Intel Corporation

Mcafee, Inc.

Other

Musarubra US LLC

Ned M Smith

Francesc Guim Bernat

Kshitij Arun Doshi

Rajesh Poornachandran

Kapil Sood

Vincent J Zimmer

Karthik Kumar

Satish Chandra Jha

Igor G Muttik

Alex Nayshtut

Thomas Willhalm

Srikathyayani Srikanteswara

Mark Y Kelly

Oleg Pogorelik

David W Grawrock

Glen J Anderson

Hormuzd M Khosravi

John Joseph Browne

Kathiravetpillai Sivanesan

Tobias Max Kohlenberg

Christian Maciocco

Ravi L Sahita

Vincent R Scarlata

Andrew J Herdrich

Vedvyas Shanbhogue

Shao-Wen Yang

Nageen Himayat

Reshma Lal

Barry E Huntley

Karanvir S Grewal

Hassnaa Moustafa

David M Durham

Rita H Wouhaybi

Jesse R Walker

Selim Aissi

Geoffrey S Strongin

Arvind A Kumar

Manoj R Sastry

Prashant Dewan

Vinodh Gopal

Michael A Rothman

Rath Vannithamby

Ren Wang

Steven E Wells

Michael E Kounavis

Qian Li

Yang-Seok Choi

Ignacio Javier Alvarez

Nathan Heldt-Sheller

Timothy Verrall

S M Iftekharul Alam

Micah James Sheller

Sven Schrecker

Suraj Prabhakaran

Michael J Nolan

Mats Gustav Agerstam

Willard M Wiseman

Omer Ben-Shalom

Alexander Bachmutsky

Conor Patrick Cahill

Jason Martin

William C Deleeuw

Simon R Hunt

Keith Nolan

Evan Custodio

Sanjay Bakshi

Alok Kumar

Gregory Burns

Raghu R Kondapalli

Venkatesan Nallampatti Ekambaram

Zongrui Ding

Howard C Herbert

Katalin Klara Bartfai-Walcott

Mingqiu Sun

Nitin V Sarangdhar

Maruti Gupta Hyde

Liuyang L Yang

Ziye Yang

Steven L Grobman

Saurabh Dadu

Ernie F Brickell

Susanne M Balle

Simon P Johnson

Bin Xing

Karthik Veeramani

Xin Zeng

Daniel Nemiroff

Robert W Strong

Robert L Vaughn

Marcio Rogerio Juliato

David J Clark

Pradeep M Pappachan

Farid Adrangi

Ioannis T Schoinas

Igor Tatourian

Narayan Biswal

Ashok Raj

Digvijay Ashokkumar Raorane

Vijay Sarathi Kesavan

Jiewen Yao

The technology described herein includes receiving a first reference integrity manifest (RIM) and a first proto-RIM from a first endorser, the first endorser asserting authority, by the first RIM and the first proto-RIM, to supply first attestation reference values for a computing device; storing the first proto-RIM in a RIM transparency database; notarizing the first proto-RIM; and providing the first RIM and the notarized first proto-RIM to a verifier of the computing device.

Supply chain attestation transparency and authorization

Technologies for accelerated edge data access and physical data security include an edge device that executes services associated with endpoint devices. An address decoder translates a virtual address generated by a service into an edge location using an edge translation table. If the edge location is not local, the edge device may localize the data and update the edge translation table. The edge device may migrate the service to another edge location, including migrating the edge translation table. The edge device may monitor telemetry and determine on a per-tenant basis whether a physical attack condition is present. If present, the edge device instructs a data resource to wipe an associated tenant data range. The determinations to localize remote data, to migrate the service, and/or whether the physical attack condition is present may be performed by an accelerator of the edge device. Other embodiments are described and claimed.

Technologies for accelerated edge data access and physical data security for edge devices

Apparatus, systems, articles of manufacture, and methods are disclosed for generating a data supply chain object. An example non-transitory computer readable storage medium disclosed herein includes data which may be configured into executable instructions and, when configured and executed, cause one or more processors to at least: derive a provenance of a first data supply chain object; identify a first stakeholder from the provenance; determine if the first stakeholder is verified; utilize data associated with the data supply chain when the first stakeholder is verified; build a tag-value structure based on the utilization of the data; build a second data supply chain object based on the tag-value structure and an identity of a second stakeholder; and add the second data supply chain object to the data supply chain.

Decentralized data supply chain provenance

A system is disclosed for quarantining and recovery of a network after an outage or in advance of a potential outage. Unaffected network slices are isolated and recovery is initiated by quarantine physical and virtual network functions. An AI model is trained based on recent events detected by sensors disposed throughout the network to determine whether to quarantine network slices, move services to unaffected network slices, or initiate recovery. Once the network is stabilized, resources that are specifically allocated for recovery and services are released and the traffic moved back to the recovered network slices.

Quarantine control network in a 5G RAN for coordinated multi-layer resiliency of network slice resources

Various systems and methods for enabling derivation and distribution of an attestation manifest for a software update image are described. In an example, these systems and methods include orchestration functions and communications, providing functionality and components for a software update process which also provides verification and attestation among multiple devices and operators.

Attestation manifest derivation and distribution using software update image

An apparatus of an edge gateway disclosed herein includes an access evaluator to determine whether a data access attempt, if permitted, will cause data specified in the data access attempt to cross a data boundary, the data boundary associated with at least one condition to be met before the data specified in the data access attempt will be permitted to cross the boundary. The apparatus further includes an operations determiner to determine an operation to be applied to the data for which access is being attempted, in response to determining the data access attempt will cause the data to cross the data boundary, and an operation applier to apply the operation to the data. The application of the operation to the data causes the condition to be met, so that the data access occurs in conformance with the condition.

Methods, apparatus and systems to enforce data boundaries through the use of boundary labels

Various systems and methods for providing secure and resilient configuration upgrades are described herein. A system, includes a processor; and memory to store instructions, which when executed by the processor, cause the system to: receive at a resilient security island (RSI) partition of a first network node, an update from a source, the first network node hosting the RSI partition and a host partition, the RSI comprising reserved hardware resources of the first network node; verify, by the RSI, provenance of the update; apply, by the RSI, the update to modify a configuration of the RSI or the host partition; test, by the RSI, the modified configuration of the RSI or the host partition; and provide a cryptographic proof that the test was completed and an update status to an update coordinator.

Mechanism for secure and resilient configuration upgrades

Various systems and methods for establishing network connectivity and onboarding for Internet of Things (IoT) devices and trusted platforms, including in Open Connectivity Foundation (OCF) specification device deployments, are discussed. In an example, a zero touch owner transfer method includes operations of: receiving a first request from a new device for network access to begin an onboarding procedure with a network platform; transmitting credentials of a first network to the new device, the first network used to access a rendezvous server and obtain onboarding information associated with the network platform; receiving a second request from the new device for network access to continue the onboarding procedure; and transmitting credentials of a second network to the new device, as the new device uses the second network to access the onboarding server of the network platform and perform or complete the onboarding procedure with the network platform.

Secure device onboarding techniques

An embodiment of an integrated circuit may comprise memory to store respective resource control descriptors in correspondence with respective identifiers, and an input/output (IO) memory management unit (IOMMU) communicatively coupled to the memory, the IOMMU including circuitry to determine resource control information for an IO transaction based on a resource control descriptor stored in the memory that corresponds to an identifier associated with the IO transaction, and control utilization of one or more resources of the IOMMU based on the determined resource control information. Other embodiments are disclosed and claimed.

PASID granularity resource control for IOMMU

Systems, methods, articles of manufacture, and apparatus for end-to-end hardware tracing in an Edge network are disclosed. An example compute device includes at least one memory, instructions in the compute device, and processing circuitry to execute the instructions to, in response to receiving detecting an object having a global group identifier, generate monitoring data corresponding to a respective process executing on the compute device, the monitoring data including a process identifier, index the monitoring data having the process identifier to the corresponding global group identifier, synchronize a time stamp of the monitoring data to a network time protocol corresponding to the global group identifier, and transmit the indexed and synchronized monitoring data as tracing data in to the a tracing datastore.

Systems, methods, articles of manufacture, and apparatus for end-to-end hardware tracing in an edge network

Systems and techniques for storage-class memory device including a network interface are described herein. A write for a network communication is received by the host interface of the memory device. Here, the network communication includes a header. The header is written to a non-volatile storage array managed by a memory controller. A network command is detected by the memory device. Here, the network command includes a pointer to the header in the non-volatile storage array. The header is retrieved from the non-volatile storage array and a packet based on the header is transmitted via a network interface of the memory controller.

Storage class memory device including a network

Methods, apparatus, systems, and articles of manufacture are disclosed for data resiliency in an edge network environment. An example apparatus includes at least one memory, instructions in the apparatus, and processor circuitry to at least one of execute and/or instantiate the instructions to generate spectrum metadata based on spectrum data, determine a resiliency operation based on one or more resiliency requirements, generate a resiliency policy based on at least one of the resiliency operation or the one or more resiliency requirements, generate a resiliency operation map based on at least one of the resiliency policy or first identifiers of respective workloads associated with the network environment, the first identifiers including a second identifier, and, in response to identifying a FAFO event associated with the second identifier, execute the resiliency operation based on mapping the second identifier to the resiliency operation in the resiliency operation map.

Systems, apparatus, and methods for data resiliency in an edge network environment

A digital twin model is generated for physical nodes of an edge network. The digital twin model includes a digital twin for a physical node of the physical nodes. An error is identified of the physical node or the digital twin for the physical node. The digital twin model is updated to halt communication with the physical node or the digital twin of the physical node. A path is created to another physical node or a digital twin of the another physical node in the digital twin model.

Digital twin framework for next generation networks

Various approaches for implementing multi-tenant data protection are described. In an edge computing system deployment, a system includes memory and processing circuitry coupled to the memory. The processing circuitry is configured to obtain a workflow execution plan that includes workload metadata defining a plurality of workloads associated with a plurality of edge service instances executing respectively on one or more edge computing devices. The workload metadata is translated to obtain workload configuration information for the plurality of workloads. The workload configuration information identifies a plurality of memory access configurations and service authorizations identifying at least one edge service instance authorized to access one or more of the memory access configurations. The memory is partitioned into a plurality of shared memory regions using the memory access configurations. A memory access request for accessing one of the shared memory regions is processed based on the service authorizations.

Multi-tenant data protection in edge computing environments

A computing device includes a direct memory access (DMA) engine coupled to a memory, a network interface, and processing circuitry. The processing circuitry is to perform a secure exchange with a second computing device to negotiate a shared encryption key, based on a request for data received via the network interface from the second computing device. The DMA engine is to retrieve the data from a storage location based on an encryption command. The encryption command indicates the storage location. The DMA engine is to encrypt the data based on the shared encryption key to generate encrypted data, and store the encrypted data in the memory.

Cryptographic data processing using a DMA engine

Growing community of inventors

Beaverton, OR, United States of America

Ned M Smith