Abstract: There is provided a data processing apparatus that includes an input policy filter that receives input data and an input provenance that relates to the input data. The filter forwards some or all of the input data and the input provenance according to at least one input policy. A processing environment receives the input data forwarded by the input policy filter and processes the input data to generate output data. A management environment produces an attestation of the processing environment and produces an output provenance based on the input provenance and the attestation. An output policy filter receives the output data and the output provenance and forwards the output data and the output provenance according to at least one output policy.

Abstract: Broadly speaking, the present techniques relate to a computer implemented method for enabling template-based registration, the method performed by an intermediary apparatus in communication with a first device and a server, the method comprising: receiving, from the first device, a registration request comprising one or more device identifiers for the first device; determining the availability of template information for the first device based on or in response to the one or more device identifiers; when the template information for the first device is unavailable: generating template information for the first device; or requesting, from the server, the template information.

Abstract: Provided is a technology including an apparatus and a machine-implemented method for operating a content sending apparatus attachable to a network, comprising acquiring a sequence comprising at least two content blocks; generating at least one authentication metadata block comprising at least one signed digest derived by a chaining digest technique from the sequence of content blocks; deriving a content transform encoding for each of the content blocks; and sending the at least one authentication metadata block and at least one content transform encoding to at least one of a set of recipient devices, the at least one device being operable to apply an inverse transformation to the content transform encoding and to authenticate at least one resultant content block according to the authentication metadata block.

Abstract: Broadly speaking, embodiments of the present technique provide methods, apparatuses and systems for performing a TLS/DTLS handshake process between machines in a manner that reduces the amount of data sent during the handshake process.

Abstract: Broadly speaking, the present techniques relate to a computer implemented method for establishing a secure communication session between a client device and a server, the method performed at the client device comprising: obtaining a security object comprising at least one security credential and server connection data for multiple connection options to a first server, wherein the security credential is to be used for each of the multiple connection options; generating, a first server security universal resource identifier (URI), the first Server Security URI comprising server contact information for the first server and a first security binding selected from the server connection data; communicating with the first server using the first Server Security URI and the at least one security credential to establish a secure communication session between the client device and the first server.

Abstract: The present techniques generally describe a machine-implemented method for configuring a retransmission timer, the method performed at the server including: receiving, from a client, a first handshake message as part of a first handshake with the client; deriving a retransmission parameter from the first handshake message; setting a first wait time of the retransmission timer based on or in response to the retransmission parameter.

Abstract: A device, device initialisation and method of installing a delta update of executable code on a device, the method comprising: generating an unrelocation table based upon a symbol table and a relocation table associated with relocatable code by: identifying an entry in the relocation table that references a symbol in the symbol table; and storing in the unrelocation table the relocated address of the identified entry in the relocation table; generating a first executable program code based upon the symbol table, the relocation table, and the relocatable code; and storing the first executable program code and the unrelocation table on the device.

Abstract: Aspects of the present disclosure relate to an apparatus comprising first interface circuitry to communicate with a first computing device and second interface circuitry to communicate with a second computing device. The first interface circuitry is configured to receive a handshake message from the first computing device. The second interface circuitry is configured to transmit the handshake message to the second computing device and to receive a handshake response message from the second computing device. The first interface circuitry is configured to transmit the handshake response message to the first computing device, whereby to establish a communication session between the first computing device and the second computing device.

Abstract: Broadly speaking, embodiments of the present technique provide methods, apparatuses and systems for operating a server in communication with a network-attachable electronic device, comprising: storing, in storage accessible by the server, a device registration and a registration lifetime value for the device; receiving at least one message from the device; analysing the message to derive a confidence modifier associated with a message type associated with that message; applying the derived confidence modifier to a calculation of a confidence score for the device; and responsive to the calculation, determining whether a stored registration lifetime value for the device is to be adjusted based upon the confidence score.

Abstract: Broadly speaking, embodiments of the present technique provide methods, apparatuses and systems for controlling device resource subscriptions by an LwM2M server, comprising receiving at said LwM2M server a registration request message from a LwM2M client device, the message comprising an enumeration of a plurality of subscribable elements of an object hierarchy of the device; storing, using the LwM2M server, an association between the device and the plurality of subscribable elements; and sending from the LwM2M server to the LwM2M client device a subscription message comprising a unitary compressed expression representing plural ones of said plurality of subscribable elements associated with said device.

Abstract: Broadly speaking, the present techniques relate to a computer implemented method comprising: receiving, at a first server, one or more device identifiers from a device; determining, with the first server, the availability of a resource template for the device based on or in response to the one or more device identifiers; when the resource template is available for the device: provisioning, from the first server to the device, a template identifier to enable the device to register with a second server using the template identifier.

Abstract: A method of provisioning a device to use a data service provided by a data service provider comprises maintaining a list of unique identifiers of devices to which a trusted certificate has been issued and receiving a data service request for a device. The request will include a unique identifier for the device and a certificate. In response to the data service request, the list of device unique identifiers is consulted in order to verify that the certificate contained in the data service request is a trusted certificate. If the certificate contained in the service request is a trusted certificate, the certificate may then be forwarded to the data service provider.

Abstract: A method of identifying an object within an environment is described for capturing visual data associated with the environment and comparing data defining a candidate object in the environment with an object data store storing object templates providing data pertaining to one or more objects; responsive to matching the data defining the candidate object in the environment and an object template, identifying the candidate object; and responsive to failing to match data representing the candidate object in the environment with an object template, identifying one or more object identifiers disposed in the environment to define identifier search data, and using the identifier search data to interrogate a further object data store to identify the candidate object.

Abstract: Various implementations described herein are directed to providing time-dependent authentication of a sending device. A message to a designated receiver is prepared. A portion of at least one secret identifier value of the sending device is retrieved. A portion of time information is retrieved. An authentication field is produced using the portion of the at least one secret identifier value and the portion of the time information. The authentication field is attached to the message. The message is transmitted to the designated receiver.

Abstract: A machine-implemented method for controlling a configuration data item in a storage-equipped device having at least two security domains, comprising receiving, by one of the security domains, a configuration data item; storing the configuration data item; providing a security indication for the configuration data item; and when an event indicates untrustworthiness of the data item, invalidating a configuration effect of the stored configuration data item. Further provided is a machine-implemented method for controlling a storage-equipped device as a node in a network of devices, comprising receiving information that a data source or type of a configuration data item is untrusted; analysing metadata for the data source and the configuration data item; populating a knowledge base with analysed metadata; and responsive to the analysed metadata, transmitting security information to the network of devices. A corresponding device and computer program product are also described.

Abstract: The present techniques generally relate to a system comprising: a data resource comprising: a device data log to store a device data record for device data of a first device; a permissions log to store a permissions record for one or more permissions associated with the device data; a consent log to store a consent record comprising a consent status for the one or more permissions; wherein the consent record, permissions record and device data record provide a verifiable data audit to determine whether a party is authorized to access the device data.

Abstract: Techniques are described for debugging node devices. A node device may be connected to a host device for debugging purposes. A debugger, providing debug functionality, such as a debugging web application, may run on a remote server and be accessed via a web browser running at the host device, to debug the node device. Alternatively, the debugging web application may execute in the web browser running at the host device to debug the node device. In another alternative, the debugging web application may execute at a gateway device provided between the node device and the host device. In all cases the debugging web application is controlled via a debug user interface running at the web browser. Consequently, a user of the host device is not required to install a debugger at the host device in order to debug a node device.

Abstract: A method of establishing a communications path between devices comprising: receiving, at a first device, data, the data comprising: a first resource having a first identifier for a second device remote from the first device; a second resource having a second identifier for the second device; addressing the second device with the first identifier; generating, at the first device, first connection data based on the second identifier; transmitting, from the first device to the second device, the first connection data; receiving, at the first device, second connection data; validating, at the first device, the second connection data; establishing the communications path between the first device and second device responsive to valid second connection data.

Abstract: A proxy node protects at least one edge node in a network of nodes. The proxy node includes a communications module for communicatively coupling the proxy node with the edge node so that all communications to and from that edge node go through the proxy node. The proxy node also has at least one isolated area that is associated with the at least one edge node. The isolated area stores application software for the associated edge node.

Abstract: Technology for operating a computer system to manage network communications with plural devices, comprising retrieving from a registry one or more device capability profiles for the identified devices, the registry linking a device capability profile with each of the identified plural devices and the device capability profile identifying one or more capabilities of a device; operating in the computer system a message translation manager to adapt a message according to a linked device capability profile of each of the plural devices; and sending the message in adapted form to each identified one of the plural devices.