Cisco Technology, Inc.

Steven Joseph Rich

Mark W Eklund

Robert T Bell

Robert L Sargent

Gregory Weber

Scott K Reed

David A McGrew

Fabio Rodolfo Maino

Pere Monclus

Chris A Shenefiel

William Michael Hudson, Jr

Jared B Pendleton

Richard Brian Livingston

John D White

David A Mcgrew

According to certain embodiments, a method comprises monitoring a request for use of memory requested by a container manager application on behalf of a given one of a plurality of containers during runtime of the given container. The method further comprises determining that the request for use of memory has caused an exception. The exception indicates that the request has requested an invalid operation on a memory table or that the request has requested a previously not seen memory table. In response, the method further comprises determining an action to perform. The action depends on both first trustworthiness information associated with the given container and second trustworthiness information associated with the given container. The first trustworthiness information is obtained from a Third Party Reputation Service (TPRS). The second trustworthiness information is obtained based on monitoring the runtime behavior of the given container.

Runtime container protection

Traffic cone

Techniques are described for securely booting and executing a virtual machine (VM) image in an untrusted cloud infrastructure. A multi-core processor may be configured with additional hardware components&#x2014;referred to as a trust anchor. The trust anchor may be provisioned with a private/public key pair, which allows the multi-core CPU to authenticate itself as being able to securely boot and execute a virtual machine (VM) image in an untrusted cloud infrastructure.

Secure virtual machine bootstrap in untrusted cloud infrastructures

An example method is provided and includes providing an encrypted image to a central processing unit of an integrated circuit and decrypting the encrypted image using a cryptographic key element. The cryptographic key element is embedded within the integrated circuit. The method also includes evaluating the decrypted image in order to verify its authenticity, and executing the decrypted image if the decrypted image is successfully verified. In more particular embodiments, the verification includes utilizing an executable and linkable format (ELF) to signify that encryption has been enabled for at least a portion of the encrypted image. A processor within the integrated circuit can be provided with the cryptographic key element that corresponds to a product family of devices. The method can also include providing a corresponding image of the decrypted image to an external memory of the integrated circuit.

System and method for executing encrypted binaries in a cryptographic processor

A solution for matching RADIUS request packets with corresponding RADIUS response packets when the number of simultaneous outstanding requests is greater than 256 involves using a sixteen-octet authenticator field in each packet. For each response packet that arrives, the identifier of the packet is compared in turn with the identifier of each outstanding request packet. If the identifiers match, the authenticators are then compared. If the results of the comparison indicate a match, the packet is accepted and no further processing of the outstanding requests is required. Otherwise, a search of the outstanding request packets is continued. This solution allows for more than 256 simultaneous outstanding RADIUS requests and only encounters a mismatch or ambiguous match with a probability of one in 3.4&#xd7;10packets.

Matching of radius request and response packets during high traffic volume

A solution for matching RADIUS request packets with corresponding RADIUS response packets when the number of simultaneous outstanding requests is greater than 256 involves using a sixteen-octet authenticator field in each packet. For each response packet that arrives, the identifier of the packet is compared in turn with the identifier of each outstanding request packet. If the identifiers match, the authenticators are then compared. If the results of the comparison indicate a match, the packet is accepted and no further processing of the outstanding requests is required. Otherwise, a search of the outstanding request packets is continued. This solution allows for more than 256 simultaneous outstanding RADIUS requests and only encounters a mismatch or ambiguous match with a probability of one in 3.4&times;10 packets.

Matching of RADIUS request and response packets during high traffic volume

Growing community of inventors

Maryville, TN, United States of America

Steven Joseph Rich