A technique includes creating, by a computer, a sandboxed user account on the computer, where creating the sandboxed user account includes generating credentials for the sandboxed user account. The technique includes creating, by the computer, an operating system session and executing a single sign on (SSO) tool in the operating system session in association with the sandboxed user account. In response to a request that is associated with another user account to start up an application, authorizing, by the computer, use of the application by the other user account based on credentials that are associated with the other user account and starting up the application by the computer. Starting up the application includes using the SSO tool to inject SSO credentials for the other user account based on policy authorization into the application such that the application is executed in association with the sandboxed user account.

Technologies for untrusted code execution include a computing device having a processor with sandbox support. The computing device executes code included in a native domain in a non-privileged, native processor mode. The computing device may invoke a sandbox jump processor instruction during execution of the code in the native domain to enter a sandbox domain. The computing device executes code in the sandbox domain in a non-privileged, sandbox processor mode in response to invoking the sandbox jump instruction. While executing in the sandbox processor mode, the processor denies access to memory outside of the sandbox domain and may deny execution of one or more prohibited instructions. From the sandbox domain, the computing device may execute a sandbox exit instruction to exit the sandbox domain and resume execution in the native domain. The computing device may execute processor instructions to configure the sandbox domain. Other embodiments are described and claimed.

Methods, apparatus, systems, and articles of manufacture are disclosed to defend against dynamic-link library (DLL) side-loading attacks. An example apparatus includes a fingerprint generator to determine a first DLL fingerprint of a first DLL stored at a first OS path referenced by an operating system (OS) event generated by a computing device, and, in response to determining that a second DLL having the same name as the first DLL is stored at a second OS path superseding the first OS path, determine a second DLL fingerprint of the second DLL, a fingerprint comparator to determine whether at least one of the first or the second DLL fingerprint satisfies a deviation threshold based on a comparison of the first and the second DLL fingerprint to a reference DLL fingerprint, and a security action enforcer to execute a security action to protect a computing device from an attack.

There is provided a user device including a transceiver, a processor, and a memory. The memory stores a device management application (DMA) arranged to disable at least one function of the user device in accordance with an operative device policy state of the user device, and a device policy schedule comprising a queue of device policy states each having an associated respective set of policy data. Responsive to receiving, from a remote system via the transceiver, first synchronisation data indicating a first device policy state in the queue of device policy states, the DMA is arranged to update the operative device policy state of the user device to the indicated first device policy state.

A method for operating a web server implemented on a computer, wherein in a launch phase, a web server process ignores requests from clients and a further process having elevated permissions of the web server process is started by the web server process, where the further process serves to execute actions with access to a predefined operating system area, following the launch phase, the web server process transitions to normal operation such that when the web server process then receives a request requiring an action with access to the predefined operating system area, the permissibility of the received request is checked by the web server process and in the event of a permissible request, the web server process and the further process communicate, which prompts the further process to execute the action with the required access to the predefined operating system area.

An information processing system includes at least one server and one or more devices communicable with the server through a network. The information processing system includes circuitry configured to: manage a service in association with a device type that can use the service; manage the devices in association with the device type, the devices each being a target device to which a license is to be allocated; and compare a device type associated with the target device to which the license is to be allocated with the device type associated with the service, to determine whether an allocation of the license of the service to the target device is permitted.

A computer system comprising a processor and a memory for storing instructions, that when executed by the processor performs a copy protection method. The copy protection method comprises executing a software loop of a first software application in a first operating system. A first call is executed in the software loop to a code portion. A decrypted code portion of the first software application is executed in a second operating system in response to the first call. The code portion is decrypted in response to a successful validation of the first software application.

An external trusted time source is implemented over a network for conditional access system (CAS)/digital rights management (DRM) client devices. A client device includes untrusted software and a trusted execution environment (TEE) for processing an entitlement management message (EMM) that includes an epoch sequence number (ESN) transmitted from an EMM server using a first network connection. A remaining client key set (CKS) lifetime value is stored and updated in the TEE based on the ESN processed.

A computer system includes a processor and a memory device. The computer system is configured to execute a function that builds a software instance definition object. The software instance definition object includes one or more configuration items, attributes, permissions, and linkages to other objects, which define a software instance. The computer system temporarily stores the software instance definition object in the memory device. The computer system updates at least one of the configuration items, attributes, permissions, and linkages to other objects of the stored software instance definition object, thereby creating an updated software instance definition object. A fix command is then executed to update the software instance based on the updated software instance definition object, thereby creating an updated software instance. After creating the updated software instance, the software instance definition object is deleted from the memory device.

An apparatus, method, and system for curtailing and investigating software piracy is provided. The method includes spawning user applications on a computer without use of a file on the file system. A protected application data source is retrieved by an operating system of the computer from a server and placed into a portion of memory not accessible by at least one application. The operating system also prevents the protected application data source from being written to the file system. In this manner there is no file subject to unauthorized distribution. The protected application data may also be watermarked by ordering at least one of executable functions, function call parameters, and program data according to a license identifier so that any two versions execute the same, but carry an identifier which can be used to trace piracy to the source.