Abstract: A system has a virtual overlay infrastructure mapped onto physical resources for processing, storage and network communications, the virtual infrastructure having virtual entities for processing, storage and network communications. Virtual infrastructures of different users share physical resources but are isolated. Each infrastructure has its own infrastructure controller to create and configure the infrastructure. It has a user accessible part (CFC) for configuration of that user's infrastructure, and a user inaccessible part (UFC) able to access the mapping and the physical resources. This increases user control to ease system administration, while maintaining security by limiting access to the mapping.

Abstract: A system has a virtual overlay infrastructure mapped onto physical resources for processing, storage and network communications, the virtual infrastructure having virtual entities for processing, storage and network communications. The system has a mapping manager to dynamically alter the mapping for balancing, performance, and redundancy. There can be more independence from the underlying physical configuration, compared to known methods of virtualizing only some of the entities. The mapping manager can be distributed across a number of entities on different physical servers arranged to cooperate with each other.

Abstract: Security keys for the provision of a secure service such as content provision are generated in an ancestral hierarchy, so that invalidation of a key in the hierarchy results in a need to reconfigure all other keys in the hierarchy to the extent they share common ancestry. When a user subscription to the service lapses, a decision on invalidation of their key is based in a determination of whether it's more costly to the subscriber to invalidate the key, or continue providing an unpaid-for service. Keys can be allocated to users from domains of the hierarchy on the basis of their economic value to the provider, with higher value users being allocated keys from domains which share fewer common ancestors with other users of other domains than those users share with each other, to minimise inconvenience to high value users of key reconfiguration.

Abstract: Embodiments of the invention provide a method of authenticating a physical document, comprising obtaining an electronic representation of at least part of the physical document; extracting at least one error detection code from the electronic representation; and using the at least one error detection code to detect errors in image data within the electronic representation. Embodiments of the invention also provide a method of securing a physical document, comprising obtaining an electronic representation of at least part of the physical document; determining at least one error detection code for image data within the electronic representation; and producing a secure physical document comprising the electronic representation and a machine readable marking including the at least one error detection code.

Abstract: Security keys for the provision of a secure service such as content provision are generated in an ancestral hierarchy, so that invalidation of a key in the hierarchy results in a need to reconfigure all other keys in the hierarchy to the extent they share common ancestry. When a user subscription to the service lapses, a decision on invalidation of their key is based in a determination of whether it's more costly to the subscriber to invalidate the key, or continue providing an unpaid-for service. Keys can be allocated to users from domains of the hierarchy on the basis of their economic value to the provider, with higher value users being allocated keys from domains which share fewer common ancestors with other users of other domains than those users share with each other, to minimize inconvenience to high value users of key reconfiguration.

Abstract: A computer implemented process for identifying conflicts between policies for a method invocable by an object is described, in which the method is a member of at least one statically defined method grouping having a corresponding policy. The process comprises, for each method grouping, obtaining each method which is a member of the method grouping, associating therewith the corresponding method grouping policy, and comparing policies associated with methods which are members of two or more method groupings to identify conflicts.

Abstract: A method of providing a validatable data structure having a changeable part and an unchangeable part having respective content is described. The method comprises incorporating, in the unchangeable part, an identifier identifying the changeable part.

Abstract: A method of authorizing a computing entity comprises obtaining at the authorizing entity a delegation chain of intermediate elements through which an authorisable entity asserts authorization eligibility in the form of a sequence of locally assigned labels for the elements. The method further comparing the label sequence against a label sequence template.

Abstract: The present disclosure relates to a system and method for isolating applications from each other. In one arrangement, the system and method pertain to intercepting application instructions, determining if an application instruction calls for an illegal action, and preventing the illegal action from occurring if the application instruction calls for the illegal action. In some arrangements, the system and method further pertain to determining if the application instruction contains an indirect memory reference and, if so, modifying the application instruction to enable the application instruction to determine itself whether an illegal operation is to be performed.

Abstract: While powerful in diffusion at one resolution to print photos at a finer resolution, the invention is not thus limited. It defines superpixels (“spels”) for each desired colorimetric level, generates/receives image data, renders by finding levels for image positions, and prints an image using selected spels. One invention aspect finds a randomized value at each found level and uses the value to select the spel from plural ones for each level. Another aspect derives/maintains a randomized-value matrix; and maps a matrix location to an image position, to select a random value at that location and spel for that position. Another uses the value in common for all planes to select a spel for each plane at the found level—compatible spels for different planes, to coordinate color placement in planes. Another controls defining/selecting for a blue-noise property of spels in aggregate. In another, spels defined for a level vary in value to yield nonintegral color quanta.

Abstract: A method and apparatus is provided for consolidating cryptographic key updates, the consolidated update information enabling, for example, a returning member of a secure group who has been offline, to recover the current group key, at least in most cases. The unconsolidated key updates each comprise an encrypted key, corresponding to a node of a key hierarchy, that has been encrypted using a key which is a descendant of that node. The key updates are used to maintain a key tree with nodes in this tree corresponding to nodes in the key hierarchy. Each node of the key tree is used to store, for each encrypting key used in respect of the encrypted key associated with the node, the most up-to-date version of the encrypted key with any earlier versions being discarded. The key tree, or a subset of the tree, is then provided to group members.

Abstract: Security keys for the provision of a secure service such as content provision are generated in an ancestral hierarchy, so that invalidation of a key in the hierarchy results in a need to reconfigure all other keys in the hierarchy to the extent they share common ancestry. When a user subscription to the service lapses, a decision on invalidation of their key is based in a determination of whether it's more costly to the subscriber to invalidate the key, or continue providing an unpaid-for service. Keys can be allocated to users from domains of the hierarchy on the basis of their economic value to the provider, with higher value users being allocated keys from domains which share fewer common ancestors with other users of other domains than those users share with each other, to minimise inconvenience to high value users of key reconfiguration.

Abstract: Security keys for the provision of a secure service such as content provision are generated in an ancestral hierarchy, so that invalidation of a key in the hierarchy results in a need to reconfigure all other keys in the hierarchy to the extent they share common ancestry. When a user subscription to the service lapses, a decision on invalidation of their key is based in a determination of whether it's more costly to the subscriber to invalidate the key, or continue providing an unpaid-for service. Keys can be allocated to users from domains of the hierarchy on the basis of their economic value to the provider, with higher value users being allocated keys from domains which share fewer common ancestors with other users of other domains than those users share with each other, to minimise inconvenience to high value users of key reconfiguration.

Abstract: The present disclosure relates to a system and method for isolating applications from each other. In one arrangement, the system and method pertain to intercepting application instructions, determining if an application instruction calls for an illegal action, and preventing the illegal action from occurring if the application instruction calls for the illegal action. In some arrangements, the system and method further pertain to determining if the application instruction contains an indirect memory reference and, if so, modifying the application instruction to enable the application instruction to determine itself whether an illegal operation is to be performed.