Technologies disclosed herein provide cryptographic computing with cryptographically encoded pointers in multi-tenant environments. An example method comprises executing, by a trusted runtime, first instructions to generate a first address key for a private memory region in the memory and generate a first cryptographically encoded pointer to the private memory region in the memory. Generating the first cryptographically encoded pointer includes storing first context information associated with the private memory region in first bits of the first cryptographically encoded pointer and performing a cryptographic algorithm on a slice of a first linear address of the private memory region based, at least in part, on the first address key and a first tweak, the first tweak including the first context information. The method further includes permitting a first tenant in the multi-tenant environment to access the first address key and the first cryptographically encoded pointer to the private memory region.

Technologies disclosed herein provide cryptographic computing with cryptographically encoded pointers in multi-tenant environments. An example method comprises executing, by a trusted runtime, first instructions to generate a first address key for a private memory region in the memory and generate a first cryptographically encoded pointer to the private memory region in the memory. Generating the first cryptographically encoded pointer includes storing first context information associated with the private memory region in first bits of the first cryptographically encoded pointer and performing a cryptographic algorithm on a slice of a first linear address of the private memory region based, at least in part, on the first address key and a first tweak, the first tweak including the first context information. The method further includes permitting a first tenant in the multi-tenant environment to access the first address key and the first cryptographically encoded pointer to the private memory region.

In general, the invention relates to a method for managing data. The method includes obtaining a data set from a local data system, identifying an audit tag associated with the data set, generating a table entry for a data registration table based on the data set and the audit tag, and storing the table entry in the data registration table, wherein the data registration table is stored in a data tracking service.

In one implementation, a method for automatically generating a security policy for a controller includes receiving, by a security policy generation system and from a controller development environment, code for a device controller; selecting middleware that enforces a security policy; analyzing the code for the device controller; based at least in part on the analyzing, automatically generating the security policy; and providing the selected middleware along with the generated security policy.

A method for operating an electronic control unit (ECU) includes a normal mode and a protected mode. In the protected mode a new security artifact is stored in a microcontroller. The security artifact is transferred from the microcontroller to a microprocessor, and, after having received the security artifact, the microprocessor uses the security artifact for authenticating a program.

A method for operating an electronic control unit (ECU) includes a normal mode and a protected mode. In the protected mode a new security artifact is stored in a microcontroller. The security artifact is transferred from the microcontroller to a microprocessor, and, after having received the security artifact, the microprocessor uses the security artifact for authenticating a program.

In one implementation, a method for automatically generating a security policy for a controller includes receiving, by a security policy generation system and from a controller development environment, code for a device controller; selecting middleware that enforces a security policy; analyzing the code for the device controller; based at least in part on the analyzing, automatically generating the security policy; and providing the selected middleware along with the generated security policy.

A method includes receiving a request from an internet content provider to provide data about a subscriber associated with an IP address, where the data allows the internet content provider to maintain stateful and persistent information about an HTTP session with a user endpoint device associated with the IP address determining whether the Internet content provider is a trusted Internet content provider pre-authorized to receive at least some of the data about the subscriber, determining a subset of the data about the subscriber that is allowed to be shared with the Internet content provider, when the Internet content provider is determined to be a trusted Internet content provider, providing the subset of the data to the Internet content provider, when the subset of the data is determined, and denying the request to provide the data, when the Internet content provider is determined not to be a trusted Internet content provider.

Systems, methods and devices are provided for provisioning a computerized device. The system may include a distributor computer that is connected to the computerized device and is operable to receive a first digital asset and transmit it to the computerized device, and a server that is connected to the distributor computer, and that transmits the first digital asset to the distributor computer when a first authorizing condition is met, the first digital asset being configured to cause the computerized device to become partially provisioned, wherein the server transmits a second digital asset to the computerized device, and the computerized device is functional after the second digital asset is transmitted to the computerized device.

Systems, methods and devices are provided for provisioning a computerized device. The system may include a distributor computer that is connected to the computerized device and is operable to receive a first digital asset and transmit it to the computerized device, and a server that is connected to the distributor computer, and that transmits the first digital asset to the distributor computer when a first authorizing condition is met, the first digital asset being configured to cause the computerized device to become partially provisioned, wherein the server transmits a second digital asset to the computerized device, and the computerized device is functional after the second digital asset is transmitted to the computerized device.