Arm IP Limited

Methods and apparatus are described for processing transactions from untrusted sources which reduce the risk of a maliciously instructed transaction being processed at a target environment and thus preventing undesirable behaviour resulting from processing the transaction occurring at the target environment. An execution manager is provided to process transactions/portions of transactions in an emulated environment and monitor the resultant effects. Following execution of the transaction at the emulated environment, it is determined whether undesirable behaviour occurred at the emulated environment and whether the transaction may be executed in the target environment. The method enables transactions from untrusted sources to be processed with minimal risks of malicious consequences occurring at the target environment.

Broadly speaking, the present techniques relate to a machine-implemented method for registering a device with a server, the method performed at the device comprising: applying a data-reducing function to at least one object, object instance, resource and/or resource instance at the device to generate resource data comprising compressed data representative of the at least one object object instance, resource and/or resource instance; transmitting a registration message comprising said resource data to register said device with server.

A technology provides quantified reliance data for at least one of an electronic computing device node and a connection in network, the technology comprising instrumenting at least one of the device and the connection to generate datasets comprising at least one of a device feature vector and a connection feature vector, each feature vector being encoded in a form suitable for transmission over a connection in the network; performing computational inferencing over the datasets to generate quantified reliance data comprising at least one of a trust indicator, a diagnostic indicator and a performance indicator associated with at least one of the device and the connection; and supplying the quantified reliance data in a form usable for selecting an action to be performed, the action being performed by or performed to at least one of the at least one electronic computing device node and the at least one connection.

A trusted device, such as a wristwatch, is provided with authentication circuitry, used to perform an authentication operation to switch the trusted device into an authenticated state. Retention monitoring circuitry monitors the physical possession of the trusted device by the user following the authentication operation and switches the trusted device out of an authenticated state if the trusted device does not remain in the physical possession of the user. While the trusted device remains in the physical possession of the user, communication triggering circuitry is used to detect a request to establish communication with a target device that is one of a plurality of different target devices and communication circuitry is used to communicate with that target device using an authenticated identity of the user.

Broadly speaking, the present techniques relate to a computer implemented method for establishing a secure communication session between a client device and a server resource.

The present techniques generally describe a computer implemented method for establishing a secure communication session between a client device and a first server, the method performed by the client device comprising: obtaining, from a second server, credential data comprising a session identifier and cryptographic key data; performing a connection handshake with the first server to establish the secure communication session; creating a security state record defining one or more parameters used to establish the secure communication session, and associating the session identifier with the security state record; performing a first resumption handshake with the first server using the session identifier to re-establish the secure communication session.

There is provided a data processing apparatus that includes an input policy filter that receives input data and an input provenance that relates to the input data. The filter forwards some or all of the input data and the input provenance according to at least one input policy. A processing environment receives the input data forwarded by the input policy filter and processes the input data to generate output data. A management environment produces an attestation of the processing environment and produces an output provenance based on the input provenance and the attestation. An output policy filter receives the output data and the output provenance and forwards the output data and the output provenance according to at least one output policy.

Broadly speaking, the present techniques relate to a computer implemented method for enabling template-based registration, the method performed by an intermediary apparatus in communication with a first device and a server, the method comprising: receiving, from the first device, a registration request comprising one or more device identifiers for the first device; determining the availability of template information for the first device based on or in response to the one or more device identifiers; when the template information for the first device is unavailable: generating template information for the first device; or requesting, from the server, the template information.

Provided is a technology including an apparatus and a machine-implemented method for operating a content sending apparatus attachable to a network, comprising acquiring a sequence comprising at least two content blocks; generating at least one authentication metadata block comprising at least one signed digest derived by a chaining digest technique from the sequence of content blocks; deriving a content transform encoding for each of the content blocks; and sending the at least one authentication metadata block and at least one content transform encoding to at least one of a set of recipient devices, the at least one device being operable to apply an inverse transformation to the content transform encoding and to authenticate at least one resultant content block according to the authentication metadata block.

A method implemented e.g. in a Lightweight Machine-to-Machine (LwM2M) server, comprises establishing a secure communication session with a client and transmitting an observation request to the client. The observation request identifies a first resource at the client, one or more criteria relating to the first resource to trigger a notification to be transmitted from the client to the server, and one or more resources at the client comprising at least one resource other than the first resource, the value of which is to be included in the notification.