Abstract: Provided are a method, system, program and device for maintaining shadow page tables in a sequestered memory region. A first processor executing an application invokes a second processor to create a shadow page table used for address translation for the application in a sequestered memory region non-alterable by processes controlled by an operating system executed by the first processor. The shadow page table references at least one page in an operating system memory region accessible to processes controlled by the operating system.

Abstract: In some embodiments, a method includes generating a prefix trie for a set of patterns, generating a suffix trie for the set of patterns, and establishing respective links between nodes of the prefix trie and respective corresponding nodes of the suffix trie. In some embodiments, a method includes adding a suffix to a suffix tree, so that the suffix (which is at least a portion of a pattern) is represented in the tree by a path that begins at a first node and ends at a second node, and associating with at least the first node and the second node a pattern identifier that identifies the pattern.

Abstract: A technique for self-isolation of a network device that has been identified as potentially harmful. The network device may be isolated from the network except for an out-of-band communication channel that can be used for management purposes to restore or repair the device prior to the network connection being re-established.

Abstract: According to some embodiments, a system provides a resource service module, a resource data record repository, and a provider module. The resource service module exposes an interface, receives an invocation of the interface from a system management module, and requests managed resource data associated with a manageable resource based on the invocation. The resource data record repository includes a resource data record indicating a memory location of a managed host in which the managed resource data is stored, and the provider module receives the request and retrieves the managed resource data from the memory location of the managed host.

Abstract: A platform for verifying the validity of changes to dynamic data modifiable during the runtime execution of an agent. In one embodiment, a management mode of a processor uses key information to generate a signature for a set of dynamic data, the signature to verify the validity of the state of the dynamic data to an integrity measurement agent.

Abstract: The present disclosure relates to attempting to monitor and control memory access and, more specifically, to attempting to limit memory access to a specific registered software agent.

Abstract: An embodiment of the present invention is a technique to protect memory. A memory identifiers storage stores memory identifiers associated with protected components. The memory identifiers include exclusive memory identifiers and shared memory identifiers. The memory identifier storage is protected from access by a host operating system. A memory identifier management service (MMS) manages the memory identifiers. The MMS resides in a protected environment. An access control enforcer (ACE) enforces an access control policy with the memory identifiers.

Abstract: A fully automated method of providing network services on demand is disclosed. The method includes receiving a request for download traffic from a user and beginning transmission of the download traffic to the user. The user is provided with the option of requesting better service level if required for an extra cost. If the user experiences poor service quality, the user then submits a service request by simply clicking a button. The NHCC then automatically identifies the customer traffic, determines the service parameters for the download traffic. With a global view of the existing network topology and conditions, the NHCC determines if the incoming service level request can be accommodated. If the network can be provisioned to accommodate the request, the NHCC sends traffic provisioning requests to Smart Nodes. The download traffic quality then improves thereby providing the customer with better quality of service.

Abstract: Embodiments of apparatuses, articles, methods, and systems for associating identifiers with memory locations for controlling memory accesses are generally described herein. Other embodiments may be described and claimed.

Abstract: Host software, such as device drivers, may be able to communicate through a platform interface with one another and with adjunct processors. This interface may be provided by enabling such communications to be snooped and then directed through an adjunct or service processor to sequestered memory locations. The sequestered memory locations may be associated with status registers to announce the availability of information transfers. In addition, the sequestered memory may be made relatively invisible to components running on the host system.

Abstract: In response to an attempt to execute an instruction to specify memory type, deciding if the instruction was attempted by a registered program.

Abstract: Registering a first program operable to access a first address of a first protected region of memory in a registry and in response to a second program making a request to access a second address of a second protected region of memory, deciding whether the second program is registered in the registry; if the second program is registered, translating the second address to a physical address; checking the validity of a control register associated with a page table and if the control register is valid, relaxing a restriction on access to a field in a page table associated with the second address.

Abstract: A method and apparatus are provided that allow processing engines to be synchronized to each other with high accuracy. In one embodiment, the invention includes obtaining a processor tick counter value from a first processing engine, comparing the obtained processor tick counter value to a processor tick counter value from a second processing engine and determining a timing offset for synchronizing the first processing engine and the second processing engine using the comparison. The invention may further include obtaining a processor tick counter value by sending a request message from the second processing engine to the first processing engine, and receiving a reply from the first processing engine at the second processing engine. The processor tick counter value at the second processing engine can be determined by recording the time at which the request message is sent and by recording the time at which the reply is received.

Abstract: The present disclosure relates to providing a remediation scheme for a compromised system and, more specifically, to providing a memory filtration scheme using an isolated partition within a system.

Abstract: The present disclosure relates to attempting to monitor and control memory access and, more specifically, to attempting to limit memory access to a specific registered software agent.

Abstract: Provided are a method, system, program and device for maintaining shadow page tables in a sequestered memory region. A first processor executing an application invokes a second processor to create a shadow page table used for address translation for the application in a sequestered memory region non-alterable by processes controlled by an operating system executed by the first processor. The shadow page table references at least one page in an operating system memory region accessible to processes controlled by the operating system.

Abstract: Systems and methods are described herein to provide for host virtual memory reconstitution. Virtual memory reconstitution is the ability to translate the host device's virtual memory addresses to the host device's physical memory addresses. The virtual memory reconstitution methods are independent of the operating system running on the host device.

Abstract: Systems and methods are described herein to provide for remote triggering of page faults.

Abstract: Systems and methods are described herein to provide for secure host resource management on a computing device. Other embodiments include apparatus and system for management of one or more host device drivers from an isolated execution environment. Further embodiments include methods for querying and receiving event data from manageable resources on a host device. Further embodiments include data structures for the reporting of event data from one or more host device drivers to one or more capability modules.

Abstract: According to some embodiments, a system provides a resource service module, a resource data record repository, and a provider module. The resource service module exposes an interface, receives an invocation of the interface from a system management module, and requests managed resource data associated with a manageable resource based on the invocation. The resource data record repository includes a resource data record indicating a memory location of a managed host in which the managed resource data is stored, and the provider module receives the request and to retrieve the managed resource data from the memory location of the managed host.