Abstract: At least a portion of a software image may be executed on a first instance of a computing platform. A first sequence of multi-dimensional execution states may be measured that the first instance of the computing platform passes through when executing the portion of the software image. The portion of the software image may then be executed on a second instance of the computing platform. A second sequence of multi-dimensional execution states may be measured that the second instance of the computing platform passes through when executing the portion of the software image. The integrity of the second instance of the computing platform may be verified with respect to the first instance of the computing platform by comparing the first sequence of multi-dimensional execution states with the second sequence of multi-dimensional execution states.

Abstract: Systems and techniques are described for verifying the integrity of a computing platform. Specifically, a software image can be generated that, when executed at a computing platform, verifies integrity of the computing platform. Next, the software image can be sent to the computing platform. The computing platform can execute the software image, thereby enabling the verification of the integrity of the computing platform.

Abstract: Technique and systems for detecting network intrusion are described. Each device in a plurality of devices in the network can generate an integrity report by: (1) measuring a first set of execution parameter values during an execution of a portion of a software image at the device, (2) comparing the first set of execution parameter values with a second set of execution parameter values associated with executing the portion of the software image at a secure instance of the device, and (3) generating the integrity report based on said comparing. Next, the integrity reports can be collected, and network intrusions can be detected based on the integrity reports by using statistical and pattern recognition techniques including but not limited to neural nets implementing crossover and backpropagation, and classifiers including but not limited to cluster analysis, correlation and regression, factor analysis.

Abstract: Circuitry to facilitate verification of the integrity of a target instance of a computing platform is described. Specifically, a processor can include circuitry to measure execution parameter values during an execution of a portion of a software image, wherein the execution parameter values represent a sequence of execution states that the target instance of the computing platform passes through while executing the portion of the software image. During operation, a software image can be generated that, when executed at the target instance of the computing platform, verifies integrity of the computing platform. Next, the software image can be sent to the target instance of the computing platform. The processor at the target instance of the computing platform can execute the software image, thereby enabling the verification of the integrity of the target instance of the computing platform.

Abstract: A mechanism to activate an original object (12S) so that statistical objects (14S) generated from the original object can be recognized using statistical object identification is disclosed. An object activation agent (48) with a clock (47) and at least one original object (12S) communicates the original object (12S) and time from the clock (47) to an object activation service (50). The object activation service (50) provides and communicates keying information (61) and expiration criterion (63) for at least one of said original objects (12S) back to the object activation agent (48).

Abstract: Systems and techniques are described for verifying the integrity of a computing platform. Specifically, a software image can be generated that, when executed at a computing platform, verifies integrity of the computing platform. Next, the software image can be sent to the computing platform. The computing platform can execute the software image, thereby enabling the verification of the integrity of the computing platform.

Abstract: The present invention provides a mechanism to activate an original object (12S) so that statistical objects (14S) generated from the original object can be recognized using statistical object identification. An object activation agent (48) with a clock (47) and at least one original object (12S) communicates the original object (12S) and time from the clock (47) to an object activation service (50). The object activation service (50) provides and communicates keying information (61) and expiration criterion (63) for at least one of said original objects (12S) back to the object activation agent (48).

Abstract: Systems and techniques are described for verifying the integrity of a computing platform. Specifically, a software image can be generated that, when executed at a computing platform, verifies integrity of the computing platform. Next, the software image can be sent to the computing platform. The computing platform can execute the software image, thereby enabling the verification of the integrity of the computing platform.

Abstract: The present invention provides a method and apparatus for securing electronic systems, including computers, information appliances and communication devices. The invention in question addresses the problem of preventing compromise by severe attacks directed at the protected systems. A severe attack could mean any of the following: low level debugging, use of in-circuit emulators or logic analyzers, removal of silicon dice and inspection including by lapping and micro-photography, and other well-known methods of attack such as distributed denial of service. In order to protect systems and data from such severe attacks, a mechanism is required whose operation is irreparably altered by the attempt to understand its operation through such attacks. Moreover, the mechanism must cease operation instantly upon detection of any intrusion associated with an attack, whether by software or by hardware based means.

Abstract: The present invention provides a mechanism to activate an original object (12S) so that statistical objects (14S) generated from the original object can be recognized using statistical object identification. An object activation agent (48) with a clock (47) and at least one original object (12S) communicates the original object (12S) and time from the clock (47) to an object activation service (50). The object activation service (50) provides and communicates keying information (61) and expiration criterion (63) for at least one of said original objects (12S) back to the object activation agent (48).

Abstract: The present invention provides a mechanism to communicate an original object (12S) without requiring the sending of the complete original object. A representative of the original object (12S), a statistical object (14S), is generated by one entity and is communicated to a second entity. The second entity receives the statistical object (14S), and identifies it as being generated from an original object (12S). If the second entity is unable to unambiguously identify the statistical object (14S), the second entity records the partial identity progress and associated communications characteristics information (22). The amount of information communicated during this process is much smaller than the original object (12S), greatly improving the speed and efficiency of communicating an original object (12S).

Abstract: The present invention provides a mechanism to communicate an original object (12S) without requiring the sending of the complete original object. A representative of the original object (12S), a statistical object (14S), is generated by one entity and is communicated to a second entity. The second entity receives the statistical object (14S), and identifies it as being generated from an original object (12S). If the second entity is unable to unambiguously identify the statistical object (14S), the second entity records the partial identity progress and associated communications characteristics information (22). The amount of information communicated during this process is much smaller than the original object (12S), greatly improving the speed and efficiency of communicating an original object (12S).

Abstract: The present invention enables an enterprise to move from an implicitly trusted resource pool to an explicitly authenticated resource pool. Trust information is generally conveyed whenever a new resource is added to the pool and trust information is revoked when a resource is removed from the pool or is unable to provide its advertised resources. The dynamic, event driven conveyance of trust information is particularly important in highly virtualized environments where virtual resources are dynamically scaled up and down in response to resource demand.

Abstract: The present invention provides a method and apparatus for securing electronic systems, including computers, information appliances and communication devices. The invention in question addresses the problem of preventing compromise by severe attacks directed at the protected systems. A severe attack could mean any of the following: low level debugging, use of in-circuit emulators or logic analyzers, removal of silicon dice and inspection including by lapping and micro-photography, and other well-known methods of attack such as distributed denial of service. In order to protect systems and data from such severe attacks, a mechanism is required whose operation is irreparably altered by the attempt to understand its operation through such attacks. Moreover, the mechanism must cease operation instantly upon detection of any intrusion associated with an attack, whether by software or by hardware based means.