Intel Corporation

Priya Rajagopal

David M Durham

Ravi L Sahita

Hormuzd M Khosravi

Uday R Savagaonkar

Travis T Schluessler

Scott D Hahn

Tisson K Mathew

Carlos V Rozas

Arvind A Kumar

James P Kardach

Raj S Yavatkar

Saul Lewites

Carey W Smith

Gerhard W Gross

Ray Steinberger

Arun Preetham

Karanvir (Ken) Grewal

Systems and methods are described herein to provide for secure host resource management on a computing device. Other embodiments include apparatus and system for management of one or more host device drivers from an isolated execution environment. Further embodiments include methods for querying and receiving event data from manageable resources on a host device. Further embodiments include data structures for the reporting of event data from one or more host device drivers to one or more capability modules.

Systems and methods for secure host resource management

Embodiments of apparatuses, articles, methods, and systems for associating identifiers with memory locations for controlling memory accesses are generally described herein. Other embodiments may be described and claimed.

Identifier associated with memory locations for managing memory accesses

A combination of more frequent and less frequent security monitoring may be used to defeat worm or virus attacks. At periodic intervals, a risk assessment scan may be implemented to determine whether or not a worm attack has occurred. Prior thereto, an intermediate detection by an anomaly detection agent may determine whether or not a worm attack may have occurred. If a potential worm attack may have occurred, intermediate action, such as throttling of traffic, may occur. Then, at the next risk assessment scan, a determination may be made as to whether the attack is actually occurring and, if so, more effective and performance altering techniques may be utilized to counter the attack.

Defending against worm or virus attacks on networks

A system and process are described to enable at least one of a plurality of host agents executing on a system to update memory region types of a system memory, register the at least one host agent in a registry stored in system management memory, receive a system management interrupt (SMI) from one of the plurality of host agents to update a memory region type, determine if the host agent issuing the SMI is listed in the registry stored in system management memory, update the memory region in response to determining the host agent issuing the SMI is listed in the registry, and maintain the memory region type in response to determining the host agent issuing the SMI is not listed in the registry.

Validating a memory type modification attempt

An embodiment of the present invention is a technique to protect memory. A memory identifiers storage stores memory identifiers associated with protected components. The memory identifiers include exclusive memory identifiers and shared memory identifiers. The memory identifier storage is protected from access by a host operating system. A memory identifier management service (MMS) manages the memory identifiers. The MMS resides in a protected environment. An access control enforcer (ACE) enforces an access control policy with the memory identifiers.

Operating system agnostic sharing of proteced memory using memory identifiers

Hardware correlation of software performance statistics. Software may gather data relating to performance of a hardware resource. A hardware component of the system of the hardware resource may obtain data relating to the performance of the hardware resource from a hardware component and the gathered software data, and correlate the software and hardware data. A level of correlation may be determined, and remedial action may be taken based on the correlation of the software and hardware data.

Platform-based identification of host software circumvention

Systems and methods are described herein to provide for host virtual memory reconstitution. Virtual memory reconstitution is the ability to translate the host device's virtual memory addresses to the host device's physical memory addresses. The virtual memory reconstitution methods are independent of the operating system running on the host device.

Systems and methods for host virtual memory reconstitution

In one embodiment, a method is provided. The method of this embodiment provides receiving one or more packets that are addressed to an alternate IP (Internet Protocol) address and that include a LADLC (local application data link control) address in a system having an operating system-independent processor ('service processor') associated with the alternate IP address and an alternate DLC address, and an embedded network stack ('ENS') of the service processor associated with a primary IP address; performing filtering to determine if the LADLC address matches the alternate DLC address; and if the LADLC address matches the alternate DLC address, then replacing the alternate IP address of the one or more packets with the primary IP address, and forwarding the one or more packets to the ENS.

Local and remote network based management of an operating system-independent processor

An apparatus and method for a generic, extensible and efficient data manager for virtual peripheral component interconnect devices (VPCIDs). The apparatus includes a data manager and a data repository, where the data manager utilizes the data repository to maintain information for at least one virtual machine (VM). The VM data structure contains elements to associate the VM with zero or more instances of multiple VPCIDs.

Apparatus and method for a generic, extensible and efficient data manager for virtual peripheral component interconnect devices (VPCIDs)

Provided are a method, system, program and device for maintaining shadow page tables in a sequestered memory region. A first processor executing an application invokes a second processor to create a shadow page table used for address translation for the application in a sequestered memory region non-alterable by processes controlled by an operating system executed by the first processor. The shadow page table references at least one page in an operating system memory region accessible to processes controlled by the operating system.

Maintaining shadow page tables in a sequestered memory region

In some embodiments, a method includes generating a prefix trie for a set of patterns, generating a suffix trie for the set of patterns, and establishing respective links between nodes of the prefix trie and respective corresponding nodes of the suffix trie. In some embodiments, a method includes adding a suffix to a suffix tree, so that the suffix (which is at least a portion of a pattern) is represented in the tree by a path that begins at a first node and ends at a second node, and associating with at least the first node and the second node a pattern identifier that identifies the pattern.

Methods and apparatus for detecting patterns in a data stream

A technique for self-isolation of a network device that has been identified as potentially harmful. The network device may be isolated from the network except for an out-of-band communication channel that can be used for management purposes to restore or repair the device prior to the network connection being re-established.

Techniques for self-isolation of networked devices

According to some embodiments, a system provides a resource service module, a resource data record repository, and a provider module. The resource service module exposes an interface, receives an invocation of the interface from a system management module, and requests managed resource data associated with a manageable resource based on the invocation. The resource data record repository includes a resource data record indicating a memory location of a managed host in which the managed resource data is stored, and the provider module receives the request and retrieves the managed resource data from the memory location of the managed host.

Architecture and system for host management

The present disclosure relates to attempting to monitor and control memory access and, more specifically, to attempting to limit memory access to a specific registered software agent.

Growing community of inventors

Hillsboro, OR, United States of America

Priya Rajagopal