Hewlett-packard Development Company, L.p.

Hewlett Packard Enterprise Development LP

Agilent Technologies, Inc.

Patrick Goldsack

Antonio Lain

Adrian John Baldwin

Brian Quentin Monahan

Nigel John Edwards

Marco Casassa Mont

Aled Justin Edwards

Paul Michael Murray

Simon Kai-Ying Shiu

Simon Love

Julio Guijarro

Philipp Reinecke

Suksant Sae Lor

Graham S Pollock

Anna Fischer

Granville Barnett

Evan Randy Kirshenbaum

Chris I Dalton

Michael John Wray

Dean R Thompson

James W Davis

Brian Woodroffe

Jose Maria Alcaraz Calero

Jeremy Peter William Brown

Joseph S Sventek

James Salter

An apparatus comprises a memory to store data and a processor coupled to the memory. The processor may modify a plurality of data elements using a semantic relationship between the plurality of data elements and a pre-selected data security policy and to store data representing the modified plurality of data elements in the memory.

Modification of data elements using a semantic relationship

An example computing device comprises a first processing unit having first capabilities, a second processing unit having second capabilities, and a shared memory accessible by the first processing unit and the second processing unit. The shared memory stores data objects in association with type information indicating the data type of the data objects. The example computing device further comprises an instruction set to, when executed by a processing unit of the computing device, select one of the first processing unit and the second processing unit to perform a computation of a particular type, using data of a particular type stored in the shared memory, wherein the selection is performed based on a predefined affinity of the first processing unit for the particular computation type and/or the particular data type and a predefined affinity of the second processing unit for the particular computation type and/or the particular data type.

Scheduling heterogenous processors

An example system in accordance with an aspect of the present disclosure includes a cache engine, a validate engine, and an access engine. The cache engine is to cache, into an address cache of an object reference, an object address corresponding to an object, in response to performing a lookup of the object via at least one indirection. The validate engine is to validate that an object ID of the object located at the cached object address corresponds to a reference object ID that is stored in the object reference and associated with the object. The access engine is to access the object via a lookup of the object address cached in the address cache of the object reference, in response to validating the reference object ID.

Accessing objects via object references

Examples analyze source code of a task prior to compiling the source code to determine a static property of the task. Examples determine a category for the task based at least in part on the static property. Examples compile the source code to generate a binary of the task. Examples determine execution parameters for the task based at least in part on the category. Examples schedule the binary for execution based at least in part on the execution parameters.

Category based execution scheduling

In one implementation, a data sharing system can comprise a trust engine to identify an environment that satisfies a level of trust, an access engine to request access to a set of data, a procedure engine to receive a procedure, a restriction engine to receive a restriction associated with a resource of the environment, a monitor engine to maintain resource utilization information, and a control engine to limit execution of the procedure based on the restriction and the resource utilization information. In another implementation, a method for sharing a set of data can comprise validating an environment satisfies a level of trust, receiving a restriction associated with a resource of the environment, receiving a procedure to access the set of data, ascertaining resource utilization information, and providing a view of the set of data based on the restriction and the resource utilization information.

Resource restriction

In one implementation, a data sharing system can comprise a trust engine to identify an environment that satisfies a level of trust, an access engine to request access to a set of data, a procedure engine to receive a procedure, a restriction engine to receive a semantic restriction associated with a semantic term of the environment, a tracker engine to track the procedure during execution, and a control engine to maintain execution of the procedure based on the restriction and trace information. In another implementation, a method for sharing a set of data can comprise validating an environment satisfies a level of trust, receiving a procedure to access the set of data, receiving a semantic restriction associated with a semantic term of the environment, tracing the procedure during execution, and providing a view of the set of data based on the restriction and a semantic mapping of trace information.

Semantic restriction

A connection policy for a communications network has a local connection policy indicating which paths between a given one of the nodes (computer A, router A, host) and others of the nodes (computers B, C, filters B, B, C, C, hosts) are allowable paths, by a symbolic expression of ranges endpoint addresses and other local connection policies in respect of other nodes. It is implemented in a distributed manner by determining, for the given node, which of the allowable paths, are dual authorized as allowable by the other local connection policy relating to the other node at the other end of that path, by Boolean operations on the symbolic expressions. For a given message for a given path between two of the nodes having their own local connection policies, both of these nodes determine whether the given path is currently dual authorized. This can provide reassurance that changes in versions of the connection policy won't transiently open a risk of undetected unwanted communication.

Distributed network connection policy management

A system has a virtual overlay infrastructure mapped onto physical resources for processing, storage and network communications, the virtual infrastructure having virtual entities for processing, storage and network communications. Virtual infrastructures of different users share physical resources but are isolated. Each infrastructure has its own infrastructure controller to create and configure the infrastructure. It has a user accessible part (CFC) for configuration of that user's infrastructure, and a user inaccessible part (UFC) able to access the mapping and the physical resources. This increases user control to ease system administration, while maintaining security by limiting access to the mapping.

Controlling virtual overlay infrastructure

The application describes an attestation system () in a cloud computing environment. The authorization system is configured to allow a plurality of users (-) and applications () of the cloud computing environment to issue attestations regarding attributes of other users and applications. The authorization system is also configured to control access to said attestations and to allow a plurality of users and applications of the cloud computing environment to query the authorization system to determine whether a specified user or application has a specified attribute. Methods of controlling access to resources in a cloud computing environment and also of providing secure attestations are also described.

Authorization control

A data center can share processing resources using virtual networks. A hosting programhosts one or more virtual machines. The program has a virtual interface VIF, to the virtual machines, a network interfaceto enable communication between the virtual machines and other nodes of a network, and an infrastructure management interface, invisible to the virtual machines. The program has an intercept functionimplemented as a comparator, switch or router, arranged to intercept a status message from one of the virtual machines, or applications run by that virtual machine. The status indication is sent to a status bufferand is made available to the infrastructure management interface without providing a network path between the management interface and the virtual machine. This can discriminate between VM failure and communication failure, and the invisibility maintains isolation and helps avoid vulnerability to denial of service attack.

Virtual machine liveness determination

A system has a virtual overlay infrastructure mapped onto physical resources for processing, storage and network communications, the virtual infrastructure having virtual entities for processing, storage and network communications. Each virtual infrastructure can be passivated by suspending applications, stopping operating systems, and storing state, to enable later reactivation. This is simpler for a complete virtual infrastructure than for groups of virtual entities and physical entities. It enables cloned virtual infrastructure to be created for testing, upgrading or sharing without risk to the parent. On failure, reversion to a previous working clone is feasible.

Managing virtual overlay infrastructures

A data center can share processing resources using virtual networks. A virtual machine manager () hosts one or more virtual machines (), the virtual machines forming part of a segmented virtual network (). Outgoing messages from the virtual machines have an intermediate destination address of an intermediate node in a local segment of the segmented virtual network, and the virtual machine manager has a router () for determining a new intermediate destination address outside the local segment, for routing the given outgoing message. By having the router as part of the virtual machine manager rather than having only a switch in the virtual machine manager, the need for virtual machines for implementing gateways is avoided. This can reduce the number of 'hops' for the message between virtual entities hosted, and thus improve performance. This can help a service provider to share physical processing resources of a data center between different clients having their own virtual networks.

Routing across a virtual network

A system is provided for disseminating resource allocation information from system resources to state-information observers comprising resource users and typically also at least one system resource manager. Each resource maintains state information about its identity and its allocation to one or more resource users. Each resource provides this information to a state-dissemination arrangement which disseminates it to each state-information observer. Each resource user uses the state information it receives from the state-dissemination arrangement to ascertain the resources allocated to it. Similarly, a system resource manager, when present, uses the state information it receives from the state-dissemination arrangement to ascertain the allocation of those resources that are of interest to the manager. A resource, resource user and resource manager for use in such a system are also provided.

Growing community of inventors

Bristol, United Kingdom

Patrick Goldsack