Intel Corporation

Mcafee, Inc.

Other

Musarubra US LLC

Ned M Smith

Francesc Guim Bernat

Kshitij Arun Doshi

Rajesh Poornachandran

Kapil Sood

Vincent J Zimmer

Karthik Kumar

Satish Chandra Jha

Igor G Muttik

Alex Nayshtut

Thomas Willhalm

Mark Y Kelly

Srikathyayani Srikanteswara

Oleg Pogorelik

David W Grawrock

Glen J Anderson

Hormuzd M Khosravi

Kathiravetpillai Sivanesan

Tobias Max Kohlenberg

John Joseph Browne

Ravi L Sahita

Vincent R Scarlata

Christian Maciocco

Andrew J Herdrich

Vedvyas Shanbhogue

Shao-Wen Yang

Nageen Himayat

Reshma Lal

Barry E Huntley

Karanvir S Grewal

Hassnaa Moustafa

David M Durham

Rita H Wouhaybi

Jesse R Walker

Selim Aissi

Geoffrey S Strongin

Arvind A Kumar

Prashant Dewan

Steven E Wells

Vinodh Gopal

Michael A Rothman

Rath Vannithamby

Manoj R Sastry

Ren Wang

Nathan Heldt-Sheller

Timothy Verrall

Micah James Sheller

S M Iftekharul Alam

Sven Schrecker

Suraj Prabhakaran

Michael J Nolan

Mats Gustav Agerstam

Willard M Wiseman

Omer Ben-Shalom

Alexander Bachmutsky

Conor Patrick Cahill

Jason Martin

William C Deleeuw

Simon R Hunt

Keith Nolan

Evan Custodio

Sanjay Bakshi

Alok Kumar

Gregory Burns

Raghu R Kondapalli

Zongrui Ding

Venkatesan Nallampatti Ekambaram

Howard C Herbert

Katalin Klara Bartfai-Walcott

Mingqiu Sun

Avishay Sharaga

Nitin V Sarangdhar

Maruti Gupta Hyde

Liuyang L Yang

Ziye Yang

Saurabh Dadu

Ernie F Brickell

Susanne M Balle

Simon P Johnson

Bin Xing

Karthik Veeramani

Xin Zeng

Daniel Nemiroff

Robert W Strong

Robert L Vaughn

Stephen T Palermo

Michael E Kounavis

Qian Li

Yang-Seok Choi

David J Clark

Pradeep M Pappachan

Ioannis T Schoinas

Farid Adrangi

Igor Tatourian

Narayan Biswal

Ashok Raj

Digvijay Ashokkumar Raorane

Vijay Sarathi Kesavan

Jiewen Yao

Joel Robert Spurlock

Various systems and methods for providing secure and resilient configuration upgrades are described herein. A system, includes a processor; and memory to store instructions, which when executed by the processor, cause the system to: receive at a resilient security island (RSI) partition of a first network node, an update from a source, the first network node hosting the RSI partition and a host partition, the RSI comprising reserved hardware resources of the first network node; verify, by the RSI, provenance of the update; apply, by the RSI, the update to modify a configuration of the RSI or the host partition; test, by the RSI, the modified configuration of the RSI or the host partition; and provide a cryptographic proof that the test was completed and an update status to an update coordinator.

Mechanism for secure and resilient configuration upgrades

Various systems and methods for establishing network connectivity and onboarding for Internet of Things (IoT) devices and trusted platforms, including in Open Connectivity Foundation (OCF) specification device deployments, are discussed. In an example, a zero touch owner transfer method includes operations of: receiving a first request from a new device for network access to begin an onboarding procedure with a network platform; transmitting credentials of a first network to the new device, the first network used to access a rendezvous server and obtain onboarding information associated with the network platform; receiving a second request from the new device for network access to continue the onboarding procedure; and transmitting credentials of a second network to the new device, as the new device uses the second network to access the onboarding server of the network platform and perform or complete the onboarding procedure with the network platform.

Secure device onboarding techniques

An embodiment of an integrated circuit may comprise memory to store respective resource control descriptors in correspondence with respective identifiers, and an input/output (IO) memory management unit (IOMMU) communicatively coupled to the memory, the IOMMU including circuitry to determine resource control information for an IO transaction based on a resource control descriptor stored in the memory that corresponds to an identifier associated with the IO transaction, and control utilization of one or more resources of the IOMMU based on the determined resource control information. Other embodiments are disclosed and claimed.

PASID granularity resource control for IOMMU

Systems, methods, articles of manufacture, and apparatus for end-to-end hardware tracing in an Edge network are disclosed. An example compute device includes at least one memory, instructions in the compute device, and processing circuitry to execute the instructions to, in response to receiving detecting an object having a global group identifier, generate monitoring data corresponding to a respective process executing on the compute device, the monitoring data including a process identifier, index the monitoring data having the process identifier to the corresponding global group identifier, synchronize a time stamp of the monitoring data to a network time protocol corresponding to the global group identifier, and transmit the indexed and synchronized monitoring data as tracing data in to the a tracing datastore.

Systems, methods, articles of manufacture, and apparatus for end-to-end hardware tracing in an edge network

Systems and techniques for storage-class memory device including a network interface are described herein. A write for a network communication is received by the host interface of the memory device. Here, the network communication includes a header. The header is written to a non-volatile storage array managed by a memory controller. A network command is detected by the memory device. Here, the network command includes a pointer to the header in the non-volatile storage array. The header is retrieved from the non-volatile storage array and a packet based on the header is transmitted via a network interface of the memory controller.

Storage class memory device including a network

Methods, apparatus, systems, and articles of manufacture are disclosed for data resiliency in an edge network environment. An example apparatus includes at least one memory, instructions in the apparatus, and processor circuitry to at least one of execute and/or instantiate the instructions to generate spectrum metadata based on spectrum data, determine a resiliency operation based on one or more resiliency requirements, generate a resiliency policy based on at least one of the resiliency operation or the one or more resiliency requirements, generate a resiliency operation map based on at least one of the resiliency policy or first identifiers of respective workloads associated with the network environment, the first identifiers including a second identifier, and, in response to identifying a FAFO event associated with the second identifier, execute the resiliency operation based on mapping the second identifier to the resiliency operation in the resiliency operation map.

Systems, apparatus, and methods for data resiliency in an edge network environment

A digital twin model is generated for physical nodes of an edge network. The digital twin model includes a digital twin for a physical node of the physical nodes. An error is identified of the physical node or the digital twin for the physical node. The digital twin model is updated to halt communication with the physical node or the digital twin of the physical node. A path is created to another physical node or a digital twin of the another physical node in the digital twin model.

Digital twin framework for next generation networks

Various approaches for implementing multi-tenant data protection are described. In an edge computing system deployment, a system includes memory and processing circuitry coupled to the memory. The processing circuitry is configured to obtain a workflow execution plan that includes workload metadata defining a plurality of workloads associated with a plurality of edge service instances executing respectively on one or more edge computing devices. The workload metadata is translated to obtain workload configuration information for the plurality of workloads. The workload configuration information identifies a plurality of memory access configurations and service authorizations identifying at least one edge service instance authorized to access one or more of the memory access configurations. The memory is partitioned into a plurality of shared memory regions using the memory access configurations. A memory access request for accessing one of the shared memory regions is processed based on the service authorizations.

Multi-tenant data protection in edge computing environments

A computing device includes a direct memory access (DMA) engine coupled to a memory, a network interface, and processing circuitry. The processing circuitry is to perform a secure exchange with a second computing device to negotiate a shared encryption key, based on a request for data received via the network interface from the second computing device. The DMA engine is to retrieve the data from a storage location based on an encryption command. The encryption command indicates the storage location. The DMA engine is to encrypt the data based on the shared encryption key to generate encrypted data, and store the encrypted data in the memory.

Cryptographic data processing using a DMA engine

Various examples of device and system implementations and methods for performing attestation delegation operations are disclosed. In an example, attestation operations are performed by a verifier, including: obtaining endorsement information for attestation of an entity; obtaining an appraisal policy for evaluation of attestation evidence for the attestation of the entity; determining, based on the endorsement information and the appraisal policy, that delegation to a delegate verifier entity is permitted to perform the attestation of the entity; and providing, to the delegate verifier entity, a delegation command to perform the attestation of the entity, wherein the delegation command authorizes the delegate verifier entity to perform attestation operations (e.g., verifier operations) for a domain of entities including the entity.

Attestation verifier role delegation

Apparatus and methods for data lifecycle management in an edge environment are disclosed herein. An example apparatus includes an operation executor to identify a first operation to be performed for a data object at an edge node in an edge environment and a second operation to be performed for the data object, the first operation different that the second operation. The example apparatus includes a time parameter retriever to retrieve a first time value associated with the first operation from a data source and a second time value associated with the second operation from the data source. The operation executor is to execute the first operation in response to the first time value and to execute the second operation in response to the second time value.

Apparatus, systems, articles of manufacture, and methods for data lifecycle management in an edge environment

Various systems and methods for dynamic access policy provisioning in a connected device framework are described herein. In an example, the techniques for policy provisioning may include resource update access policy automation, directory resource access policy automation, or hidden resources access policy automation, as monitored and operated with an access management service (AMS). In an example, the AMS monitors resources to receive a notification when they change. If the change observed is an addition or deletion of a resource object, the AMS responds by performing security analysis of devices hosting the new resource(s), which may further result in device onboarding actions. The AMS may further respond by evaluating link semantics to determine which other devices and resources may need updated access control list (ACL) policies.

Dynamic access policy provisioning in a device fog

A computing node includes network interface circuitry and processing circuitry. The processing circuitry assigns available computing resources to a plurality of slice contexts. Each slice context of the plurality includes resource allocations of the available computing resources associated with multiple communication networks. A first portion of the resource allocations is designated as dedicated resources and a second, remaining portion is designated as shared resources. A FAFO event associated with a workload is detected. The workload executes on a network slice instance (NSI) associated with a slice context of a subset of slice contexts. The configuration of the NSI is restored to a pre-FAFO event state based on reconfiguring one or both of the dedicated resources or the shared resources of the slice context based on the resource allocations of at least a second slice context in the subset of slice contexts.

End-to-end network slicing (ENS) from ran to core network for next generation (NG) communications

System and techniques for geographic routing are described herein. A node receives a data packet that includes map data, a sequence of geographic areas to a requestor, and a target geographic area. The node may then determine that it is within the target geographic area and start a transmit timer based on a next-hop geographic area. Here, the next-hop geographic area is determined from the sequence of geographic areas in the data packet. The node may then counts how many other nodes from the geographic area sent data packets while the transmit timer is running. When the transmit timer expires, the node may transmit a modified data packet when the number of data packets is less than a predefined threshold. Here, the modified data packet is the data packet updated to include local map data and the next-hop geographic area.

Geographic routing

System and techniques for storage node recruitment in an information centric network (ICN) are described herein. An ICN node receives a storage interest packet that includes an indication differentiating the storage interest from other ICN interests. The ICN node forwards the storage interest packet and receives a storage data packet in response. Here, the storage data packet includes an indication that the storage data packet is not to be cached along with node information for a node that created the storage data packet. The ICN node may then transmit the storage data packet in accordance with a pending interest table (PIT) entry corresponding to the storage interest packet.

Storage node recruitment in an information centric network

Growing community of inventors

Beaverton, OR, United States of America

Ned M Smith