Abstract: An apparatus for balancing consumption of random data, comprising an entropy manager operable to: responsive to receipt of a request for random data, monitor one or more events associated with a plurality of entities and access one or more rules; determine whether a higher level of entropy associated with the random data is required by analyzing the one or more events in accordance with the one or more rules; responsive to a determination that a higher level of entropy is not required, set an entropy state associated with the entropy to a lower level of entropy and obtain random data from an entropy source having a lower level of entropy; and responsive to a determination that a higher level of entropy is required, switch an entropy state associated with the entropy to a higher level of entropy and obtain random data from an entropy source having a higher level of entropy.

Abstract: A method, system and program product for performing a trusted boot of a virtual machine comprises the steps of executing, in turn, a series of components of the trusted boot, performing a function on each component prior to the execution of the respective component, storing the output of the functions in a virtual trusted platform module, detecting that the virtual trusted platform module has not responded to the storing of the output of a function in the virtual trusted platform module, and generating a request that the virtual trusted platform module be disabled.

Abstract: A method, system and program product for performing a trusted boot of a virtual machine comprises the steps of executing, in turn, a series of components of the trusted boot, performing a function on each component prior to the execution of the respective component, storing the output of the functions in a virtual trusted platform module, detecting that the virtual trusted platform module has not responded to the storing of the output of a function in the virtual trusted platform module, and generating a request that the virtual trusted platform module be disabled.

Abstract: Systems and methods are described for clipboard intercession of secure applications. Techniques include a method for clipboard intercession comprising: for a first application, the application having a first library that includes a function referencing a first memory location for at least one clipboard command associated with the application, modifying the application such that a second, different memory location is referenced when the function is called for the at least one clipboard command; in response to the first application receiving a copy command, copying first text to the second memory location and not the first memory location; and, in response to a second application receiving a paste command after the first application receives the copy command, referencing the first memory location and not the second memory location such that the first text is not accessed by the second application.

Abstract: Systems, methods and media are provided for selective decryption of files. One method includes monitoring a secure file storage area including at least one file using a selective decryption process associated with the secure file storage area. Content of each of the at least one file is protected with an encryption. The method also includes detecting a request by an application program for one of the at least one file. The method further includes determining whether the application program needs to access the content of the requested file. The method also includes, when it is determined that the application program does not need to access the content of the requested file, allowing the application program to access the file content without decrypting the encryption.

Abstract: The disclosed subject matter includes a method. The method includes determining, by a module running on a computer platform in communication with non-transitory computer readable medium having a plurality of security zones, whether an application instance is in a foreground of a user interface for the computer platform. The method further includes determining, by the module, an alert level associated with the application instance in the foreground of the user interface, wherein the alert level includes at least one of a restriction level and an access level. The method also includes providing the alert level to a user of the computer platform using a visual cue displayed on the user interface.

Abstract: A method, system and program product for performing a trusted boot of a virtual machine comprises the steps of executing, in turn, a series of components of the trusted boot, performing a function on each component prior to the execution of the respective component, storing the output of the functions in a virtual trusted platform module, detecting that the virtual trusted platform module has not responded to the storing of the output of a function in the virtual trusted platform module, and generating a request that the virtual trusted platform module be disabled.

Abstract: A method and apparatus is disclosed for managing encryption keys in a computer system in which in response to the change of a system key the old key and new key are both maintained for subsequent use.

Abstract: The disclosed subject matter includes a method. The method includes identifying an attempt to access, by an application instance running in a user space of an operating system, a first security zone of a computer readable medium, where the first security zone is associated with a first security level. The method further includes determining whether a restriction level associated with the application instance is higher than the first security level, where the restriction level is a function of previous security zones that have been accessed by the application instance. When the restriction level associated with the application instance is higher than the first security level, the method would prevent the application instance from writing to the first security zone. When the restriction level associated with the application instance is not higher than the first security level, the method would authorize the application instance to access the first security zone.

Abstract: Systems, methods and media are provided for selective decryption of files. One method includes monitoring a secure file storage area including at least one file using a selective decryption process associated with the secure file storage area. Content of each of the at least one file is protected with an encryption. The method also includes detecting a request by an application program for one of the at least one file. The method further includes determining whether the application program needs to access the content of the requested file. The method also includes, when it is determined that the application program does not need to access the content of the requested file, allowing the application program to access the file content without decrypting the encryption.

Abstract: The disclosed subject matter includes a method. The method includes determining, by a module running on a computer platform in communication with non-transitory computer readable medium having a plurality of security zones, whether an application instance is in a foreground of a user interface for the computer platform. The method further includes determining, by the module, an alert level associated with the application instance in the foreground of the user interface, wherein the alert level includes at least one of a restriction level and an access level. The method also includes providing the alert level to a user of the computer platform using a visual cue displayed on the user interface.

Abstract: The disclosed subject matter includes a method. The method includes identifying an attempt to access, by an application instance running in a user space of an operating system, a first security zone of a computer readable medium, where the first security zone is associated with a first security level. The method further includes determining whether a restriction level associated with the application instance is higher than the first security level, where the restriction level is a function of previous security zones that have been accessed by the application instance. When the restriction level associated with the application instance is higher than the first security level, the method would prevent the application instance from writing to the first security zone. When the restriction level associated with the application instance is not higher than the first security level, the method would authorize the application instance to access the first security zone.

Abstract: A method, system and program product for performing a trusted boot of a virtual machine comprises the steps of executing, in turn, a series of components of the trusted boot, performing a function on each component prior to the execution of the respective component, storing the output of the functions in a virtual trusted platform module, detecting that the virtual trusted platform module has not responded to the storing of the output of a function in the virtual trusted platform module, and generating a request that the virtual trusted platform module be disabled.

Abstract: An apparatus for balancing consumption of random data, comprising an entropy manager operable to: responsive to receipt of a request for random data, monitor one or more events associated with a plurality of entities and access one or more rules; determine whether a higher level of entropy associated with the random data is required by analysing the one or more events in accordance with the one or more rules; responsive to a determination that a higher level of entropy is not required, set an entropy state associated with the entropy to a lower level of entropy and obtain random data from an entropy source having a lower level of entropy; and responsive to a determination that a higher level of entropy is required, switch an entropy state associated with the entropy to a higher level of entropy and obtain random data from an entropy source having a higher level of entropy.

Abstract: A method and apparatus is disclosed for managing encryption keys in a computer system in which in response to the change of a system key the old key and new key are both maintained for subsequent use.