Intel Corporation

Mcafee, Inc.

Other

Musarubra US LLC

Ned M Smith

Francesc Guim Bernat

Kshitij Arun Doshi

Rajesh Poornachandran

Kapil Sood

Vincent J Zimmer

Karthik Kumar

Satish Chandra Jha

Igor G Muttik

Alex Nayshtut

Thomas Willhalm

Srikathyayani Srikanteswara

Mark Y Kelly

Oleg Pogorelik

David W Grawrock

Glen J Anderson

Hormuzd M Khosravi

John Joseph Browne

Kathiravetpillai Sivanesan

Tobias Max Kohlenberg

Christian Maciocco

Ravi L Sahita

Vincent R Scarlata

Andrew J Herdrich

Vedvyas Shanbhogue

Shao-Wen Yang

Nageen Himayat

Reshma Lal

Barry E Huntley

Karanvir S Grewal

Hassnaa Moustafa

David M Durham

Rita H Wouhaybi

Jesse R Walker

Selim Aissi

Geoffrey S Strongin

Arvind A Kumar

Manoj R Sastry

Prashant Dewan

Steven E Wells

Saurabh Dadu

Vinodh Gopal

Michael A Rothman

Rath Vannithamby

Ren Wang

Nathan Heldt-Sheller

Timothy Verrall

S M Iftekharul Alam

Micah James Sheller

Sven Schrecker

Suraj Prabhakaran

Michael J Nolan

Mats Gustav Agerstam

Willard M Wiseman

Omer Ben-Shalom

Alexander Bachmutsky

Conor Patrick Cahill

Jason Martin

William C Deleeuw

Simon R Hunt

Keith Nolan

Evan Custodio

Sanjay Bakshi

Alok Kumar

Gregory Burns

Raghu R Kondapalli

Zongrui Ding

Venkatesan Nallampatti Ekambaram

Howard C Herbert

Katalin Klara Bartfai-Walcott

Mingqiu Sun

Nitin V Sarangdhar

Maruti Gupta Hyde

Liuyang L Yang

Steven L Grobman

Ernie F Brickell

Susanne M Balle

Simon P Johnson

Bin Xing

Karthik Veeramani

Xin Zeng

Daniel Nemiroff

Robert W Strong

Robert L Vaughn

Stephen T Palermo

Michael E Kounavis

Qian Li

Yang-Seok Choi

David J Clark

Pradeep M Pappachan

Marcio Rogerio Juliato

Ioannis T Schoinas

Farid Adrangi

Igor Tatourian

Narayan Biswal

Ashok Raj

Digvijay Ashokkumar Raorane

Vijay Sarathi Kesavan

Jiewen Yao

Joel Robert Spurlock

A system is disclosed for quarantining and recovery of a network after an outage or in advance of a potential outage. Unaffected network slices are isolated and recovery is initiated by quarantine physical and virtual network functions. An AI model is trained based on recent events detected by sensors disposed throughout the network to determine whether to quarantine network slices, move services to unaffected network slices, or initiate recovery. Once the network is stabilized, resources that are specifically allocated for recovery and services are released and the traffic moved back to the recovered network slices.

Quarantine control network in a 5G RAN for coordinated multi-layer resiliency of network slice resources

Various systems and methods for enabling derivation and distribution of an attestation manifest for a software update image are described. In an example, these systems and methods include orchestration functions and communications, providing functionality and components for a software update process which also provides verification and attestation among multiple devices and operators.

Attestation manifest derivation and distribution using software update image

An apparatus of an edge gateway disclosed herein includes an access evaluator to determine whether a data access attempt, if permitted, will cause data specified in the data access attempt to cross a data boundary, the data boundary associated with at least one condition to be met before the data specified in the data access attempt will be permitted to cross the boundary. The apparatus further includes an operations determiner to determine an operation to be applied to the data for which access is being attempted, in response to determining the data access attempt will cause the data to cross the data boundary, and an operation applier to apply the operation to the data. The application of the operation to the data causes the condition to be met, so that the data access occurs in conformance with the condition.

Methods, apparatus and systems to enforce data boundaries through the use of boundary labels

Various systems and methods for providing secure and resilient configuration upgrades are described herein. A system, includes a processor; and memory to store instructions, which when executed by the processor, cause the system to: receive at a resilient security island (RSI) partition of a first network node, an update from a source, the first network node hosting the RSI partition and a host partition, the RSI comprising reserved hardware resources of the first network node; verify, by the RSI, provenance of the update; apply, by the RSI, the update to modify a configuration of the RSI or the host partition; test, by the RSI, the modified configuration of the RSI or the host partition; and provide a cryptographic proof that the test was completed and an update status to an update coordinator.

Mechanism for secure and resilient configuration upgrades

Various systems and methods for establishing network connectivity and onboarding for Internet of Things (IoT) devices and trusted platforms, including in Open Connectivity Foundation (OCF) specification device deployments, are discussed. In an example, a zero touch owner transfer method includes operations of: receiving a first request from a new device for network access to begin an onboarding procedure with a network platform; transmitting credentials of a first network to the new device, the first network used to access a rendezvous server and obtain onboarding information associated with the network platform; receiving a second request from the new device for network access to continue the onboarding procedure; and transmitting credentials of a second network to the new device, as the new device uses the second network to access the onboarding server of the network platform and perform or complete the onboarding procedure with the network platform.

Secure device onboarding techniques

An embodiment of an integrated circuit may comprise memory to store respective resource control descriptors in correspondence with respective identifiers, and an input/output (IO) memory management unit (IOMMU) communicatively coupled to the memory, the IOMMU including circuitry to determine resource control information for an IO transaction based on a resource control descriptor stored in the memory that corresponds to an identifier associated with the IO transaction, and control utilization of one or more resources of the IOMMU based on the determined resource control information. Other embodiments are disclosed and claimed.

PASID granularity resource control for IOMMU

Systems, methods, articles of manufacture, and apparatus for end-to-end hardware tracing in an Edge network are disclosed. An example compute device includes at least one memory, instructions in the compute device, and processing circuitry to execute the instructions to, in response to receiving detecting an object having a global group identifier, generate monitoring data corresponding to a respective process executing on the compute device, the monitoring data including a process identifier, index the monitoring data having the process identifier to the corresponding global group identifier, synchronize a time stamp of the monitoring data to a network time protocol corresponding to the global group identifier, and transmit the indexed and synchronized monitoring data as tracing data in to the a tracing datastore.

Systems, methods, articles of manufacture, and apparatus for end-to-end hardware tracing in an edge network

Systems and techniques for storage-class memory device including a network interface are described herein. A write for a network communication is received by the host interface of the memory device. Here, the network communication includes a header. The header is written to a non-volatile storage array managed by a memory controller. A network command is detected by the memory device. Here, the network command includes a pointer to the header in the non-volatile storage array. The header is retrieved from the non-volatile storage array and a packet based on the header is transmitted via a network interface of the memory controller.

Storage class memory device including a network

Methods, apparatus, systems, and articles of manufacture are disclosed for data resiliency in an edge network environment. An example apparatus includes at least one memory, instructions in the apparatus, and processor circuitry to at least one of execute and/or instantiate the instructions to generate spectrum metadata based on spectrum data, determine a resiliency operation based on one or more resiliency requirements, generate a resiliency policy based on at least one of the resiliency operation or the one or more resiliency requirements, generate a resiliency operation map based on at least one of the resiliency policy or first identifiers of respective workloads associated with the network environment, the first identifiers including a second identifier, and, in response to identifying a FAFO event associated with the second identifier, execute the resiliency operation based on mapping the second identifier to the resiliency operation in the resiliency operation map.

Systems, apparatus, and methods for data resiliency in an edge network environment

A digital twin model is generated for physical nodes of an edge network. The digital twin model includes a digital twin for a physical node of the physical nodes. An error is identified of the physical node or the digital twin for the physical node. The digital twin model is updated to halt communication with the physical node or the digital twin of the physical node. A path is created to another physical node or a digital twin of the another physical node in the digital twin model.

Digital twin framework for next generation networks

Various approaches for implementing multi-tenant data protection are described. In an edge computing system deployment, a system includes memory and processing circuitry coupled to the memory. The processing circuitry is configured to obtain a workflow execution plan that includes workload metadata defining a plurality of workloads associated with a plurality of edge service instances executing respectively on one or more edge computing devices. The workload metadata is translated to obtain workload configuration information for the plurality of workloads. The workload configuration information identifies a plurality of memory access configurations and service authorizations identifying at least one edge service instance authorized to access one or more of the memory access configurations. The memory is partitioned into a plurality of shared memory regions using the memory access configurations. A memory access request for accessing one of the shared memory regions is processed based on the service authorizations.

Multi-tenant data protection in edge computing environments

A computing device includes a direct memory access (DMA) engine coupled to a memory, a network interface, and processing circuitry. The processing circuitry is to perform a secure exchange with a second computing device to negotiate a shared encryption key, based on a request for data received via the network interface from the second computing device. The DMA engine is to retrieve the data from a storage location based on an encryption command. The encryption command indicates the storage location. The DMA engine is to encrypt the data based on the shared encryption key to generate encrypted data, and store the encrypted data in the memory.

Cryptographic data processing using a DMA engine

Various examples of device and system implementations and methods for performing attestation delegation operations are disclosed. In an example, attestation operations are performed by a verifier, including: obtaining endorsement information for attestation of an entity; obtaining an appraisal policy for evaluation of attestation evidence for the attestation of the entity; determining, based on the endorsement information and the appraisal policy, that delegation to a delegate verifier entity is permitted to perform the attestation of the entity; and providing, to the delegate verifier entity, a delegation command to perform the attestation of the entity, wherein the delegation command authorizes the delegate verifier entity to perform attestation operations (e.g., verifier operations) for a domain of entities including the entity.

Attestation verifier role delegation

Apparatus and methods for data lifecycle management in an edge environment are disclosed herein. An example apparatus includes an operation executor to identify a first operation to be performed for a data object at an edge node in an edge environment and a second operation to be performed for the data object, the first operation different that the second operation. The example apparatus includes a time parameter retriever to retrieve a first time value associated with the first operation from a data source and a second time value associated with the second operation from the data source. The operation executor is to execute the first operation in response to the first time value and to execute the second operation in response to the second time value.

Apparatus, systems, articles of manufacture, and methods for data lifecycle management in an edge environment

Various systems and methods for dynamic access policy provisioning in a connected device framework are described herein. In an example, the techniques for policy provisioning may include resource update access policy automation, directory resource access policy automation, or hidden resources access policy automation, as monitored and operated with an access management service (AMS). In an example, the AMS monitors resources to receive a notification when they change. If the change observed is an addition or deletion of a resource object, the AMS responds by performing security analysis of devices hosting the new resource(s), which may further result in device onboarding actions. The AMS may further respond by evaluating link semantics to determine which other devices and resources may need updated access control list (ACL) policies.

Dynamic access policy provisioning in a device fog

Growing community of inventors

Beaverton, OR, United States of America

Ned M Smith