Abstract: An example non-transitory machine-readable medium includes instructions that cause a processor of a computing device to create a first virtual machine using a hypervisor, execute a trusted basic input/output system (BIOS) in the first virtual machine, create a second virtual machine using the hypervisor, and execute an untrusted BIOS component in the second virtual machine. The first virtual machine is executed with a greater privilege to access a resource of the computing device than the second virtual machine.

Abstract: In Example implementations provide a computer program product to authenticate a set of components associated with a device; the components having associated respective shares (s1..sn) of a private key of a private-key/public key pair (sk,pk); the computer program product comprising: instructions to create a signature from the shares (s1..sn) and a message, m, associated with the components; and instructions to generate authentication data comprising at least the signature for transmitting to an authentication server.

Abstract: Example implementations provide a computer program product for authenticating a number of grouped product-packaging pairs, in which each product-packaging pair comprises a respective message, associated with a respective product, and a respective signature associated with the message; the computer program product comprising machine executable instructions arranged, when processed, to: read the product messages and the signatures from the grouped product-packaging pairs; determine and store bilinear computation results associated with each of the messages, and each of the signatures; and determine, from the stored bilinear computation results, whether or processed not at least one product-packaging pair of the number of grouped product-packaging pairs is authentic.

Abstract: A monitoring device for verifying the integrity of a software of a memory device is disclosed. The monitoring device comprises a processor and a memory, the memory containing instructions executable by the processor, such that the processor is to; receive first information on at least one physical side-effect of a computer apparatus as a result of an instruction of a monitored software being executed by the computing apparatus. The processor is also to receive second information on the monitored software being executed, and based on the first information and the second information, the processor is to determine if the monitored software is compromised.

Abstract: An example computing device comprises a memory storing software, and a processor to, identify an expected parameter value range of a plurality of expected parameter value ranges of a hardware component of the computing device, the expected parameter value range corresponding to a set operating mode of the hardware component; compare an analog parameter value of the hardware component to the identified expected parameter value range; and determine whether the analog parameter value is within or outside the expected parameter value range.

Abstract: A method of determining whether a processing unit is compliant with a security policy is provided. The method may comprise obtaining first data indicative of a power consumption profile of the processing unit for a first time period, the power consumption profile comprising a variation of power consumption with time. The method may comprise determining whether the processing unit is compliant with the security policy during the first time period depending, at least in part, on the obtained first data. It may be that the processing unit complying with the security policy gives rise to a power signature in the power consumption profile of the processing unit during a period of compliance.

Abstract: In an example, an apparatus is described. The apparatus comprises processing circuitry comprising a control module. The control module is to protect information regarding a machine learning model owned by a third party. The information is protected in a memory communicatively coupled to the control module. In response to receiving an indication that a computing device under control of the control module complies with a third party policy associated with the machine learning model, the control module is to release the information to the computing device.

Abstract: In an example, an apparatus is described. The apparatus comprises processing circuitry comprising a control module. The control module determines whether a computing device communicatively coupled to the control module is in a specified state for executing a machine learning model controlled by a third party entity. In response to determining that the computing device is in the specified state, the control module is to send, to an attestation module in a data processing pipeline associated with the computing device, an indication that the computing device is in the specified state.

Abstract: In an example, an apparatus is described. The apparatus comprises processing circuitry comprising a generating module, a signing module and an interfacing module. The generating module is to generate a statement comprising: a control plane indicator to indicate a control plane state of a computing device used to execute a machine learning model. The statement further comprises information regarding the machine learning model. The signing module is to generate a signature for the statement using an attestation key associated with the apparatus. The interfacing module is to send the statement and the signature to a requesting entity.

Abstract: In an example, an apparatus is described. The apparatus comprises a memory device comprising a set of logical cells. A logical cell of the set of logical cells indicates a data value by an amount of charge stored in a physical cell of the logical cell. Charge leakage between the physical cell and an adjacent physical cell of the logical cell is to occur at a rate that at least partially depends on a relative amount of charge stored in the physical cell and the adjacent physical cell. A set of data values indicated by the set of logical cells is to change over time due to the charge leakage. The set of data values indicated by the set of logical cells is representative of information that is valid over an estimated period of time, which is based on the rate of charge leakage.

Abstract: In an example, an apparatus is described. The apparatus comprises a processor to interface with a computing system and a memory device comprising a set of logical cells. A logical cell of the set of logical cells indicates a data value by an amount of charge stored in a physical cell of the logical cell. Charge leakage between the physical cell and an adjacent physical cell of the logical cell is to occur at a rate that at least partially depends on a relative amount of charge stored in the physical cell and the adjacent physical cell. The apparatus further comprises a machine-readable medium storing instructions readable and executable by the processor to cause the processor to process a request issued via the computing system for the processor to cause a memory operation to be performed in the memory device.

Abstract: The present disclosure relates to a neural network. The neural network may comprise a first portion, comprising a plurality of layers of the neural network, to perform a first cryptographic operation on input data. The neural network may further comprise a second portion, comprising a plurality of layers of the neural network, to perform processing on the data. The neural network may further comprise a third portion, comprising a plurality of layers of the neural network, to perform a second cryptographic operation on the processed data.

Abstract: In an example, a method is described. The method comprises receiving a log comprising information about a computing system. The log is sent by a computing device associated with the computing system. The computing device comprises a first identity bound to a third identity of a certificate authority (CA) and a second identity bound to the first identity. The method further comprises receiving a signature for the log. The method further comprises verifying a certificate indicative of the second identity having been certified. The method further comprises verifying the received signature.

Abstract: In an example, a method includes providing a computing device with an instruction to cause the computing device to execute the instruction. The method further includes monitoring a side channel of a microarchitectural component of the computing device to obtain an indication of whether or not a state of the microarchitectural component changes as a result of the computing device executing the instruction. The method further includes determining whether or not the indication corresponds to an expected state of the microarchitectural component for the instruction.

Abstract: In an example there is provided an apparatus for a computing system. The apparatus comprises a central processing unit (CPU) and at least one further hardware component. The apparatus comprises a probe communicatively coupled with the hardware component and the CPU, to intercept communication between the hardware component and CPU and an inspection module communicatively coupled to the probe, to access communication data intercepted at the probe relating to communication between the hardware component and CPU determine a state of a process executing on the CPU, on the basis of the communication data and apply a model to the state to infer malicious activity on the CPU.

Abstract: There is described a method including obtaining memory management configuration data, for example, from a memory management unit. The memory management configuration data is used to identify memory locations having a predetermined property. Content is monitored at the identified memory locations.

Abstract: A method is provided, comprising actively testing the access control policy of a software target using a probing logic. The method further comprises determining whether an intrusion in the software target has occurred based on monitored side effects. According to the method, the probing logic is to execute at least one operation that is forbidden by the access control policy. The probing logic is further to create at least one predetermined observable side effect based on the successful execution of the operation.

Abstract: There is provided a method for thread allocation in a multi-processor computing system. The method includes determining whether a thread for execution has a security requirement. The thread is allocated to one of a first processing unit or a second processing unit based on the determination. The thread is allocated for execution by the first processing unit based on the thread having the security requirement.

Abstract: In examples, apparatus for detecting malicious or rogue behaviour associated with data packets transmitted between a first device and a second device through a switch is provided, the first device having direct read/write memory access to the second device, in which the apparatus comprises an intercepting device logically intermediate the first device and the switch device to enable the apparatus to analyse the data packets to determine a communication pattern between the first and second devices, compare the communication pattern to a set of expected behaviours for the first device, select, on the basis of the comparison to the set of expected behaviours, a behaviour pattern for the first device, and map the behaviour pattern for the first device to a set of mitigating actions when the behaviour pattern for the first device is symptomatic of a malicious or rogue behaviour.

Abstract: The disclosure relates to a data processing apparatus. The data processing apparatus may comprise a memory storing a candidate service level response to an intrusion to an operating system having a plurality of operating system services. The data processing apparatus may comprise processing circuitry coupled to the memory. The data processing apparatus may comprise an output coupled to the processing circuitry. It may be that the processing circuitry is to, depending on an alert indicative of the intrusion: select from the memory, for an operating system service of the said plurality of operating systems, the said operating system service being related to the alert, the candidate service level response to the intrusion; and provide a signal to the output depending on the candidate service level response selected in respect of the said operating system service.