used to build several certification schemes for application objects. The invention provides various methods that determine the strength of binding between an application code image and the issued certificates within the context of the ICF elements. A key element with regard to the exercise of a cryptographic function concerns the special requirements for the trust relation that an authority specifies for the cryptographic unit. Any function exercised by the cryptographic unit must be controllable by the associated class of service which represents the security policy. Touchpointing, both in the application and the firmware elements inside the cryptographic unit, plays a key role in exercising control over the functioning of these modules. Another fundamental requirement of the ICF architecture is that the application is assured of the integrity of the cryptographic unit from which it is receiving services. Thus, the invention also provides methods that allow a determination of whether or not the cryptographic unit has been replaced or tampered with.

Dynamic classes of service for an international cryptography framework

Trusted processing capability, for example for a cryptographic unit element in an International Cryptography Framework, secures one or more tasks or processes associated with application code. Trusted processing is assured by a trusted element, where use of the trusted element is based upon the principles of separation and locality, i.e. where the trusted element is associated with a trusted computing base that is separated from the operating system and/or data by a trust boundary, and where protected mechanisms are used to access the trusted element, such that trusted execution occurs only locally in a trusted execution area. The trust processing capability also encompasses a policy controlled main CPU.

Growing community of inventors

Santa Clara, CA, United States of America

Keith S Klemba