公开(公告)号：US20190012463A1

公开(公告)日：2019-01-10

申请号：US15748788

申请日：2016-08-01

Applicant: ARM IP LIMITED

Inventor： Geraint LUFF ,  Thomas GROCUTT ,  Milosch MERIAC ,  Jonathan AUSTIN

IPC: G06F21/57 ,  G06F21/78 ,  G06F21/74 ,  G06F21/64 ,  H04L12/24

Abstract: A machine-implemented method for controlling a configuration data item in a storage-equipped device having at least two security domains, comprising receiving, by one of the security domains, a configuration data item; storing the configuration data item; providing a security indication for the configuration data item; and when an event indicates untrustworthiness of the data item, invalidating a configuration effect of the stored configuration data item. Further provided is a machine-implemented method for controlling a storage-equipped device as a node in a network of devices, comprising receiving information that a data source or type of a configuration data item is untrusted; analysing metadata for the data source and the configuration data item; populating a knowledge base with analysed metadata; and responsive to the analysed metadata, transmitting security information to the network of devices. A corresponding device and computer program product are also described.

公开(公告)号：US20180225458A1

公开(公告)日：2018-08-09

申请号：US15749169

申请日：2016-07-07

Applicant: ARM IP LIMITED

Inventor： Jonathan AUSTIN ,  Milosch MERIAC ,  Thomas GROCUTT ,  Geraint LUFF

IPC: G06F21/57 ,  G06F21/64 ,  G06F21/74 ,  G06F9/445 ,  G06F21/32

Abstract: A machine-implemented method is provided for securing a storage-equipped device against introduction of malicious configuration data into configuration data storage, the method comprising steps of receiving by the device, a trusted signal for modification of the configuration of the device; responsive to the receiving, placing the device into a restricted mode of operation and at least one of deactivating a service and rebooting the device, responsive to the placing the device into the restricted mode of operation and the deactivating or rebooting, permitting configuration data entry into a restricted portion of the configuration data storage. A corresponding device and computer program product are also described.