Intel Corporation

Mcafee, Inc.

Other

Musarubra US LLC

Ned M Smith

Francesc Guim Bernat

Kshitij Arun Doshi

Rajesh Poornachandran

Nathan Heldt-Sheller

Timothy Verrall

Kapil Sood

Vincent J Zimmer

Micah James Sheller

Karthik Kumar

Igor G Muttik

Alex Nayshtut

Sven Schrecker

S M Iftekharul Alam

Satish Chandra Jha

Suraj Prabhakaran

Michael J Nolan

Willard M Wiseman

Omer Ben-Shalom

Mats Gustav Agerstam

Alexander Bachmutsky

Thomas Willhalm

Mark Y Kelly

Oleg Pogorelik

Conor Patrick Cahill

Jason Martin

William C Deleeuw

Eve M Schooler

David W Grawrock

Srikathyayani Srikanteswara

Simon R Hunt

Glen J Anderson

Hormuzd M Khosravi

Keith Nolan

Kathiravetpillai Sivanesan

Tobias Max Kohlenberg

John Joseph Browne

Evan Custodio

Ravi L Sahita

Vincent R Scarlata

Andrew J Herdrich

Sanjay Bakshi

Alok Kumar

Gregory Burns

Raghu R Kondapalli

Vedvyas Shanbhogue

Christian Maciocco

Shao-Wen Yang

Venkatesan Nallampatti Ekambaram

Zongrui Ding

Reshma Lal

Barry E Huntley

Karanvir S Grewal

Howard C Herbert

Katalin Klara Bartfai-Walcott

Mingqiu Sun

Hassnaa Moustafa

Nitin V Sarangdhar

Maruti Gupta Hyde

David M Durham

Rita H Wouhaybi

Nageen Himayat

Jesse R Walker

Selim Aissi

Geoffrey S Strongin

Arvind A Kumar

Steven L Grobman

Prashant Dewan

Steven E Wells

Saurabh Dadu

Ernie F Brickell

Simon P Johnson

Susanne M Balle

Liuyang L Yang

Bin Xing

Karthik Veeramani

Daniel Nemiroff

Robert W Strong

Stephen T Palermo

John Douglas Teddy

Robert L Vaughn

Andrew Martyn Draper

Vinodh Gopal

Michael A Rothman

Rath Vannithamby

Manoj R Sastry

Qian Li

Yang-Seok Choi

David J Clark

Pradeep M Pappachan

Farid Adrangi

Igor Tatourian

Ioannis T Schoinas

Narayan Biswal

Xin Zeng

Digvijay Ashokkumar Raorane

Vijay Sarathi Kesavan

Jiewen Yao

Joel Robert Spurlock

Geoffrey Cooper

Various approaches for implementing multi-tenant data protection are described. In an edge computing system deployment, a system includes memory and processing circuitry coupled to the memory. The processing circuitry is configured to obtain a workflow execution plan that includes workload metadata defining a plurality of workloads associated with a plurality of edge service instances executing respectively on one or more edge computing devices. The workload metadata is translated to obtain workload configuration information for the plurality of workloads. The workload configuration information identifies a plurality of memory access configurations and service authorizations identifying at least one edge service instance authorized to access one or more of the memory access configurations. The memory is partitioned into a plurality of shared memory regions using the memory access configurations. A memory access request for accessing one of the shared memory regions is processed based on the service authorizations.

Multi-tenant data protection in edge computing environments

A computing device includes a direct memory access (DMA) engine coupled to a memory, a network interface, and processing circuitry. The processing circuitry is to perform a secure exchange with a second computing device to negotiate a shared encryption key, based on a request for data received via the network interface from the second computing device. The DMA engine is to retrieve the data from a storage location based on an encryption command. The encryption command indicates the storage location. The DMA engine is to encrypt the data based on the shared encryption key to generate encrypted data, and store the encrypted data in the memory.

Cryptographic data processing using a DMA engine

Various examples of device and system implementations and methods for performing attestation delegation operations are disclosed. In an example, attestation operations are performed by a verifier, including: obtaining endorsement information for attestation of an entity; obtaining an appraisal policy for evaluation of attestation evidence for the attestation of the entity; determining, based on the endorsement information and the appraisal policy, that delegation to a delegate verifier entity is permitted to perform the attestation of the entity; and providing, to the delegate verifier entity, a delegation command to perform the attestation of the entity, wherein the delegation command authorizes the delegate verifier entity to perform attestation operations (e.g., verifier operations) for a domain of entities including the entity.

Attestation verifier role delegation

Apparatus and methods for data lifecycle management in an edge environment are disclosed herein. An example apparatus includes an operation executor to identify a first operation to be performed for a data object at an edge node in an edge environment and a second operation to be performed for the data object, the first operation different that the second operation. The example apparatus includes a time parameter retriever to retrieve a first time value associated with the first operation from a data source and a second time value associated with the second operation from the data source. The operation executor is to execute the first operation in response to the first time value and to execute the second operation in response to the second time value.

Apparatus, systems, articles of manufacture, and methods for data lifecycle management in an edge environment

Various systems and methods for dynamic access policy provisioning in a connected device framework are described herein. In an example, the techniques for policy provisioning may include resource update access policy automation, directory resource access policy automation, or hidden resources access policy automation, as monitored and operated with an access management service (AMS). In an example, the AMS monitors resources to receive a notification when they change. If the change observed is an addition or deletion of a resource object, the AMS responds by performing security analysis of devices hosting the new resource(s), which may further result in device onboarding actions. The AMS may further respond by evaluating link semantics to determine which other devices and resources may need updated access control list (ACL) policies.

Dynamic access policy provisioning in a device fog

A computing node includes network interface circuitry and processing circuitry. The processing circuitry assigns available computing resources to a plurality of slice contexts. Each slice context of the plurality includes resource allocations of the available computing resources associated with multiple communication networks. A first portion of the resource allocations is designated as dedicated resources and a second, remaining portion is designated as shared resources. A FAFO event associated with a workload is detected. The workload executes on a network slice instance (NSI) associated with a slice context of a subset of slice contexts. The configuration of the NSI is restored to a pre-FAFO event state based on reconfiguring one or both of the dedicated resources or the shared resources of the slice context based on the resource allocations of at least a second slice context in the subset of slice contexts.

End-to-end network slicing (ENS) from ran to core network for next generation (NG) communications

System and techniques for geographic routing are described herein. A node receives a data packet that includes map data, a sequence of geographic areas to a requestor, and a target geographic area. The node may then determine that it is within the target geographic area and start a transmit timer based on a next-hop geographic area. Here, the next-hop geographic area is determined from the sequence of geographic areas in the data packet. The node may then counts how many other nodes from the geographic area sent data packets while the transmit timer is running. When the transmit timer expires, the node may transmit a modified data packet when the number of data packets is less than a predefined threshold. Here, the modified data packet is the data packet updated to include local map data and the next-hop geographic area.

Geographic routing

System and techniques for storage node recruitment in an information centric network (ICN) are described herein. An ICN node receives a storage interest packet that includes an indication differentiating the storage interest from other ICN interests. The ICN node forwards the storage interest packet and receives a storage data packet in response. Here, the storage data packet includes an indication that the storage data packet is not to be cached along with node information for a node that created the storage data packet. The ICN node may then transmit the storage data packet in accordance with a pending interest table (PIT) entry corresponding to the storage interest packet.

Storage node recruitment in an information centric network

Various systems and methods of establishing and providing credential dependency information in RESTful transactions are described. In an example, accessing credential resource dependencies may be performed by a credential management service (CMS) or other server, with operations including: receiving a request for a credential resource in a Representation State Transfer (RESTful) communication; identifying the credential resource which has a credential path that indicates a dependency associated with a credential; identifying dependency characteristics of the credential resource, based on the dependency; populating the credential resource to include a dependent credential, based on the dependency characteristics; and transmitting the populated credential resource in response to the request. In further examples, the credential resource and the credential path within the credential resource may be established, such as by defining paths to trust anchor entries, or dependencies to a trusted computing key of a trusted computing module that attests to trust properties.

Credential dependency encoding and verification based on other credential resources

Methods, apparatuses and system provide for technology that interleaves a plurality of verification commands with a plurality of copy commands in a command buffer, wherein each copy command includes a message authentication code (MAC) derived from a master session key, wherein one or more of the plurality of verification commands corresponds to a copy command in the plurality of copy commands, and wherein a verification command at an end of the command buffer corresponds to contents of the command buffer. The technology may also add a MAC generation command to the command buffer, wherein the MAC generation command references an address of a compute result.

Graphics security with synergistic encryption, content-based and resource management technology

System and techniques for decentralized key generation and management are described herein. An information centric network (ICN) node receives a first ICN interest packet for public encryption parameters of an identity based encryption (IBE) key generation center (KGC). Public encryption parameters for the KGC are received in a first ICN data packet in response to the first ICN interest packet. The public encryption parameters are cached and used to respond a second ICN interest packet for the public parameters. A third ICN data packet may be received from the KGC in response to a key generation request. Here, the third data packet includes an indication that the third ICN data packet is part of a one-time session. Then, the third ICN data packet is transmitted without caching the third ICN data packet content based on the indication.

Decentralized key generation and management

An apparatus for an S-BS includes processing circuitry configured to decode configuration signaling from a plurality of S-UEs. The configuration signaling indicates an interference level at each of the plurality of S-UEs from transmissions of an M-BS. An S-UE is selected based on a comparison of the interference level at each S-UE with an interference threshold of each S-UE. Control signaling is encoded for transmission to the selected S-UE via a small cell access (S-AC) communication link. The control signaling is transmitted during the reception of downlink data from the M-BS via a primary backhaul communication link.

Full duplex communications in wireless networks

Examples herein relate to an interface selectively providing access to a memory region for a work request from an entity by providing selective access to a physical address of the memory region and selective access to a cryptographic key for use by a memory controller to access the memory region. In some examples, providing selective access to a physical address conversion is based on one or more of: validation of a certificate received with the work request and an identifier of the entity being associated with a process with access to the memory region. Access to the memory region can be specified to be one or more of: create, read, update, delete, write, or notify. A memory region can be a page or sub-page sized region. Different access rights can be associated with different sub-portions of the memory region, wherein the access rights comprise one or more of: create, read, update, delete, write, or notify.

Protected data accesses using remote copy operations

A computing node includes interface circuitry and processing circuitry. To implement a spectrum harvesting entity in a wireless network configured for crowdsource-based unlicensed spectrum harvesting, the processing circuitry is configured to select a set of crowdsourcing nodes from a plurality of crowdsourcing nodes available in the wireless network. A plurality of spectrum occupancy reports (SORs) is received from the set of crowdsourcing. Each of the plurality of SORs indicates a channel occupancy status of a communication channel in the unlicensed spectrum sensed by a corresponding crowdsourcing node of the set and geolocation associated with the corresponding crowdsourcing node. A spectrum occupancy map of the unlicensed spectrum is generated based on the channel occupancy status and the geolocation provided in the plurality of SORs by each crowdsourcing node of the set of crowdsourcing nodes.

Unlicensed spectrum harvesting with collaborative spectrum sensing in next generation networks

Methods and systems are provided for securing distributed shares of an electronic wallet. An example method includes provisioning a plurality of devices each hosting an e-wallet share with enhanced privacy identification (EPID) private keys for the e-wallet share. A signature is posted for the e-wallet share to a blockchain. A determination is made as to whether the e-wallet share is compromised, and, if so, posting a revocation list comprising the signature for the e-wallet share to a blockchain.

Securing distributed electronic wallet shares

Growing community of inventors

Beaverton, OR, United States of America

Ned M Smith