Abstract: A technique includes registering, with a core of an operating system kernel, a hook that corresponds to a file event and associates the file event with an event-driven module of the operating system kernel. The core is associated with an integrity measurement architecture policy. The technique includes, responsive to an occurrence of the file event, triggering execution of the event-driven module to extend a scope of the integrity measurement architecture policy. Executing the module includes the operating system kernel determining a property of a file that is associated with the file event; and filtering a set of rules of an extended integrity measurement policy based on the property. The filtering includes identifying a given rule of the set of rules having a condition that is contingent on the file event being associated with the property.

Abstract: A process includes aggregating a time sequence of samples. Each sample has a plurality of dimensions that correspond to respective metrics that are associated with a microservice. Each sample includes, for each dimension, a measurement of the metric that corresponds to the dimension. The process includes identifying a given sample of the time sequence of samples based on measurements of first samples of the time sequence of samples and determining a sensitivity dependency of the metrics based on the measurements of the given sample. The process includes determining whether the microservice has been subjected to a security attack based on the sensitive dependency.

Abstract: A process includes a first tenant of a plurality of tenants communicating with a security processor of a computer platform, via a first physical request interface of the security processor, to acquire ownership of a first command execution engine of the security processor associated with the first physical request interface. The process includes a second tenant of the plurality of tenants communicating with the security processor, via a second physical request interface of the security processor, to acquire ownership of a second command execution engine of the security processor associated with the second physical request interface. The process includes the security processor receiving a first request from the first tenant in the first physical interface, and the second processor receiving a second request from the second tenant in the second physical request interface.

Abstract: A process includes testing a motor vehicle using a distributed computing system. The distributed computing system includes a plurality of hardware components and a plurality of software components. The plurality of hardware components includes first hardware components of the vehicle and second hardware components that are separate from the vehicle. The plurality of software components includes first software components of the vehicle and second software components separate from the vehicle. The process includes, responsive to the testing, generating, by the distributed computing system, an audit record. Generating the audit record includes determining, by the distributed computing system, integrity measurements of the first hardware components, the second hardware components, the first software components and the second software components.

Abstract: A process includes a first tenant of a plurality of tenants communicating with a security processor of a computer platform, via a first physical request interface of the security processor, to acquire ownership of a first command execution engine of the security processor associated with the first physical request interface. The process includes a second tenant of the plurality of tenants communicating with the security processor, via a second physical request interface of the security processor, to acquire ownership of a second command execution engine of the security processor associated with the second physical request interface. The process includes the security processor receiving a first request from the first tenant in the first physical interface, and the second processor receiving a second request from the second tenant in the second physical request interface.

Abstract: The application describes an attestation system (705, 707, 710) in a cloud computing environment. The authorization system is configured to allow a plurality of users (701a-d) and applications (702, 706, 708, 709) of the cloud computing environment to issue attestations regarding attributes of other users and applications. The authorization system is also configured to control access to said attestations and to allow a plurality of users and applications of the cloud computing environment to query the authorization system to determine whether a specified user or application has a specified attribute. Methods of controlling access to resources in a cloud computing environment and also of providing secure attestations are also described.

Abstract: The application describes an attestation system (705, 707, 710) in a cloud computing environment. The authorization system is configured to allow a plurality of users (701a-d) and applications (702, 706, 708, 709) of the cloud computing environment to issue attestations regarding attributes of other users and applications. The authorization system is also configured to control access to said attestations and to allow a plurality of users and applications of the cloud computing environment to query the authorization system to determine whether a specified user or application has a specified attribute. Methods of controlling access to resources in a cloud computing environment and also of providing secure attestations are also described.