Abstract: In one embodiment, a scheme is disclosed for supporting wireless access network service request capability in a user equipment (UE) device that is operable in wide area cellular network (WACN) bands as well as in wireless access network bands (e.g., GAN bands and/or UMA bands). The UE device includes capability for gaining Internet Protocol (IP) connectivity with a wireless access network node (e.g., a GAN controller (GANC) or UMA network controller (UNC)). Thereafter, the UE device is operable to initiate a registration request message towards the wireless access network node, wherein the registration request message includes at least one information element pertaining to wireless access network services required by the UE device.

Abstract: Examples associated with ransomware attack monitoring are described herein. One example includes a monitor module to monitor files stored on the system for sequences of file accesses that match a predefined pattern of file accesses. An investigation module is activated based on a sequence of file accesses that match the predefined pattern. The investigation module logs actions taken by processes to modify files. A reaction module pauses a set of processes operating on the system based on the logging performed by the investigation module, and resumes legitimate processes.

Abstract: There is disclosed a method, computer program product and a system for regulating execution of a suspicious process, comprising determining a file system location of an executable file associated with the suspicious process, encrypting the file, and creating a wrapper for the file with the same file name and location as the file associated with the suspicious process.

Abstract: A device platform, in some examples, comprises a security processor that may create a private/public cryptographic key pair, and data representing evidence of creation of the key pair, provide access to the key pair and data from an operating system component of the device platform, where the public key part of the key pair may be used to verify management commands. The device platform may validate the key pair and data in a trusted execution state.

Abstract: Examples associated with digital composition hashing are described. One example method includes receiving a digital composition file from a user. The digital composition file may include a top-level design and a hierarchy of sub-level designs. A hashed structure may be generated from the digital composition file, where a node in the hashed structure for the first sub-level design is generated based on hashes of sub-level designs below the first sub-level design in the hierarchy. The hashed structure and a hash of the digital composition file are stored in association with the user.

Abstract: A controller for a fulfilment service operation is described in which the controller, before initiating fulfilment of the job, operates to determine if an authorised user is present at a fulfilment service device and to determine if the user intends to remain attendant at the fulfilment service device for the duration of fulfilment of the job. If the user moves away from the fulfilment service device, the controller operates to pause the job. If the user remains away from the fulfilment service device for a period of time, the controller operates to cancel the job.

Abstract: Examples associated with process verification are described. One example includes a process operating in a general operating environment of the system. From an isolated environment, a protection module modifies the behavior of the process by modifying data associated with the process while the process is in operation. The protection module verifies whether the behavior of the process has changed in accordance with the modification. The protection module takes a remedial action upon determining the process has been compromised.

Abstract: In an example, there is provided a method for attesting to a management state of a device platform configuration, based on a signed data structure that represents a device management status and a time-based value from a secure cryptoprocessor of the device. The signed data structure is sent to a management system for validation based on a comparison to the state of the cryptoprocessor at the time of signing the data structure.

Abstract: Examples associated with ransomware attack monitoring are described herein. One example includes a monitor module to monitor files stored on the system for sequences of file accesses that match a predefined pattern of file accesses. An investigation module is activated based on a sequence of file accesses that match the predefined pattern. The investigation module logs actions taken by processes to modify files. A reaction module pauses a set of processes operating on the system based on the logging performed by the investigation module, and resumes legitimate processes.

Abstract: In an example, a machine-readable medium includes instructions that, when executed by a processor, cause the processor to order, as part of an execution of a trusted process, a plurality of processes into a sequence comprising a first process, at least one intermediate process, and a last process. The machine-readable medium may further comprise instruction to cause the processor to generate, as part of an execution of the first process, a value based on a code portion of the process following the first process in the sequence, and to generate, as part of an execution of each intermediate process, a respective value based on the value generated by the process preceding the intermediate process in the sequence and based on a code portion associated with the process following the intermediate process in the sequence.

Abstract: Examples associated with ransomware attack monitoring are described. One example includes a monitor module to monitor files stored on the system for sequences of file accesses that match a predefined pattern of file accesses. An investigation module is activated when a number of sequences of file accesses that match the predefined pattern exceeds a first threshold. The investigation module logs actions taken by processes to modify files. A reaction module pauses a set of processes operating on the system when the number of sequences of file accesses that match the predefined pattern exceeds a second threshold. The reaction module then identifies processes associated with a suspected ransomware attack based on the logging performed by the investigation module, and resumes legitimate processes.

Abstract: A device platform, in some examples, comprises a security processor that may create a private/public cryptographic key pair, and data representing evidence of creation of the key pair, provide access to the key pair and data from an operating system component of the device platform, where the public key part of the key pair may be used to verify management commands. The device platform may validate the key pair and data in a trusted execution state.

Abstract: A method for regulating access to a system BIOS comprises generating an access token for a user providing selected BIOS access privileges according to a system policy for the user.

Abstract: A controller for a fulfilment service operation is described in which the controller, before initiating fulfilment of the job, operates to determine if an authorised user is present at a fulfilment service device and to determine if the user intends to remain attendant at the fulfilment service device for the duration of fulfilment of the job. If the user moves away from the fulfilment service device, the controller operates to pause the job. If the user remains away from the fulfilment service device for a period of time, the controller operates to cancel the job.

Abstract: A method, in an example, for secure key exchange in a platform, the method comprises checking a value of parameter via a platform hardware initialisation device to determine a status of an agent, generating at least one symmetric cryptographic key, encrypting the at least one symmetric cryptographic key using a public cryptographic key, generating a variable representing the encrypted at least one symmetric cryptographic key, and enabling access to the variable from the agent via the platform hardware initialisation device.

Abstract: In an example, there is provided a method for attesting to a management state of a device platform configuration, based on a signed data structure that represents a device management status and a time-based value from a secure cryptoprocessor of the device. The signed data structure is sent to a management system for validation based on a comparison to the state of the cryptoprocessor at the time of signing the data structure.

Abstract: In an example there is provided a method of applying a mitigation action to a computing system. The method comprises receiving notification of an intrusion event on a computing system. The notification identifies one or more of data, and a process affected by the intrusion event. The method comprises accessing state data corresponding to a state of the computing system prior to the intrusion event, accessing a policy specifying one or more mitigation actions to be applied to the one or more of data, and a process in response to an intrusion event, restoring the one or more of data, and the process on the basis of the state data, and applying a mitigation action according to the policy.

Abstract: Examples disclosed herein relate to selecting a security mitigation action based on device usage. In one implementation, a processor selects a security mitigation action for a device based on information related to usage of the device and associated usage limitations associated with the selected security mitigation action. The processor may output information related to the selected security mitigation action.

Abstract: Examples associated with process verification are described. One example includes a process operating in a general operating environment of the system. From an isolated environment, a protection module modifies the behavior of the process by modifying data associated with the process while the process is in operation. The protection module verifies whether the behavior of the process has changed in accordance with the modification. The protection module takes a remedial action upon determining the process has been compromised.

Abstract: A method for address resolution request control in a network device of a network, the method comprises comparing address resolution requests submitted to network nodes from the network device against a predetermined threshold profile for the network device, and regulating a flow of address resolution requests from the network device in response to the comparison.