A server device for managing privilege delegation to control execution of commands thereon is described. Execution of a command, according to first privileges, by a remote management (RM) server on the server device is requested from a RM client on a client device. An agent plug-in, chained to a command execution plug-in of the RM server, intercepts the request and forwards related information to an agent service cooperating with an operating system of the server device. The agent service determines whether to execute the command according to second privileges, different from the first privileges and if permitted, delegates the second privileges to the command, and causes, via the agent plug-in chained to the command execution plug-in, the command to be executed according to the second privileges.

A server device for managing privilege delegation to control execution of commands thereon is described. Execution of a command, according to first privileges, by a remote management (RM) server on the server device is requested from a RM client on a client device. An agent plug-in, chained to a command execution plug-in of the RM server, intercepts the request and forwards related information to an agent service cooperating with an operating system of the server device. The agent service determines whether to execute the command according to second privileges, different from the first privileges and if permitted, delegates the second privileges to the command, and causes, via the agent plug-in chained to the command execution plug-in, the command to be executed according to the second privileges.

Embodiments of the invention are directed to systems, methods, and computer program products for creating an effective baseline for controlling software and programs running on a user device or virtual machine environment of an enterprise network. Historical data may be used to train one or more iterative machine learning processes for intelligently identifying relevant program characteristics and aiding or automating a determination as to a software or program's need, usage, redundancy, or security. Determinations regarding software or program classifications may be used for further review or automated control of software or program execution within a network environment.

An approach is disclosed that enforces restrictions to data in a filesystem based on metadata for a file including a name for an attribute, a type, and a location in the file for the type. A file specific metadata includes an owner, contact information, access rights including an owner consent-based access policy, users of the system who can access the file and the type of access allowed by the users based on a purpose for the access. The operating system (OS) enforces an access to attribute entries of the file based on the purpose and selected metadata in the associated metadata. The restrictions for file access are driven by the file structure metadata which identifies types of information, where in the file each type of information is located, and consent information which specifies what type of information is accessible to a requestor retrieving data for a specific purpose.

A context of one or more interactions is determined. Base objects are transformed into interpreted objects by interpreting the base objects based on evaluation of the context, and by resolving references of the base objects relative to domain model types and concepts, each of the base objects modeled using a same declarative modeling language, the same declarative modeling language enabling transitions between the interpreted objects, at least one of the interpreted objects including at least one post-condition providing hooks for transition policies which allow the at least one of the interpreted objects to be logically chained in a non-linear process. Transitioning between at least two of the interpreted objects by chaining the at least two interpreted objects based on a particular post-condition of a particular interpreted object to create at least a portion of a particular non-linear process. At least a portion of the particular non-linear process is executed.

There is provided a user device including a transceiver, a processor, and a memory. The memory stores a device management application (DMA) arranged to disable at least one function of the user device in accordance with an operative device policy state of the user device, and a device policy schedule comprising a queue of device policy states each having an associated respective set of policy data. Responsive to receiving, from a remote system via the transceiver, first synchronisation data indicating a first device policy state in the queue of device policy states, the DMA is arranged to update the operative device policy state of the user device to the indicated first device policy state.

The present disclosure relates to a system and method for monitoring system calls to an operating system kernel. A performance monitoring unit is used to monitor system calls and to gather information about each system call. The information is gathered upon interrupting the system call and can include system call type, parameters, and information about the calling thread/process, in order to determine whether the system call was generated by malicious software code. Potentially malicious software code is nullified by a malicious code counter-attack module.

An apparatus including a processor and a memory configured to provide an SEE and an REE. The processor is configured to provide a client application configured to execute at a user privilege level and a hypervisor configured to execute at a hypervisor privilege level. The user privilege level is more restrictive than the hypervisor privilege level. The processor is further configured to provide a trusted application configured to execute within the SEE. The trusted application provides secure services to the client application. The processor is configured to send a request for secure services from the client application to the trusted application, send a measurement request to the hypervisor, generate within the hypervisor a measured value based on the client application, return the measured value to the trusted application, and determine whether the client application is authorized to access the secure services. The authorization determination is based on the measured value.

The present disclosure relates to a system and method for monitoring system calls to an operating system kernel. A performance monitoring unit is used to monitor system calls and to gather information about each system call. The information is gathered upon interrupting the system call and can include system call type, parameters, and information about the calling thread/process, in order to determine whether the system call was generated by malicious software code. Potentially malicious software code is nullified by a malicious code counter-attack module.

An external trusted time source is implemented over a network for conditional access system (CAS)/digital rights management (DRM) client devices. A client device includes untrusted software and a trusted execution environment (TEE) for processing an entitlement management message (EMM) that includes an epoch sequence number (ESN) transmitted from an EMM server using a first network connection. A remaining client key set (CKS) lifetime value is stored and updated in the TEE based on the ESN processed.