Hewlett-packard Development Company, L.p.

Hewlett Packard Enterprise Development LP

Siani Lynne Pearson

Liqun Chen

Marco Casassa Mont

David Chan

Boris Balacheff

Graeme John Proudler

Sharad Singhal

Dipankar Gupta

Marc Brandt

Bruno Edgard Van Wilder

Archie Reed

Matthew John Lawman

Keith Alexander Harrison

Tomas Sander

Chris I Dalton

Michael John Wray

Fred A Cummins

Prasad V Rao

Martin Sadler

Michael Bernd Beiter

Christopher L Dalton

Richard Brown

Gina Kounga

Dennis Heinze

Gina L D Kounga

Pete Bramhall

Andrew Charles David Hay

Michela D'Errico

Arindam Das-Purkayastha

Roelf Du Toit

Leon Frank Ehrenhart

Examples relate to system call policies for containers. In an example, a method includes receiving, by a container platform, a container for running an application. The container has a metadata record that specifies an application type of the application. The container platform receives a data structure that specifies a set of system call policies for a set of application types and queries the data structure to determine a policy of the set of system call policies to apply to the container based on the application type in the metadata record. A kernel implements the policy for the container to allow or deny permission for a system call by the application running in the container based on a comparison of the system call to the policy.

System call policies for containers

One example provides a collaborative policy refinement service to aggregate policy inputs from organizational layers and to generate security policies that are consistent across the organizational layers. This includes an interactive policy component to facilitate collaborative interaction between the organizational layers and to facilitate determination of the security policies.

System and method for policy generation

An example method for managing data in accordance with aspects of the present disclosure includes receiving from a user in the computer network environment a policy about how a piece of data should be treated, an encryption of the piece of data, a signature of a cryptographic hash of the policy and a cryptographic key, requesting from a trust authority the cryptographic key to access the piece of data, transmitting an encryption of at least one share to the trust authority, wherein the at least one share is created by and received from the trust authority, receiving from the trust authority the cryptographic key, wherein the cryptographic key is recreated by a combiner using a subset of the at least one share, shares associated with the trust authority and shares associated with the combiner, and decrypting the encryption of the piece of data using the recreated cryptographic key.

Data management

Compliance to a policy about how to treat data in a computer network environment is ensured by checking that conditions in the policy are satisfied by the entity before access to the data is provided.

Policy-based data management

In one embodiment, a data set is received at a network service element of a network service, a location record for that data set is generated, and the location record is sent to a location registry within the network service to monitored locations of that data set within a network service. The network service element is operatively coupled to a communications link. The location record is generated based on a portion of the data set and a cryptographic key associated with the network service element. The location record uniquely identifies the presence of the data set at the network service element.

Methods, apparatus and systems for monitoring locations of data within a network service

A computer network has a number of resources. One or more trusted localization provider certifies the location of the resources. Encrypted data is closely associated with a policy package defining privacy policies for the data and metapolicies for their selection. A trusted privacy service enforces the privacy policies. The trusted privacy service is arranged to supply a key to a resource to allow that resource to process data if the trusted privacy service determines from the trusted localization provider certifying the location and other contextual information of the resource that the privacy policy allows processing of the data on that resource in that location.

System and method for dynamically allocating resources

In one implementation, encrypted data and a virtual machine are stored together as a virtual machine-data image, wherein the virtual machine is configured to EXERT management control over the data based on policies set by an owner of the data. In another implementation, metadata defining or tagging policies for usage of data is associated with the data. Control capabilities of service providers are mapped to the policies, wherein those service provider environments that best satisfy the controls mapped to the policies are identified.

Data management using a virtual machine-data image

A questionnaire generation process presents a first subset from a set of questions of the questionnaire and receives first answers from a user. The first answers are used to determine whether the first answers are sufficient to give definite values to conditions of first rules, wherein the first rules have conditions for providing output. When the first answers are not sufficient, the conditions of the first rules can be used to identify a second subset of the questions, wherein the second subset of questions has second answers such that a combination of the first and second answers is sufficient to give definite values to the respective conditions of the first rules, and the second subset of questions can be presented to the user.

Questionnaire generation

A trusted certification authority service allows a user to control a combination or a subset of personal credentials associated with different trusted identities of the user to create a new identity that may be used by the user to entitle him to access or obtain a third party service. The copying and/or transfer of trust values (such as bank balances or loyalty points) between different trusted identities in order can maintain the anonymity of a person having one or more of said identities.

Trusted identities on a trusted computing platform

An apparatus and methods for modifying the security status of a computer component are disclosed. The apparatus represents a plurality of computer components; represents interactions among the plurality of computer components; and allows modification of a security setting associated with at least one of the computer components. The methods disclosed teach depicting a plurality of computer components; depicting interactions among the plurality of computer components; and modification of a security setting associated with at least one of the computer components.

Security apparatus

In order to facilitate a user's ability to trust a computing environment, a trusted computing device () is arranged to challenge other devices in the computing environment and to record a log of the facilities available within the computing environment and an indication of whether those facilities are trustworthy. A new user () entering the computing environment can obtain the log from the trusted computing device in order to ascertain the status of the environment. Alternatively any device can hold data concerning platforms in its vicinity and its operation can be authenticated by the trusted device.

Method of and apparatus for ascertaining the status of a data processing environment

A computer platform () uses a tamper-proof component (), or 'trusted module', of a computer platform in conjunction with software, preferably running within the tamper-proof component, that controls the uploading and usage of data on the platform as a generic dongle for that platform. Licensing checks can occur within a trusted environment (in other words, an environment which can be trusted to behave as the user expects); this can be enforced by integrity checking of the uploading and license-checking software. Metering records can be stored in the tamper-proof device and reported back to administrators as required. There can be an associated clearinghouse mechanism to enable registration and payment for data.

Computer platforms and their methods of operation

A voice call system and a method and apparatus for identifying a voice caller are disclosed. The system includes a call originator apparatusand a called party apparatus. At least one trusted user identity is formed at the call originator apparatus, ideally in a trusted platform moduleconfigured according to a Trusted Computing Platform Alliance (TCPA) specification. The called party apparatuschecks the trusted user identity when establishing a new voice call. Advantageously, an identity of the voice caller using the call originator apparatus is confirmed in a reliable and trustworthy manner, even when the voice call is transported over an inherently insecure medium, e.g. an open computing system like the internet. Preferred embodiments of the invention use IP telephony, such as SIP (session initiation protocol) or H.323 standard voice telephony.

Method and apparatus for identifying a voice caller

A storage box includes bulk non-volatile memory storage locations, an input/output unit for connection to a network, and a controller for controlling reading and writing of data from and to the storage locations. A trusted device is physically associated with/incorporated into the controller. At least one of the controller and the trusted device is configured such that in writing data to the memory storage locations, the data are stored in conjunction with a coded identifier which is associated with a person or organization that is authorized to read the data.

Growing community of inventors

Westbury-on-Trym, United Kingdom

Siani Lynne Pearson