Intel Corporation

Mcafee, Inc.

Google Inc.

Waymo LLC

Vadim Sukhomlinov

Kshitij Arun Doshi

Alex Nayshtut

Dmitry Babokin

Igor G Muttik

Michael Lemay

Francesc Guim Bernat

David M Durham

Ravi L Sahita

Baiju V Patel

Koichi Yamada

Jr-Shian Tsai

Alexander Bachmutsky

Carl D Woodward

Andrey Chilikin

Mingwei Zhang

Dmitri Rubakha

Alberto Martin

Krishna Bhuyan

Jennifer Eligius Mankin

Andrey Pronin

Areg Melik-Adamyan

Gilbert A Neiger

Vedvyas Shanbhogue

Jason W Brandt

Barry E Huntley

Michael E Kounavis

Karanvir S Grewal

Raghu R Kondapalli

Namakkal N Venkatesan

Tamir Damian Munafo

Yuriy Bulygin

Palanivelrajan Rajan Shanmugavelayutham

Josh Triplett

Roman Dementiev

Amitabh Das

Oleksandr Bazhaniuk

Sevin F Varoglu

Ye Zhuang

James C Farwell

Dima Mirkin

Mohan J Kumar

Sanjeev N Trika

Ravishankar Iyer

Andrew J Herdrich

Sara S Baghsorkhi

Oleg Pogorelik

Eliezer Tamir

Omer Ben-Shalom

Katalin Klara Bartfai-Walcott

Mingqiu Sun

Eliel Louzoun

Ian M Steiner

Edwin Verplanke

Jeffrey D Chamberlain

Nilesh K Jain

Eric Dahlen

Andreas Kleen

Mohammad R Haghighat

Venkat R Gokulrangan

Amin Firoozshahian

Ronen Aharon Hyatt

Yeluri Raghuram

Ajay Harikumar

Anil Rao

Leeor Peled

Palanivel Rajan Shanmugavelayutham

Anant Raman

Roger Keith Wiles

Raizy Kellermann

Teck Joo Goh

Denis Klimov

Harshad S Sane

Anup Mohan

Michael Prinke

Guy Barnhart-magen

Wenyong Huang

Daniel Fernando Gutson

A method for authenticating a secure credential transfer to a device includes verifying user identity and device identity. In particular, the method includes verifying user identity by requesting and receiving a user identification input at a first client device and verifying device identity of a second client device by (i) determining a security status of the second client device from hardware of the second client device, (ii) invoking an identifier related to the security status of the second client device to an authentication server, and (iii) obtaining certification from the authentication server for the second client device based on the invoked identifier. After verifying the user identity and the device identity, the method includes establishing a secure channel between the first client device and the second client device for the secure credential transfer using one or more tokens generated by the authentication server.

Method and system for authenticating a secure credential transfer to a device

Techniques and apparatuses to harden AI systems against various attacks are provided. Among the different techniques and apparatuses, is provided, techniques and apparatuses that expand the domain for an inference model to include both visible classes and well as hidden classes. The hidden classes can be used to detect possible probing attacks against the model.

Securing systems employing artificial intelligence

A computing apparatus, including: a hardware computing platform; and logic to operate on the hardware computing platform, configured to: receive a microservice instance registration for a microservice accelerator, wherein the registration includes a microservice that the microservice accelerator is configured to provide, and a microservice connection capability indicating an ability of the microservice instance to communicate directly with other instances of the same or a different microservice; and log the registration in a microservice registration database.

Microservices architecture

Detailed are embodiments related to bit matrix multiplication in a processor. For example, in some embodiments a processor comprising: decode circuitry to decode an instruction have fields for an opcode, an identifier of a first source bit matrix, an identifier of a second source bit matrix, an identifier of a destination bit matrix, and an immediate; and execution circuitry to execute the decoded instruction to perform a multiplication of a matrix of S-bit elements of the identified first source bit matrix with S-bit elements of the identified second source bit matrix, wherein the multiplication and accumulation operations are selected by the operation selector and store a result of the matrix multiplication into the identified destination bit matrix, wherein S indicates a plural bit size is described.

Bit matrix multiplication

Embodiments of systems, apparatuses and methods provide enhanced function as a service (FaaS) to users, e.g., computer developers and cloud service providers (CSPs). A computing system configured to provide such enhanced FaaS service include one or more controls architectural subsystems, software and orchestration subsystems, network and storage subsystems, and security subsystems. The computing system executes functions in response to events triggered by the users in an execution environment provided by the architectural subsystems, which represent an abstraction of execution management and shield the users from the burden of managing the execution. The software and orchestration subsystems allocate computing resources for the function execution by intelligently spinning up and down containers for function code with decreased instantiation latency and increased execution scalability while maintaining secured execution. Furthermore, the computing system enables customers to pay only when their code gets executed with a granular billing down to millisecond increments.

Function as a service (FaaS) system enhancements

Examples described herein relate to requesting execution of a workload by a next function with data transport overhead tailored based on memory sharing capability with the next function. In some examples, data transport overhead is one or more of: sending a memory address pointer, virtual memory address pointer or sending data to the next function. In some examples, the memory sharing capability with the next function is based on one or more of: whether the next function shares an enclave with a sender function, the next function shares physical memory domain with a sender function, or the next function shares virtual memory domain with a sender function. In some examples, selection of the next function from among multiple instances of the next function based on one or more of: sharing of memory domain, throughput performance, latency, cost, load balancing, or service legal agreement (SLA) requirements.

Scalable and accelerated function as a service calling architecture

Technologies for packet forwarding under ingress queue overflow conditions includes a computing device configured to receive a network packet from another computing device, determine whether a global packet buffer of the NIC is full, and determine, in response to a determination that the global packet buffer is full, whether to forward all the global packet buffer entries. The computing device is additionally configured to compare, in response to a determination not to forward all the global packet buffer entries, a selection filter to one or more characteristics of the received network packet and forward, in response to a determination that the selection filter matches the one or more characteristics of the received network packet, the received network packet to a predefined output. Other embodiments are described herein.

Technologies for packet forwarding on ingress queue overflow

Examples are described that relate to waking up or invoking a function such as a processor-executed application or a hardware device. The application or a hardware device can specify which sources can cause wake-ups and which sources are not to cause wake-ups. A device or processor-executed software can monitor reads from or writes to a region of memory and cause the application or a hardware device to wake-up unless the wake-up is specified as inhibited. The updated region of memory can be precisely specified to allow a pinpoint retrieval of updated content instead of scanning a memory range for changes. In some cases, a write to a region of memory can include various parameters that are to be used by the woken-up application or a hardware device. Parameters can include a source of a wake-up, a timer to cap execution time, or any other information.

Wake-up and timer for scheduling of functions with context hints

Disclosed embodiments relate to encoded inline capabilities. In one example, a system includes a trusted execution environment (TEE) to partition an address space within a memory into a plurality of compartments each associated with code to execute a function, the TEE further to assign a message object in a heap to each compartment, receive a request from a first compartment to send a message block to a specified destination compartment, respond to the request by authenticating the request, generating a corresponding encoded capability, conveying the encoded capability to the destination compartment, and scheduling the destination compartment to respond to the request, and subsequently, respond to a check capability request from the destination compartment by checking the encoded capability and, when the check passes, providing a memory address to access the message block, and, otherwise, generating a fault, wherein each compartment is isolated from other compartments.

Encoded inline capabilities

Technologies for filtering network traffic on ingress include a network interface controller (NIC) configured to parse a header of a network packet received by the NIC to extract data from a plurality of header fields of the header. The NIC is additionally configured to determine an input set based on the field vector, retrieve a matching list from a plurality of matching lists, and compare the input set to each of the plurality of rules to identify a matching rule of the plurality of rules that matches a corresponding portion of the input set. The NIC is further configured to perform an action on the network packet based on an actionable instruction associated with the one of the plurality of rules that matches the corresponding portion of the input set. Other embodiments are described herein.

Technologies for filtering network traffic on ingress

Growing community of inventors

Santa Clara, CA, United States of America

Vadim Sukhomlinov