Abstract: Disclosed are systems and methods for adaptive resilient network communication. A system may monitor network traffic on multiple pathways between user equipment and an application or a service at a network destination, gather network telemetry data from the monitored network traffic, input the network telemetry data into a trained artificial intelligence model, and classify the network telemetry data using the model. The system may further determine, using the model, an anomaly condition in at least a portion of the multiple pathways, and in response to the determination of an anomaly, select a mitigation technique for the at least a portion of the multiple pathways.

Abstract: A remote (e.g., cloud, edge-cloud) computing environment may be improved by configuring a client device to function as an extension of the cloud computing environment, such as by coordinating the execution and processing of data on the client device. Secure content or privacy-sensitive content is protected confidentially while in a cloud computing environment or client device, and may be moved to a client device and decrypted to a client local container for various user productivity processing workloads, thereby reducing or eliminating privacy concerns. This solution also provides improved security for sharing and usage of pre-trained AI models on a client device, such as by extending attestation and provisioning capabilities from cloud computing environment into clients, and by leveraging cloud computing technology on clients that protects cloud assets. This provides an improved ability to protect trained AI models and avoid exposing an AI model training process on a client device.

Abstract: The technology described herein includes determining a security quality of service (Qos) profile matching configuration attributes of a first computing system, generating an interdependency flow graph based at least in part on the security QoS profile and the configuration attributes, generating a recommended configuration for the first computing system from the interdependency flow graph, and sending the recommended configuration to a second computing system.

Abstract: Various aspects of methods, systems, and use cases include region identification of a malicious device based on crowdsourced locations. A method may include generating a grid of bins of a local radio coverage region, receiving location data from a plurality of devices in the local radio coverage region, and classifying locations of the plurality of devices with respect to the bins. The method may include associating the classified locations of the plurality of devices to the received location data for corresponding devices of the plurality of devices, and generating a model, from the associated classified locations and the received location data.

Abstract: A system includes processing circuitry; and a memory device including instructions embodied thereon, wherein the instructions, which when executed by the processing circuitry, configure the processing circuitry to perform operations comprising: accessing input data, at an aggregator node, the input data including sensor data from a plurality of sensor nodes, each sensor data having a respective signature; validating the sensor data by using respective cryptographic hash functions on the sensor data and evaluating the respective result using the respective signature; performing an aggregation function on the sensor data to produce aggregate data; executing a hash function on the aggregate data to produce a hash value for the aggregate data; bundling the sensor data, respective signatures of the sensor data, aggregate data, and hash value for the aggregate data in a data structure; and exposing the data structure to subscriber nodes on the IoT network.

Abstract: A DTaaS architecture is described to support communication-side optimization and to reduce communication overhead while meeting necessary reliability and latency requirements. The disclosure describe techniques for utilizing DT resources for V2X environments using both virtual and physical “twin” resources to achieve improved resiliency. Moreover, to optimize redundancy costs, the ratio of virtual DT nodes to physical DT nodes may be asymmetrical. An asymmetric approach to DT redundancies involving both virtual and physical resources enables greater flexibility in managing deployment costs.

Abstract: Systems and methods for a virtual machine executing on a host device to establish a secured wireless connection and control a wireless network device without being exposed to the wireless network credentials are provided. A supplicant proxy is provided at the virtual machine to route authentication requests generated at the virtual machine through a supplicant and receive session keys from the supplicant, where the supplicant is at another virtual machine executing on the host device and has access to the network credentials.

Abstract: Methods, apparatus, systems, and articles of manufacture are disclosed to protect distributed data. An example apparatus includes at least one memory, machine readable instructions, and processor circuitry to at least one of instantiate or execute the machine readable instructions to detect a key identifier combination from a distributed key, identify a match between the key identifier combination and a platform identifier combination, extract a second key from the distributed key, the second key associated with the object, and decrypt the object via the extracted second key.

Abstract: Various systems and methods for providing decentralized reputation management in a named-function network are described herein. A compute node is configured to access an information centric network (ICN) interest packet from a user device, the ICN interest packet including a function name and a data name; construct a named-function network (NFN) interest packet using the function name; transmit the NFN interest packet to a function provider; receive an NFN data packet with a version of a function corresponding to the function name; construct a named-data network (NDN) interest packet using the data name; receive an NDN data packet with a data value corresponding to the data name; determine that the version of the function is not on a denylist; and initiate execution of the version of the function with the data value in response to determining that the version of the function is not on the denylist.

Abstract: It is provided an apparatus comprising interface circuitry, machine-readable instructions, and processing circuitry to execute the machine-readable instructions. The machine-readable instructions include instructions to record an entry into a virtual integrity register. The entry is based on a measurement of a module. The module is a part of a confidential computing environment. The machine-readable instructions further include instructions to load the module into a memory. The memory is accessible by the confidential computing environment. The machine-readable instructions further include instructions to record an entry of a log. The log comprises a load history. The entry comprises information about the loading of the module. The machine-readable instructions further include instructions to record an entry into an integrity measurement register. The entry being based on the recorded virtual integrity register entry.

Abstract: This disclosure relates generally to confidential computing and, more particularly, to trusted confidential computing meshes. An example apparatus for attestation verification comprises interface circuitry, machine readable instructions, and programmable circuitry to execute the machine readable instructions to obtain verification data corresponding to a network application from a server, verify the network application based on policy data included in the verification data, if verification of the network application is successful, allow network traffic between the programmable circuitry and the network application, and if the verification of the network application is not successful, at least one of isolate the network application or prevent traffic between the programmable circuitry and the network application.

Abstract: Methods, systems, and computer programs are presented for sharing information among Mobility as a Service (MaaS) providers to improve service delivery while protecting data privacy. A first MaaS system receives, from a second MaaS system, a request to predict demand generated by the first MaaS system for user trips that transfer from the first MaaS system to the second MaaS system. The first MaaS system predicts, in response to the request, the demand generated by the first MaaS system using a predictor model executing at the first MaaS system on a trusted execution environment (TEE) to access data of the first MaaS system. The first MaaS system sends the predicted demand to the second MaaS system.

Abstract: System and techniques for network slice resiliency are described herein. An indication of a fault-attack-failure-outage (FAFO) event for a network slice may be received. Here, the network slice is one of multiple network slices. A capacity in a slice segment may be estimated to determine whether there is enough capacity to meet a service level agreement (SLA) of the multiple network slices based on the FAFO event. In this case, the slice segment is a set of physical resources shared by the multiple network slices. Operation of the slice segment may then be modified based on results from estimating the capacity in the slice segment to address impacts from the FAFO event.

Abstract: The subject matter described herein provides technical solutions for technical problems facing computing network security. Technical solutions described herein include adaptive sniffing of networking traffic, such as using a brokered network traffic sniffing framework. A brokered sniffing framework may be used to provide dynamic adjustment of network access points and network traffic sampling queries, such as by providing dynamic adjustment in response to changes to the network topology or network traffic. The brokered sniffing framework may provide improved statistical sampling of network traffic using improved network traffic telemetry, such as by modifying a statistical profile of network traffic contents that are collected. The network traffic telemetry may be used to identify various changes in network traffic, such as by identifying statistically significant changes in latencies, bandwidths, or other data center performance metrics.

Abstract: Methods, apparatus, systems, and articles of manufacture are disclosed for triggerable data driven location determination. An example apparatus is to cause transmission of a sounding reference signal (SRS) configuration to a radio access network (RAN), the SRS configuration for a target device in communication with a radio unit (RU) associated with the RAN. Additionally, the example apparatus is to cause transmission of a value to cause the RAN to compute at least one set of time-of-arrival (TOA) measurements or time-difference-of-arrival (TDOA) measurements for the target device based on detection of SRS data in cellular data received by antennas of the RU from the target device, the at least set one of the TOA measurements or the TDOA measurements based on the SRS configuration. The example apparatus is to estimate a location of the target device based on the at least one set of the TOA measurements or the TDOA measurements.

Abstract: The technology described herein includes receiving a first reference integrity manifest (RIM) and a first proto-RIM from a first endorser, the first endorser asserting authority, by the first RIM and the first proto-RIM, to supply first attestation reference values for a computing device; storing the first proto-RIM in a RIM transparency database; notarizing the first proto-RIM; and providing the first RIM and the notarized first proto-RIM to a verifier of the computing device.

Abstract: Apparatus and methods for data lifecycle management in an edge environment are disclosed herein. An example apparatus includes an operation executor to identify a first operation to be performed for a data object at an edge node in an edge environment and a second operation to be performed for the data object, the first operation different that the second operation. The example apparatus includes a time parameter retriever to retrieve a first time value associated with the first operation from a data source and a second time value associated with the second operation from the data source. The operation executor is to execute the first operation in response to the first time value and to execute the second operation in response to the second time value.

Abstract: Technologies for accelerated edge data access and physical data security include an edge device that executes services associated with endpoint devices. An address decoder translates a virtual address generated by a service into an edge location using an edge translation table. If the edge location is not local, the edge device may localize the data and update the edge translation table. The edge device may migrate the service to another edge location, including migrating the edge translation table. The edge device may monitor telemetry and determine on a per-tenant basis whether a physical attack condition is present. If present, the edge device instructs a data resource to wipe an associated tenant data range. The determinations to localize remote data, to migrate the service, and/or whether the physical attack condition is present may be performed by an accelerator of the edge device. Other embodiments are described and claimed.

Abstract: Apparatus, systems, articles of manufacture, and methods are disclosed for generating a data supply chain object. An example non-transitory computer readable storage medium disclosed herein includes data which may be configured into executable instructions and, when configured and executed, cause one or more processors to at least: derive a provenance of a first data supply chain object; identify a first stakeholder from the provenance; determine if the first stakeholder is verified; utilize data associated with the data supply chain when the first stakeholder is verified; build a tag-value structure based on the utilization of the data; build a second data supply chain object based on the tag-value structure and an identity of a second stakeholder; and add the second data supply chain object to the data supply chain.

Abstract: Provided is an apparatus including interface circuitry, machine-readable instructions, and processing circuitry to execute the machine-readable instructions to decide on a migration of a workload from a first trusted execution environment (TEE) to a second TEE according to a migration policy. The migration policy is embedded into support infrastructure of the first TEE.