Fujitsu Corporation

Zhexuan Song

Ryusuke Masuoka

Jesus Molina

Yannis Labrou

Sung Ho Lee

Joseph Gordon

Ryusuke Masuouka

Seigo Kotani

Indradeep Ghosh

Jonathan Russell Agre

Narendar M Shankar

Duy Q Huynh

Keishiro Tanaka

Maarten H Wiggers

Tomihiro Yamazaki

Houcheng Lee

Michael Grove

Wei-Iun Chen

Nada Hashmi

Patrick Joseph Armstrong

Guang Huang

Sung Youn Lee

According to an aspect of an embodiment, a method of establishing a chain of trust into a virtual machine on a hardware system is described. The method may include measuring an immutable portion of a virtual machine image configured to instantiate as the virtual machine to generate a trust anchor measurement. The method may also include storing the trust anchor measurement in a sealed memory.

Establishing a chain of trust within a virtual machine

A system and method are disclosed for providing and maintaining a high level of security during migration of data from one platform to another. The disclosed system combines user and equipment authentication with equipment environment authorization guaranteed by a security module such as supported by a trusted platform module (TPM) in parallel, for secure information transfer to support migration between platforms.

Method and apparatus for secure information transfer to support migration

Associating a semantic service description (SSD) with a service, wherein the SSD comprises a semantic description of the service, including a semantic description of a parameter of the service, according to a computer interpretable language, and, as a service grounding, a mapping between the computer interpretable language expressing the SSD and an interface, including an interface parameter, of the service. A dynamic composition of a task based upon a user selection of a plurality of known services is supported and a dynamic association of the task with a user interface of an application is supported, based upon associating the task with the user selection of a UI object, a UI display screen, and a UI event for the application.

Building computing applications based upon metadata

In one embodiment, receive a first request in connection with accessing a set of encrypted data, wherein the set of encrypted data has an expiration date; the first request comprises a first key associated with the expiration date; and the set of encrypted data has been encrypted using the first key. Validate the first key by comparing the expiration date against a current time. Generate a second key for decrypting the set of encrypted data using the first key only if the expiration date has not passed.

Conditional key generation based on expiration date of data

Methods and systems for providing services and/or computing resources are provided. A method may include receiving an application from an application provider. The method may further include receiving data from a data provider. The method may also include receiving a first request from the data provider to execute the application and apply the data as input to the application. Additionally, the method may include executing the application in response to receiving the first request. The method may also include storing output data resulting from execution of the application. The method may further include receiving a second request from the data provider to transmit the output data to the data provider. The method may additionally include communicating the output data to the data provider in response to the second request.

Method and system for providing services

A system for trusted network booting of a server. The system may include a booting server that may contain a booting image and a network server that may boot with the booting image from the booting server. The network server may include a trust anchor that measures the booting image. The system may further include a network controller that controls access to a network. The network controller may verify the measurement of the booting image before allowing the network server to access the network.

Trusted network booting system and method

In accordance with some embodiments of the present disclosure a method for providing evidence of a physical location of a virtual machine comprises launching, by an information technology (IT) resource, a virtual machine from a virtual machine image. The method further comprises generating, by the IT resource, a chain entry in a physical presence chain of the virtual machine image, the chain entry including an identifier of the IT resource indicating that the IT resource launched the virtual machine.

System and method for providing evidence of the physical presence of virtual machines

An event condition is checked, using a computer and data content of the computer is additionally protected in relation to a normal data protection according to the event condition. The event condition is detecting by the computer a remote command and/or detecting a state according to a policy.

Data protecting device

A computer-based system includes task computing enabling users to define tasks by combining available functionality and to execute such tasks. The computer-based system of includes available functionality which originates in devices, computing applications and electronic services available through local and remote procedure calls including Web Services, UPnP, CORBA, RMI, RPC, DCE, DCOM or comprises previously defined tasks. All available functionality is abstracted to the user as a service and each service is expressed in a service description language, and the services have a semantic description associated with them.

Task computing

The embodiments provide generating a dedicated virtual machine image (DVMI) including functionality for a target service provider and launching the DVMI in the host device as a dedicated virtual machine (DVM). A measurement of the DVMI and/or the launched DVM, as a Trusted Dedicated Virtual Machine (TDVM), is transmitted to the target service provider server. The target service provider determines a trust level for the TDVM, based upon the measurement and provides a level of service by the target service provider server to the TDVM, according to the trust level of the TDVM.

Trusted virtual machine as a client

A method for securely sharing electronic documents on a document storage system. The method includes receiving an electronic document from a creating user, generating an encryption key unique to the electronic document, encrypting the electronic document using the encryption key to create an encrypted electronic document, and communicating the encrypted electronic document to a document repository for storage/ The method also includes identifying a resource locator for uniquely identifying the storage location of the encrypted electronic document and communicating the encryption key and the resource locator to the creating user. The method also includes receiving the encryption key and the resource locator from a requesting user, retrieving the encrypted electronic document from the document repository using the resource locator, decrypting the encrypted electronic document using the encryption key, and communicating the decrypted electronic document to the requesting user.

Method and apparatus for sharing documents

A target computing environment is secured by a hardware trust anchor that provides a trust state of the target computing environment based upon a security audit of the target computing environment. And diagnosing the target computing environment can be diagnosed by the hardware trust anchor according to the security diagnostic information.

Hardware trust anchor

A method for identity verification includes receiving a request for proof of identity from a service provider and receiving biometric information associated with a user of a communication device. The method also includes determining that the received biometric information matches a biometric profile that contains biometric information associated with a registered user of the communication device. The method also includes unlocking a private key associated with the registered user in response to determining that the received biometric information matches a biometric profile and sending a request for a digital certificate that is signed with the private key associated with the registered user. The method further includes receiving the digital certificate that includes a public key associated with the registered user and satisfies the request for proof of identity. The method also includes with forwarding the digital certificate to the service provider.

Method and apparatus for identity verification

In one embodiment, one or more electronic devices access energy-consumption data at each of a plurality of electricity-consuming devices, the energy-consumption data at each of the electricity-consuming devices indicating for each of a plurality of past pre-determined time periods an aggregate energy usage by the electricity-consuming device over the past pre-determined time period, an energy-measurement unit at the electricity-consuming device having measured and recorded the aggregate energy usage by the electricity-consuming device for each of the past pre-determined time periods for later access, each of the energy-measurement units having a substantially unique identifier (ID), each of the electricity-consuming devices having its own one of the energy-measurement units; and based on the energy-consumption data, determine one or more energy-consumption patterns across the electricity-consuming devices over at least the past pre-determined time periods.

Measure energy consumption and determine energy-consumption patterns for electricity-consuming devices

An apparatus provides computing sources of functionality, each computing source of functionality presents a service and exists in any computing environment of the apparatus. The apparatus associates a semantic service description (SSD) with the service. The SSD has a semantic description of the service, including a semantic description of a parameter of the service, according to a computer interpretable language, and, as a service grounding, a mapping between the computer interpretable language expressing the SSD and an interface, including an interface parameter, of the service. The apparatus dynamically discovers SSDs as available services through discovery mechanisms, filters the services based upon the semantic description in each SSD associated with each service, generates a user interface to dynamically compose a task based upon selecting the services and the filtering the services to continuously present possible tasks, and generates an executable semantic service workflow description of the composed task.

Growing community of inventors

Sunnyvale, CA, United States of America

Zhexuan Song