Hewlett-packard Development Company, L.P.

Hewlett Packard Enterprise Development LP

Michael John Wray

Nigel John Edwards

Christopher Ian Dalton

Chris I Dalton

Siani Lynne Pearson

Patrick Goldsack

Christopher L Dalton

Niels Thomas Ferguson

Michela D'Errico

Dennis Heinze

Jose Maria Alcaraz Calero

Leon Frank Ehrenhart

Richard B Stock

Examples relate to snapshots of system memory. In an example implementation, structural information of a process in a snapshot of system memory is compared with hashes or fuzzy hashes of executable regions of the same process in a previous snapshot of system memory to determine whether there is a structural anomaly.

Comparing structural information of a snapshot of system memory

Examples relate to system call policies for containers. In an example, a method includes receiving, by a container platform, a container for running an application. The container has a metadata record that specifies an application type of the application. The container platform receives a data structure that specifies a set of system call policies for a set of application types and queries the data structure to determine a policy of the set of system call policies to apply to the container based on the application type in the metadata record. A kernel implements the policy for the container to allow or deny permission for a system call by the application running in the container based on a comparison of the system call to the policy.

System call policies for containers

Example implementations relate to determination as to whether a process is infected with malware. For example, in an implementation, information of a process extracted from a snapshot of system memory is obtained. A determination as to whether the process is infected with malware is made based on a process model.

Determining whether process is infected with malware

The application describes an attestation system () in a cloud computing environment. The authorization system is configured to allow a plurality of users (-) and applications () of the cloud computing environment to issue attestations regarding attributes of other users and applications. The authorization system is also configured to control access to said attestations and to allow a plurality of users and applications of the cloud computing environment to query the authorization system to determine whether a specified user or application has a specified attribute. Methods of controlling access to resources in a cloud computing environment and also of providing secure attestations are also described.

Authorization control

A trusted computing platform includes one or more first logically protected computer environments (or 'compartments') associated with initialization of the system, and one or more second logically protected computing environments (or 'compartments'). The one or each second compartment is associated with at least one service or process supported by the said system. The trusted computing platform is loaded with a predetermined security policy including one or more security rules for controlling the operation of each of the compartments such that the security rules relating to the one or each first compartment is loaded onto the trusted computing platform when the system is initialized. The one or more security rules relating to the one or at least one of the second compartments are only loaded onto the trusted computing platform if one or more services or processes associated therewith are enabled.

Security policy in trusted computing systems

A virtual network has network interfaces coupled by tunnels () through a forwarding network (), each interface having a forwarding address in an address space of the forwarding network, each network interface having a reconfigurable address mapper () for determining a forwarding address for a packet, and encapsulating the packet with its forwarding address so that the forwarding network can forward the data packet transparent to its destination address. The network interface automatically configures the address mapper by sending a discovery request for a given virtual network address over the forwarding network, to prompt a response with an indication of the corresponding forwarding address, and to use the indication in such a response to configure the address mapper. This can ease the administrative burden of setting up and maintaining the address mapper and to ease network reconfiguration according to demand or faults for example.

Mapping discovery for virtual network

A virtual network has virtual machines on physical devices connected to network interfaces each coupled by tunnels () through a forwarding network (), each interface having a forwarding address in an address space of the forwarding network, each network interface having a reconfigurable address mapper () for determining a forwarding address for a packet, and encapsulating the packet with its forwarding address so that the forwarding network can deliver the data packet to the remote physical device having that forwarding address. Such encapsulation enables virtual machines on different physical devices to communicate transparently to the underlying forwarding network. Virtual networks can be created to suit their applications yet use or share existing forwarding networks, while protecting the forwarding network from interference by the virtual machines, and maintaining isolation between virtual machines.

Network virtualization

A virtual network has network interfaces coupled by a multipoint tunnel () through a forwarding network (), each interface having a forwarding address in an address space of the forwarding network, each network interface having a reconfigurable address mapper () for determining a forwarding address for a packet, and encapsulating the packet with its forwarding address so that the forwarding network can forward the data packet transparent to its destination address. This makes the virtual network more agile since changes to the virtual network can be achieved by reconfiguring the corresponding forwarding addresses without needing to set up new tunnels new routing to these different tunnels. The forwarding network need not be aware of the virtual network and so no adaptation of the forwarding network or specialised hardware is needed.

Virtual network interface

A system comprising a trusted computing platform including one or more logically protected computing environments, each of which is associated with at least one service or process supported by said system, the system being arranged to load onto said trusted computing platform a predetermined security policy including one or more security rules for controlling the operation of each of said logically protected computing environments, the security rules for at least one of said logically protected computing environments including an execution control rule which defines the security attributes to be applied to a service or process associated with said logically protected computing environment when said service or process is started.

Security attributes in trusted computing systems

A system and method for resolving a rule conflict within a security policy applied to a trusted computing platform, wherein the fileset to which each of the conflicting rules v and s refers (or 'scope') is determined (step). It is then determined (at step) if the scope of one of the rules s is a complete subset of the scope of rule r. If so, rule s is applied to the accessed file f (at step). If not, the conflict is resolved in another way, for example, by determining the most restrictive of rules r and s (at step) and applying the result accordingly (step).

Security attributes of nodes in trusted computing systems

An electronic certificate has content data specifying an attribute delegation from an identified issuer to an identified subject, and an electronic signature for confirming the content data. The content data includes a condition requiring that a particular subject must have a particular attribute in order for the delegation to be valid. This particular subject may be the same as or different from the identified subject. More than one such subject-directed condition can be included in the certificate, the conditions being combined in a predetermined logical relationship.

Electronic certificate

A method is disclosed for discovering a trust chain that imparts a required attribute to a subject and is grounded in a trusted principal that is the issuer of a known trusted attribute delegation. The method involves setting as a primary goal to be proved an attribute delegation from a trusted principal to the subject and then seeking a backwards proof of the primary goal by a process of recursively taking a goal to be proved, starting with the primary goal, and decomposing it into subgoals one of which corresponds to an attribute delegation already proved by an available certificate. If it is not possible to decompose a subgoal that has not been proved, the process backtracks to a previous subgoal to seek a new decomposition of the latter. A trust chain is taken as found when the process produces a chain of subgoals proved by corresponding certificates, that grounds in a subgoal proved by a trusted attribute delegation. Name mappings are also permitted.

Method and apparatus for discovering a trust chain imparting a required attribute to a subject

A security protocol entity () is provided that includes a mechanism for enabling a first party () to communicate securely with a second party () through an access-controlling intermediate party () by nesting within a first security session () established with the intermediate party () a second security session () with the second party (). The protocol data units, PDUs, associated with the second security session () are encapsulated in PDUs associated with the first security session () when sent out by the first party, the intermediate party extracting the encapsulated PDUs for sending on to the second party (possibly with a change to the destination address included in the PDU to be sent on). Each PDU includes a message type field explicitly indicating to the intermediate party () if a received PDU encapsulates another PDU intended to be sent on. The establishment of a security session between two parties is made dependent on each party proving by attribute certificates that it has certain attributes required of it by the other party. Where the intermediate party () fronts for the second party () and the first party () initially contacts the intermediate party in the belief that it is the second party, then the latter will indicate its relay status to the first party which can then request the intermediate party () to permit a tunnel to be established through it to the second party (). The first party may place different attribute requirements on the intermediate party in its tunnel role to those initially expected of it when the first party thought it was the second party.

Method and apparatus for a secure communications session with a remote system via an access-controlling intermediate system

A system has a local client application () and a communications stack () by which the local application can communicate with remote peer applications on other systems. The communications stack includes a transport entity () for providing transport services, and a transport-independent, session-level security entity () logically positioned above the transport entity and visible to the local application. The security entity has a key-exchange handshake protocol engine () for conducting a handshake with a peer security entity () associated with a particular remote application () with which the local application () wishes to communicate, this handshake involving the exchange of key-related data for use in generating session keys. The security entity () also has a secure channel engine () for enabling messages to be passed between the local application and the target remote application with authentication and/or encryption. During the key-exchange handshake, the handshake protocol engine () exchanges attribute justifications, in the form of one or more certificates, with its peer whereby to enable verification by each system that the application () being contacted has the particular attributes, if any, required by its own application ().

Security protocol

A security protocol system is provided in which at least some of the protocol PDUs are exchanged between the parties operating the protocol in the form of electronic documents formatted according to a self-describing markup language such as XML.

Growing community of inventors

Bath, United Kingdom

Michael John Wray