Abstract: Methods and apparatus to provide a platform-level network security framework are described herein. In an example method, a packet associated with a processor system is identified. A platform-level network security protocol associated with an extensible firmware interface is identified. Based on the platform-level network security protocol, the packet is identified with a network security condition.

Abstract: A system and method are implemented within a computing system to perform tamper-resistant network security operations. For example, a method of one embodiment comprises: sequestering a partition on the computing system, the partition including a region of memory and a logical or physical processing element; forwarding incoming and/or outgoing data traffic through the sequestered portion, the incoming data traffic being received by the computing system from a network and the outgoing data traffic being transmitted from the computing system over the network; performing one or more security operations on the data traffic within the sequestered partition.

Abstract: A context-aware firewall and intrusion detection system receives a definition of a Protocol State Machine (PSM) that defines the expected behavior of any protocol (FTP, HTTP, etc.). The PSM provides rules for detecting flows that deviate from the defined protocol behavior and taking appropriate actions. PSMs are comprised of rule groups define behavior of a protocol. The rules include conditions and actions that may be executed if the conditions are satisfied, The actions include dynamically adding filters to be applied to the network flow, saving results for use in later executed rules, and activating and deactivating rules. Thus, these firewalls are capable of selective and intelligent Processing based on flow state information and control payload.

Abstract: A system and method is disclosed for protecting extensible firmware interface (EFI) runtime services utilizing virtualization technology. The runtime services used by an operating system (OS) are executed by a runtime services monitor (RSM) rather than the operating system itself. When the OS accesses a runtime service, the processor mode automatically switches context to the RSM, which then executes the runtime service and puts the results back in a shared memory location. Virtualization technology is used to effect the automatic context switching. Other embodiments as described and claimed above are disclosed.

Abstract: An apparatus and method includes grouping filters to form a tree according to a bitmask. The bitmask includes entries indicating whether a value is assigned to an element of a filter. The method also includes receiving a packet that includes a particular bitmask, searching the tree to determine filters associated with the particular bitmask and the associated values, and returning a set of filters that are an intersection of the filters indicated by the associated values.

Abstract: Methods and apparatus to provide a platform-level network security framework are described herein. In an example method, a packet associated with a processor system is identified. A platform-level network security protocol associated with an extensible firmware interface is identified. Based on the platform-level network security protocol, the packet is identified with a network security condition.

Abstract: An extensible definition of data exchanged between logical layered components of different platform hardware interfaces for management, configuration, and alerts and systems and methods for using same is disclosed. One embodiment is a mechanism for self-describing hardware and firmware components. An embodiment of the present invention is a system and method relating to a binary data definition and generic parser mechanism which allows efficient and runtime extensible definition of data exchanged between logical layered components of different platform hardware interfaces for management/configuration/alerting as well as providing generic basic input-output system (“BIOS”) and firmware data formats.

Abstract: A multihomed network distributes load information associated with different source address prefixes. A host dynamically balances the network load by directing global network traffic according to the load information. Load information may be delivered to the host using existing communication mechanisms, such as the neighbor discovery messages.