Mcafee, Inc.

Musarubra US LLC

Sudeep Das

Vincent J Zimmer

Rajesh Poornachandran

Pramod Sharma

Arthur S Zeigler

Sumant Vashisth

Ned M Smith

Simon R Hunt

Christopher Smith

Jiewen Yao

Nivedita Aggarwal

Giri P Mudusuru

Hemang Satish Nadkarni

Xiang Ma

Satya P Yarlagadda

Rangasai V Chaganty

Ravi Poovalur Rangarajan

Amy Chan

Karunakara Kotary

Senthil K Venkatesan

Don R Hanson, Ii

Atul A Khare

Jayasankar Divakarla

Anders Swanson

Technologies for privacy-safe security policy evaluation are disclosed herein. An example apparatus includes at least one memory, and at least one processor to execute instructions to at least identify one or more non-sensitive parameters of a plurality of policy parameters and one or more sensitive parameters of the plurality of the policy parameters, the plurality of the policy parameters obtained from a computing device in response to a request from a cloud analytics server for the plurality of the policy parameters, encrypt the one or more sensitive parameters to generate encrypted parameter data in response to the identification of the one or more sensitive parameters, and transmit the encrypted parameter data to the cloud analytics server, the cloud analytics server to curry a security policy function based on one or more of the plurality of the policy parameters.

Technologies for privacy-preserving security policy evaluation

In an example, there is disclosed a system and method for providing a service-oriented architecture, including request/response, over a publish/subscribe framework. In one embodiment, a system is disclosed for adding layers upon a publish/subscribe messaging framework for sophisticated messaging such as point-to-point (request/response) and the ability to query for available services, in a reliable, scalable manner.

Service-oriented architecture

An apparatus includes a network interface and a processing unit. The network interface transmits a security payload. The processing unit determines a first partition of a queuing service for the security payload at a first time, at least in part based on a determination that an initial attempt to transmit the security payload failed. The processing unit also instructs a retrieval of the security payload from the first partition to perform a first retry attempt to transmit the security payload, at least in part based on a determination that a first retry interval since the first time has elapsed.

Systems and methods for delivery using a message queue

A disclosed example apparatus includes memory; and at least one processor to execute first instructions, the first instructions obtained from first encrypted firmware, the at least one processor to: encrypt handoff data with an original equipment manufacturer key to generate encrypted handoff data; decrypt second encrypted firmware based on the original equipment manufacturer key to generate second instructions; and provide access to the encrypted handoff data to the second instructions, the second instructions to perform initialization of a computer based on the handoff data obtained from the encrypted handoff data.

Enhanced secure boot

There is disclosed in one example a data exchange layer (DXL) broker, including: a network interface to communicatively couple to a data exchange layer (DXL), the DXL including an enterprise service bus (ESB) configured to provide one-to-one device communications over a publish-subscribe fabric; hardware including at least a processor; and instructions encoded on one or more computer-readable mediums to instruct the processor to provide DXL broker software configured to: receive a DXL request message via the DXL, the request message directed to a DXL service; determine that the DXL service is available; and forward the request message to a DXL endpoint via the DXL.

Technologies for privacy-safe security policy evaluation are disclosed herein. An example apparatus includes at least one processor, and memory including instructions that, when executed, cause the at least one processor to curry a security policy function to generate a privacy-safe curried function set, the security policy function to generate a security policy as a function of a plurality of policy parameters, the privacy-safe curried function set including a non-sensitive function that receives a non-sensitive parameter of the plurality of policy parameters as an argument, the privacy-safe curried function set further including a sensitive function that receives a sensitive parameter of the plurality of policy parameters as an argument; access unencrypted parameter data corresponding to the non-sensitive parameter of the plurality of policy parameters; evaluate the non-sensitive function of the privacy-safe curried function set to generate the sensitive function; and provide the sensitive function to a client computing device.

A pre-boot initialization technique for a computing system allows for encrypting both a manufacturer and original equipment manufacturer firmware routines, as well as handing off data between the manufacturer and original equipment manufacturer firmware routines encrypted with a key provisioned in field programmable fuses with an original equipment manufacturer key. By encrypting the firmware routines and handoff data, security of the pre-boot initialization process is enhanced. Original equipment manufacturer updatable product data may also be encrypted with the original equipment manufacturer key. Additional security may be provided by using trusted input/output capabilities of a trusted execution environment to display information to and receive information from a user. Furthermore, multiple secure phases of configuration may be achieved using wireless credentials exchange components.

There is disclosed in one example a data exchange layer (DXL) broker, including: a hardware platform including a processor; and instructions encoded in a memory to instruct the processor to communicatively couple to a DXL fabric configured to operate a one to-many (1:N, N&#x3e;1) publish-subscribe fabric; provide an interface to authenticate and register DXL endpoints with the DXL broker; and provide DXL messaging, including maintaining a routing table of registered DXL endpoints; receiving from a first registered DXL endpoint a one-to-one (1:1) request for an endpoint of the DXL fabric, wherein the endpoint is not a registered DXL endpoint of the broker; and publishing the 1:1 request to the DXL fabric.

Context-aware network on a data exchange layer

Technologies for privacy-safe security policy evaluation include a cloud analytics server, a trusted data access mediator (TDAM) device, and one or more client devices. The cloud analytics server curries a security policy function to generate a privacy-safe curried function set. The cloud analytics server requests parameter data from the TDAM device, which collects the parameter data, identifies sensitive parameter data, encrypts the sensitive parameter data, and transmits the encrypted sensitive parameter data to the cloud analytics server. The cloud analytics server evaluates one or more curried functions using non-sensitive parameters to generate one or more sensitive functions that each take a sensitive parameter. The cloud analytics server transmits the sensitive functions and the encrypted sensitive parameters to a client computing device, which decrypts the encrypted sensitive parameters and evaluates the sensitive functions with the sensitive parameters to return a security policy. Other embodiments are described and claimed.

In an example, there is disclosed a method or system for merging multiple system trees of different resources based in multiple locations over a data exchange layer. In one embodiment, there is disclosed a system for merging assets of different types within one or more tree-based locations. For example, an end node may be represented in a single location, a single message broker may provide services for and be represented in multiple locations. The asset to asset relationships within merged trees may be used to ensure availability of services and visualization of the system for management purposes.

Merging multiple system trees over a data exchange layer

In an example, a context-aware network is disclosed, including threat intelligence services provided over a data exchange layer (DXL). The data exchange layer may be provided on an enterprise service bus, and may include services for classifying objects as malware or not malware. One or more DXL brokers may provide messaging services including, for example, publish-subscribe messaging and request-response messaging. Advantageously, DXL endpoint devices must make very few assumptions about other DXL endpoint devices.

In one embodiment, a system includes: a processor; a security processor to execute in a trusted executed environment (TEE), the security processor to execute memory reference code (MRC) stored in a secure storage of the TEE to train a memory coupled to the processor; and the memory coupled to the processor. Other embodiments are described and claimed.

System, apparatus and method for performing secure memory training and management in a trusted environment

A combination of shim and back-end server applications may be used to identify and block the installation of malicious applications on mobile devices. In practice, a shim application registers with a mobile device's operating system to intercept application installation operations. Upon intercepting an attempted installation operation, the shim application identifies the application seeking to be installed, generates a key uniquely identifying the application, and transmits the key over a network connection to a back-end server. The back-end server may be configured to crawl the Internet to identify malicious applications and compile and maintain a database of such applications. Upon receiving a key from the shim application, the back-end server can search its database to locate a matching application and, if found, respond to the mobile device with the application's status (e.g., malicious or not). The shim application can utilize this information to allow or block installation of the application.

Detection and prevention of installation of malicious mobile applications

Premise-based policies can be applied in the management of mobile devices and other computing devices within a system. A computing device is detected using close proximity wireless communication and location information is sent to the computing device using close proximity wireless communication. Policies applied to the computing device can be based at least in part on the location information.

Growing community of inventors

Cupertino, CA, United States of America

Sudeep Das