Abstract: A method for allocating resources includes determining that an initial allocation of memory bandwidth for one or more computing jobs fails a performance metric. The memory bandwidth provides access to a global memory pool for multiple legacy processors across a memory fabric. The method also includes determining a new allocation of memory bandwidth for the computing jobs that meets the performance metric. Additionally, the method includes assigning the new allocation of memory bandwidth to the computing jobs. The method further includes executing the computing jobs using the new allocation of memory bandwidth.

Abstract: Systems and methods associated with neural network verification are disclosed. One example method may be embodied on a non-transitory computer-readable medium storing computer-executable instructions. The instructions, when executed by a computer, may cause the computer to train a neural network with a training data set to perform a predefined task. The instructions may also cause the computer to train the neural network with a sentinel data set. The sentinel data set may cause the neural network to provide an identification signal in response to a predefined query set. The instructions may also cause the computer to verify whether a suspicious service operates an unauthorized copy of the neural network. The suspicious service may be verified by extracting the identification signal from responses the suspicious service provides to the predefined query set.

Abstract: A method for allocating resources includes determining that an initial allocation of memory bandwidth for one or more computing jobs fails a performance metric. The memory bandwidth provides access to a global memory pool for multiple legacy processors across a memory fabric. The method also includes determining a new allocation of memory bandwidth for the computing jobs that meets the performance metric. Additionally, the method includes assigning the new allocation of memory bandwidth to the computing jobs. The method further includes executing the computing jobs using the new allocation of memory bandwidth.

Abstract: A connection policy for a communications network has a local connection policy indicating which paths between a given one of the nodes (computer A, router A, host 898) and others of the nodes (computers B, C, filters B1, B2, C1, C2, hosts 890, 892) are allowable paths, by a symbolic expression of ranges endpoint addresses and other local connection policies in respect of other nodes. It is implemented in a distributed manner by determining, for the given node, which of the allowable paths, are dual authorized as allowable by the other local connection policy relating to the other node at the other end of that path, by Boolean operations on the symbolic expressions. For a given message for a given path between two of the nodes having their own local connection policies, both of these nodes determine whether the given path is currently dual authorized. This can provide reassurance that changes in versions of the connection policy won't transiently open a risk of undetected unwanted communication.

Abstract: Illustrated is a system and method to receive an instruction to access a set of identified data structures, where each identified data structure is associated with a version data structure that includes annotations of particular dependencies amongst at least two members of the set of identical data structures. The system and method further comprising determining, based upon the dependencies, that a version mismatch exists between the at least two members of the set of identified data structures, the dependencies used to identify a most recent version and a locally cached version of the at least two members. The system and method further comprising delaying execution of the instruction until the version mismatch between the at least two members of the set of identified data structures is resolved through an upgrade of a version of one of the at least two members of the set of identified data structures.

Abstract: Systems and methods associated with neural network verification are disclosed. One example method may be embodied on a non-transitory computer-readable medium storing computer-executable instructions. The instructions, when executed by a computer, may cause the computer to train a neural network with a training data set to perform a predefined task. The instructions may also cause the computer to train the neural network with a sentinel data set. The sentinel data set may cause the neural network to provide an identification signal in response to a predefined query set. The instructions may also cause the computer to verify whether a suspicious service operates an unauthorized copy of the neural network. The suspicious service may be verified by extracting the identification signal from responses the suspicious service provides to the predefined query set.

Abstract: A system has a virtual overlay infrastructure mapped onto physical resources for processing, storage and network communications, the virtual infrastructure having virtual entities for processing, storage and network communications. Virtual infrastructures of different users share physical resources but are isolated. Each infrastructure has its own infrastructure controller to create and configure the infrastructure. It has a user accessible part (CFC) for configuration of that user's infrastructure, and a user inaccessible part (UFC) able to access the mapping and the physical resources. This increases user control to ease system administration, while maintaining security by limiting access to the mapping.

Abstract: A connection policy for a communications network has a local connection policy indicating which paths between a given one of the nodes (computer A, router A, host 898) and others of the nodes (computers B, C, filters B1, B2, C1, C2, hosts 890, 892) are allowable paths, by a symbolic expression of ranges endpoint addresses and other local connection policies in respect of other nodes. It is implemented in a distributed manner by determining, for the given node, which of the allowable paths, are dual authorised as allowable by the other local connection policy relating to the other node at the other end of that path, by Boolean operations on the symbolic expressions. For a given message for a given path between two of the nodes having their own local connection policies, both of these nodes determine whether the given path is currently dual authorised. This can provide reassurance that changes in versions of the connection policy won't transiently open a risk of undetected unwanted communication.

Abstract: A connection policy for a communications network has a local connection policy indicating which paths between a given one of the nodes (computer A, router A, host 898) and others of the nodes (computers B, C, filters B1, B2, C1, C2, hosts 890, 892) are allowable paths, by a symbolic expression of ranges endpoint addresses and other local connection policies in respect of other nodes. It is implemented in a distributed manner by determining, for the given node, which of the allowable paths, are dual authorized as allowable by the other local connection policy relating to the other node at the other end of that path, by Boolean operations on the symbolic expressions. For a given message for a given path between two of the nodes having their own local connection policies, both of these nodes determine whether the given path is currently dual authorized. This can provide reassurance that changes in versions of the connection policy won't transiently open a risk of undetected unwanted communication.

Abstract: In a method for managing a memory segment through use of a memory virtual appliance, data is encapsulated with the memory virtual appliance, in which the memory virtual appliance comprises a virtual machine configured to manage a memory segment in a physical memory. In addition, the memory virtual appliance is implemented using a virtualization wrapper comprising computer readable code enabling the encapsulated data to be shared among a plurality of clients. Moreover, the encapsulated data is stored in the memory segment controlled by the memory virtual appliance.

Abstract: A system has a virtual overlay infrastructure mapped onto physical resources for processing, storage and network communications, the virtual infrastructure having virtual entities for processing, storage and network communications. Each virtual infrastructure can be passivated by suspending applications, stopping operating systems, and storing state, to enable later reactivation. This is simpler for a complete virtual infrastructure than for groups of virtual entities and physical entities. It enables cloned virtual infrastructure to be created for testing, upgrading or sharing without risk to the parent. On failure, reversion to a previous working clone is feasible.

Abstract: Non-volatile data structure managers and methods to manage non-volatile data structures are disclosed. An example non-volatile data structure manager includes a persistent data structure (PDS) to maintain at least one version of a non-volatile heap; a PDS versioner to create a version of the PDS reflective of a state of the non-volatile heap; and a memory updater to perform a direct memory update of the non-volatile heap in response to a write call routed from an application that shares a region of memory corresponding to the non-volatile heap as read-only, wherein the creation of the version of the PDS is caused by the direct memory update.

Abstract: Illustrated is a system and method to receive an instruction to access a set of identified data structures, where each identified data structure is associated with a version data structure that includes annotations of particular dependencies amongst at least two members of the set of identical data structures. The system and method further comprising determining, based upon the dependencies, that a version mismatch exists between the at least two members of the set of identified data structures, the dependencies used to identify a most recent version and a locally cached version of the at least two members. The system and method further comprising delaying execution of the instruction until the version mismatch between the at least two members of the set of identified data structures is resolved through an upgrade of a version of one of the at least two members of the set of identified data structures.

Abstract: In a method for managing a memory segment through use of a memory virtual appliance, data is encapsulated with the memory virtual appliance, in which the memory virtual appliance comprises a virtual machine configured to manage a memory segment in a physical memory. In addition, the memory virtual appliance is implemented using a virtualization wrapper comprising computer readable code enabling the encapsulated data to be shared among a plurality of clients. Moreover, the encapsulated data is stored in the memory segment controlled by the memory virtual appliance.

Abstract: Illustrated is a system and method for identifying a current object that is part of a versioned object, the versioned object to include at least one partial object and a base object. The system and method further include marking the at least one partial object as a candidate for compaction. Additionally, the system and method include compacting the at least one partial object, where the at least one partial object is marked, by replacing a characteristic of the base object with a characteristic of the at least one partial object. The system and method includes scheduling a transaction for each thread in a transaction pool so as to de-allocate memory associated with the at least one partial object, the transaction to be executed in a non-preemptable manner.

Abstract: A method and apparatus is provided for consolidating cryptographic key updates, the consolidated update information enabling, for example, a returning member of a secure group who has been offline, to recover the current group key, at least in most cases. The unconsolidated key updates each comprise an encrypted key, corresponding to a node of a key hierarchy, that has been encrypted using a key which is a descendant of that node. The key updates are used to maintain a key tree with nodes in this tree corresponding to nodes in the key hierarchy. Each node of the key tree is used to store, for each encrypting key used in respect of the encrypted key associated with the node, the most up-to-date version of the encrypted key with any earlier versions being discarded. The key tree, or a subset of the tree, is then provided to group members.

Abstract: A method of authorizing a computing entity comprises obtaining at the authorizing entity a delegation chain of intermediate elements through which an authorisable entity asserts authorization eligibility in the form of a sequence of locally assigned labels for the elements. The method further comparing the label sequence against a label sequence template.

Abstract: A computer implemented process for identifying conflicts between policies for a method invocable by an object is described, in which the method is a member of at least one statically defined method grouping having a corresponding policy. The process comprises, for each method grouping, obtaining each method which is a member of the method grouping, associating therewith the corresponding method grouping policy, and comparing policies associated with methods which are members of two or more method groupings to identify conflicts.

Abstract: A connection policy for a communications network has a local connection policy indicating which paths between a given one of the nodes (computer A, router A, host 898) and others of the nodes (computers B, C, filters B1, B2, C1, C2, hosts 890, 892) are allowable paths, by a symbolic expression of ranges endpoint addresses and other local connection policies in respect of other nodes. It is implemented in a distributed manner by determining, for the given node, which of the allowable paths, are dual authorised as allowable by the other local connection policy relating to the other node at the other end of that path, by Boolean operations on the symbolic expressions. For a given message for a given path between two of the nodes having their own local connection policies, both of these nodes determine whether the given path is currently dual authorised. This can provide reassurance that changes in versions of the connection policy won't transiently open a risk of undetected unwanted communication.

Abstract: A system has a virtual overlay infrastructure mapped onto physical resources for processing, storage and network communications, the virtual infrastructure having virtual entities for processing, storage and network communications. Each virtual infrastructure can be passivated by suspending applications, stopping operating systems, and storing state, to enable later reactivation. This is simpler for a complete virtual infrastructure than for groups of virtual entities and physical entities. It enables cloned virtual infrastructure to be created for testing, upgrading or sharing without risk to the parent. On failure, reversion to a previous working clone is feasible.