text:
19 May 2004
The US Securities and Exchange Commission has approved Public Company Accounting Oversight Board (PCAOB) Auditing Standard No.
We have combined our notes from the IASB meeting on 18-19 May 2004 onto a Single Page.
We have posted (PDF 188k).
The European Financial Reporting Advisory Group (EFRAG) is seeking comments by 28 June 2004 on its preliminary views on two current IASB exposure drafts:
Preliminary Views on IASB ED: Amendments to IAS 39 Financial Instruments Recognition and Measurement: The Fair Value Option (PDF 60k)
Preliminary Views on IASB ED: Amendments to IAS 19 Employee Benefits: Actuarial Gains and Losses, Group Plans and Disclosures (PDF 63k)
The European Financial Reporting Advisory Group (EFRAG) is seeking comments by 28 June 2004 on its preliminary views on two current IASB exposure drafts:
The Committee of European Securities Regulators has published a standard on enforcement activities by supervisors of financial information in Europe.
18 May 2004
The constitution committee of the IASC Foundation has posted to the IASB website an Update on the Constitution Review (PDF 152k).
Public Meeting with Subcommittee of the Standards Advisory Council
Date and Time(time subject to change)
2 June2:00 p.m.
New York, NY United States
Intercontinental Barclay Hotel
111 East 48th Street
New York, NY 10017
United States
Public Hearings
3 June8:30 a.m.-2:30 p.m.
New York, NYUnited States
Baruch College
55 Lexington Avenue
Room 14-220 (14th Floor)New York, NY 10010
United States
29 June
9:00 a.m.-4:30 p.m.
London, UK
IASC Foundation offices
30 Cannon Street
London EC4M 6XH
United Kingdom
13 July
Morning (times to be
Tokyo, Japan
Nippon Keidanren
Keidanren Kaikan
1-9-4 Otemachi
Chiyoda-kuTokyo 100-8188
6 OctoberAfternoon (times to be
Mexico CityMexico
Venue to be announced
The European Commission is undertaking an electronic Public Consultation on matters relating to (a) board members' responsibilities for financial and key non-financial information, (b) disclosure of related party and intra-group relationships and transactions, and (c) disclosure of corporate governance practices by listed companies in a proposed corporate governance statement.
Robert Denham, the chairman of the Financial Accounting Foundation (which oversees FASB), has expressed "grave concern" over the approval of draft legislation that would pre-empt a FASB standard on share-based payment (see our news story of 15 May).
The IASB will meet at its offices in London on 18-19 May 2004. An issue related to Financial Reporting by Small and Medium-sized Entities has been added to the Meeting Agenda.
The IASB will meet at its offices in London on 18-19 May 2004. An issue related to Financial Reporting by Small and Medium-sized Entities has been added to the Meeting Agenda.
17 May 2004
Under the auspices of the German Federal Ministry of Justice, representatives of 15 professional and industry associations have established the Financial Reporting Enforcement Panel (FREP).
Material on this website is © 2014 Deloitte Global Services Limited, or a member firm of Deloitte Touche Tohmatsu Limited, or one of their related entities. See Legal for additional copyright and other legal information.
Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee ("DTTL"), its network of member firms, and their related entities. DTTL and each of its member firms are legally separate and independent entities. DTTL (also referred to as "Deloitte Global") does not provide services to clients. Please see www.deloitte.com/about for a more detailed description of DTTL and its member firms.


text:
Track using Order ID
Login and do more!
- Track individual Orders
- View your entire Order history
- Cancel individual Orders
- Conveniently review products and sellers
Add Another Item
Add Another Item
Add Another Item
Add Another Item
* Shipments from locations where relevant permissions have been obtained.
Read instantly on your Web Browser
Also read on Flipkart eBook App
|Penguin Books Ltd
|Publication Date
|File Size
Please Note: All products sold on Flipkart are brand new and 100% genuine
Have you used this product?
Rate it now.Write a Review
Ramakrishnan Shanmugam
Mar 22, 2014
Fantastic Book
Vishnu Chevli
May 7, 2013
Depth that was beyond your imagination
Rohit Sachan
Aug 14, 2012
Mythology at its best..!!!
'Top Reviews' lists the most relevant product reviews only. Show ALL instead?Expand all Reviews
Ramakrishnan Shanmugam
Mar 22, 2014
Fantastic BookOne of the best translations on Mahabharata.. The author has taken pains to convey the content in lucid manner. Hats off to Bibek Debroy Ji..
Vishnu Chevli
May 7, 2013
Depth that was beyond your imaginationI have read first volume & about to complete second soon. Seeing 6 volumes in market, I feel more excited about it.
Rohit Sachan
Aug 14, 2012
Mythology at its best..!!!I had always been fascinated by MAHABHARAT since that epic retelling by B.R.Chopra on DD 1. But the curiosity as to why such an epic existed was always on my mind. These books by bibek debroy are the pure essence of the real mahabharat with the intensity of taking you on a spiritual journey.

subset: commoncrawl


text:
|Search | About | Preferences | Interact | Help
|150 million books. 1 search engine.
by Campbell, Jeremy
Publisher:Simon & Schuster
This book succeeds in its stated intention of giving an overview of the development of information theory. Human beings are "decoders" who interpret information. Scientific theories are human creations seeking to enlighten. The author explains a basic explanation from information theory, i.e., that "in an ordinary conversation, information is conveyed when the speaker says something that changes the listener's knowledge." Campbell attacks Darwin's theory, writing, "One major difficulty is that the central argument of Darwinian theory circles back on itself, explaining nothing." He goes into detail on why evolution is unscientific. The brain makes decisions along the way as to what information it will process and how it will interpret what it takes in.
Search under way...
Search complete.
New books: 1 - 25 of 26
Used books: 1 - 25 of 122


text:
A computer memory security platform ("MSP") includes computer system memory, circuitry, control drivers and on-board security control apparatus capable of both interacting with, and ensuring protection of, user-level application programs and kernel-mode drivers of the associated computer operating system or hypervisor executive. Through the use of an in-band control protocol, an out-of-band management protocol, and a side-band memory processing protocol, the MSP hosts a series of related control components and dynamically-loaded, hardware-resident security modules to provide executive system and application security. Special circuitry within the MSP monitors the on-board system memory to help ensure application isolation and overall executive system integrity. Depending upon configuration, the security memory platform can reside inside a standard computer form factor, or be deployed outside as a stand-alone device to provide same functionality in a simultaneous virtualization capacity for numerous computer systems.
1. A computing system comprising:
a processor;
one or more memory modules;
a hardware-based security controller positioned between the processor and the memory modules;
a software isolation (ISO) module that is a kernel-level software component that monitors memory operations issued by a software application executed by the processor;
wherein the ISO module captures context and control information from the memory operations and communicates the information to the security controller, and
wherein the security controller applies one or more security operations to memory operations between the processor and the memory modules to ensure that data used by the processor are secure.
2. The computing system of
3. The computing system of
a plurality of processing blades that operate as event engines, wherein each event engine is configurable to apply a respective security of operation to the memory operations; and
an embedded processor to program the event engines to detect different events within the memory operations that may indicate security threats to the computing system.
4. The computing system of
wherein each of event engines is a configurable logic block capable of snooping the memory operations as data is normally communicated between the memory controller and the memory modules,
wherein each of the event engines is programmed to detect one or more events within the memory operations.
5. The computing system of
6. The computing system of
7. The computing system of
8. The computing system of
9. The computing system of
10. The computing system of
wherein the memory modules utilize a serial communication interface having a latency time defined as a time period from when the memory modules receive one of the memory operations and provide a corresponding response, and
wherein the security controller applies the security operations to the memory operations during the latency period without substantially impacting a response time of the memory modules.
11. A method comprising the steps of:
executing a software module within a computing system to intercept a request from a software application to access data stored in a hardware memory module of the computing system;
relaying information from the software module to a hardware-based security integrated circuit embedded within a memory system of the computing system, wherein the information comprises context information for the software application, and wherein the security integrated circuit is positioned to access a memory bus between a memory controller and a module;
subsequent to relaying the information, monitoring a memory access request between a processor and the memory module with the hardware-based security integrated circuit;
determining within the hardware security integrated circuit, based on the context information, whether the monitored memory access request constitutes a security threat; and
performing the memory access request when it is determined that the request does not constitute a security threat.
12. The method of
13. The method of
14. The method of
15. The method of
wherein determining whether returning the memory access request constitute a security threat comprises executing a security algorithm within the hardware security integrated circuit, and
wherein the hardware security integrated circuit is formed as a component located on a removable memory module inserted within a standard memory slot of the computing system.
16. The method of
wherein determining whether returning the memory access request constitute a security threat comprises executing a security algorithm within the hardware security integrated circuit, and
wherein the hardware security integrated circuit is formed as a component located on the memory controller of the computing system.
17. The method of
18. The method of
19. The method of
20. The method of
21. The method of
monitoring a plurality of memory access requests between the processor and the memory module with the hardware-based security integrated circuit; and
determining within the hardware-based security integrated circuit, based on the context information, whether a pattern of the plurality of memory access requests constitutes a security threat.
22. The method of
23. An integrated memory stick that may be inserted within a standard memory slot of a computing system, the memory stick comprising:
a memory bus interface to receive memory access requests from a processor;
a data storage chip to store data; and
an application-specific integrated circuit (ASIC) to determine whether the requests constitute security threats and allow the performance of the request on the data storage chip when the request do not constitute security threats.
24. The memory module of
25. The memory module of
wherein the ASIC receives process context information relayed to the ASIC by the memory bus interface from a security software module executing on the processor, wherein the process context information provides context information for the process as maintained by the operating system, and
wherein the ASIC determines whether the process is attempting to access data outside the memory range allocated to the process by determining whether the request is within the memory range allocated for the process indicated by the process context information.
26. The memory module of
27. The memory module of
28. The memory module of
29. A computing system comprising:
a processor;
one or more memory modules;
a hardware-based security controller positioned between the processor and the memory modules;
a software isolation (ISO) module that is a kernel-level software component that monitors memory operations issued by a software application executed by the processor;
wherein the ISO module captures context and control information from the memory operations and communicates the information to the security controller, and
wherein the security controller applies one or more security operations to memory operations between the processor and the memory modules to ensure that instructions used by the processor are secure.
30. A memory controller comprising:
a standard memory controller of a computing system;
a memory bus interface to receive memory access requests from a processor;
a data storage chip to store data; and
a hardware security controller combined with an application-specific integrated circuit (ASIC) to determine whether the requests constitute security threats and allow the performance of the request on the data storage chip when the request do not constitute security threats.
31. The memory controller of
32. The memory controller of
wherein the ASIC receives process context information relayed to the ASIC by the memory bus interface from a security software module executing on the processor, wherein the process context information provides context information for the process as maintained by the operating system, and
wherein the ASIC determines whether the process is attempting to access data outside the memory range allocated to the process by determining whether the request is within the memory range allocated for the process indicated by the process context information.
33. The memory controller of
34. The memory controller of
35. The memory controller of
This application claims the benefit of U.S. provisional application Ser. No. 60/750,007, filed Dec. 13, 2005, the entire content of which is incorporated herein by reference.
In general, the invention relates to computer systems, and, in particular, to the security of computer systems.
All specific and general-purpose computers are based upon a primary processing unit(s) or processor(s) and some form of memory module or subsystem. The processors are designed to load the steps or instructions of a computer program and execute those instructions against applicable data to perform the task in question.
The processor is controlled by a hypervisor or operating system ("OS"), which is a general or specific executive program ("Exec"), usually providing preemptive multitasking features, capable of running many systems and application programs concurrently.
Application programs, and the Exec itself, are constructed of numerous programmatic components that can be dynamically loaded as directed by the Exec or the application in question. Some of these programmatic components run in user space and others run in Exec space ("Kernel Mode"). The Exec uses Kernel Mode to provide the general computing platform—either singularly, through the single instance of the OS, or in combination through the hypervisor and associated subordinately-hosted OS platforms. In conjunction with the hardware processor, which may offer hypervisory or multi-platform support directly, and the optional hypervisor, the OS presents a set of programmatic interfaces and device hardware abstractions that allow software engineers to write useful computer programs.
Many of these Kernel Mode components are a part of the Exec proper, while others are device drivers used to control specific hardware components of the computer. Regardless, all Kernel Mode components operate at the same level. It does not matter if the Kernel Mode component was an original part of the Exec, or if it was an after-market component provided by a third-party vendor; regardless, each has the same privilege level as the other.
The programmatic modules are generally dynamically loadable. As new programmatic modules can be added dynamically; however, it is relatively easy for intruders to introduce malicious components into the system.
Current security measures generally make use of signature-based mechanisms in order to detect such anomalous or rogue software on a system, and some offerings are now looking at statistical or behavioral based detections.
One shortcoming of many current computer security solutions is that the efforts focus on techniques that cannot ensure that the security solution remains in operation on the computer or digital device. Any proposed security software is installed on the computer along with the Exec and all the other Kernel Mode components. As such, the security software is subjected to the same hostile environment that caused the original security problem.
If an intruder wishes to commandeer a system, all they have to do is install a rogue programmatic component (virus, spyware, trojan or rootkit) on the computer. With such a component, the intruder could completely disable existing security mechanisms. Additionally, using certain programmatic techniques, an intruder could gain access to all memory, files and data on the system and remain completely hidden in their activities.
In general, embodiments of the invention constitute a Memory-Security Platform ("MSP") to ensure rogue programmatic code segments do not take control of specific software applications or data within the computer, phone or other digital appliance, and to provide an overall security platform for both current and future security algorithms. Embodiments may be viewed as a hardware-managed approach to guarding the memory subsystem with communication from the core task, register, context and virtual paging information of the CPU, Northbridge and hypervisor or executive operating system(s).
In one example, a computing system comprises a processor, one or more memory modules, a hardware-based security controller positioned between the processor and the memory modules, and a software isolation (ISO) module that is a kernel-level software component that monitors memory operations issued by software application executed by the processor. The ISO module captures context and control information from the memory operations and communicates the information to the security controller. The security controller applies one or more security operations to memory operations between the processor and the memory modules to ensure that the software applications executed by the processor are secure.
In another example, a method comprises executing a software module within a computing system to intercept a request from a software application to access data stored in a hardware memory module of the computing system. The method also comprises relaying information from the software module to a hardware-based security integrated circuit embedded within a memory system of the computing system. The information comprises context information for the software application. The security integrated circuit is positioned to access a memory bus between a memory controller and a module. In addition, the method comprises, subsequent to relaying the information, monitoring a memory access request between a processor and the memory module with the hardware-based security integrated circuit. The method also includes determining within the hardware security integrated circuit, based on the context information, whether the monitored memory access request constitutes a security threat. In addition, the method comprises performing the memory access request when it is determined that the request does not constitute a security threat.
In another example, the MSP is an integrated high-speed memory module and security platform. In others, the MSP may, for example, manifest itself within a Northbridge memory controller or CPU directly. Application and security software programmers are able to develop software programs that interact with the MSP to ensure secure operation. For example, application programmers can request their program run in isolated memory space to ensure that sensitive data is protected from unauthorized access, even from the Exec itself. If a program or component outside of the application tries to access application memory, the MSP blocks the operation.
Most computer systems and digital appliances employ the same general architecture where a processor communicates with a logic block that is able to in-turn properly communicate to a memory subsystem. However, there is no mechanism in current computer systems that would communicate critical operational information to a hardware security mechanism such that the memory subsystem can be effectively protected.
One embodiment of the MSP itself provides a real-time security platform and memory subsystem of current and future computational systems. Because of its unique ability to offer search, filtering, monitoring and real-time protection without burden on CPU or system buses, the MSP offers fundamental security features and operations needed for protecting digital or computing systems, their operational programs and the data they manipulate.
A practical example of the MSP resides in its ability to host and protect numerous security algorithms/functionality operating at wire speed, while simultaneously offering system and application programmers the ability to uniquely protect and control access to their specific computer programs' memory. In essence, the MSP works to help isolate the operations of individual computer logic within a multi-tasking, multi-process general-purpose computer or specific computing device, thereby increasing the protection of computer operations and data security.
In like manner, security designers can create solutions that interact with the MSP security device for the purposes of applying their security-protection logic directly towards the memory subsystem itself. Such protection logic activates in the device's on-board control circuitry to provide high-speed protection without the need to block access and control of the system/memory bus.
In one aspect, the invention relates to the creation of a more secure computer, phone, digital appliance or other device operating according to the processor-memory paradigm. The invention, by providing a special computer memory security platform, delivers protected, real-time security algorithm hosting, dynamic credentialing and encryption, application operation isolation functionality, hypervisor or operating system driver and system memory protection and hosted security logic operations from within the memory subsystem itself.
In some embodiments, the MSP software and hardware institute special operational elements that provide for more secure operation of the hypervisor or executive program, kernel components, application programs, disk files and memory access. For example, various example embodiments of the MSP provide one or more of the following features.
In one example, the MSP may interact in-band (within the standard bus mechanism) with computer executive program, operating system modules and computer applications to provide security and application isolation features, or ultimately as a CPU logic component for the same purposes.
In another example, the MSP may protect data, application, security and executive software operations through side-band (within a new invention-to-memory mechanism) memory processing, monitoring and access-protection activities.
In another example, the MSP may provide out-of-band (outside of the standard bus mechanism) security management operations using a mobile security component and an existing communication bus, or a new management bus ("SafeBus").
In another example, the MSP may safely create, store and administer standard and dynamic credential, encryption, and hash functions, along with their associated control keys used in computer and application security operations.
In another example, the MSP may offer audit and other integrity-check mechanisms to increase protection of executive system primitives, drivers and programmatic interfaces.
In another example embodiment, the MSP may provide a hardware-protected general security platform for various third party security developers.
In another example, the MSP may use in-band signaling between the MSP control software and hardware device. This feature is used to maintain the existing footprint and form factor of current day computer systems.
In another example, the MSP may offer hardware-backed protection of software modules to help ensure that selected critical software modules are not injected with rogue software, and remain in operation, thereby providing their designated operational or security functionality.
In another example, the MSP may offer side-band security operations in parallel so to avoid latency or contention problems that may interfere with CPU or direct memory access (DMA) operations of the host system.
In another example, the MSP may provide security and encryption key storage that provides access to secure key storage for use in encryption and security operations that are critical to protecting access and user data.
In another example, the MSP may provide dynamic credential generation. This feature establishes a protected interface between the MSP device and control software to help prevent against unauthorized operations. Additionally, the dynamic credentialing operations provide application security when functionally and/or data is extended through the application program interface to outside users.
In another example, the MSP may utilize a watchdog control mechanism. This feature helps ensure that critical control software is present and operational on a regular basis. Failure of the feature ensures that memory is blocked from all future access.
In another example, the MSP may utilize a tracer feature between control software elements. This feature helps audit the system and ensure the integrity of executive program operations and application programming interfaces used by general and specific programs.
In another example, the MSP may provide blades or on-board device computational modules. This feature provides executive, application and security applications the opportunity to deliver specific computational logic to the MSP device for the purposes of memory search, filtering, monitoring or real-time protection.
In another example, the MSP may utilize an isolation module (ISO Module) for command-and-control operations. This feature helps to protect executive, application and security programs and offers access to the device hardware via in-band communications. This feature also provides context, memory-map and executive operation information used in generic and specific security features.
In another example, the MSP may provide both in-system (computer, smart phone) and external-system deployment. This feature allows use with present day systems or provides for solutions in scenarios such as data centers where operational management dictates centralized management.
In another example, the MSP may offer the ability to link individual MSP devices (as used in multiple computer systems). This feature provides for applying search, filtering, monitoring and real-time protection across multiple computer systems for the purpose of integrated, centralized operation and management.
In another example, the MSP may utilize a unique security primer that initializes the MSP such that key operational components of the device act to protect one another against outside intrusion. This feature provides a level of assurance currently unavailable in security solutions.
In another example, the MSP may provide memory context information regarding memory I/O operations. This feature helps provide determination of memory access intent needed to provide advanced security.
In another example, the MSP may provide self-check functionality. This feature helps to ensure the integrity of the MSP and the executive, application and security programs on the computer system.
In another example, the MSP may provide memory I/O capture and emulation. This feature provides state and memory access playback feature to facilitate training, development and research.
In another example, the MSP may provide compliance logging and enforcement. This feature helps with monitoring or blocking of operations as mandated by various regulations and laws.
In another example, the MSP may provide integrated command-and-control management. The feature offers system users the ability to securely add application and system software to the list of protected modules. Users can monitor MSP activity and escalate security functionality based upon need or scenario. A key component of this offering is the out-of-band security control feature offered by MSP device.
In another example, the MSP may utilize out-of-band security initialization. This feature configures and transmits initialization information to and from MSP device to outside of host system in order to assure secure initialization of the MSP.
In another example, the MSP may utilize localized control and configuration without migratory key requirement. This feature provides the security and functional offerings on a particular computer system without the need to deploy certificates or other security measures across platforms. This removes the cost and complication of global certificate/key management, and allows the various development/management personnel to work with the MSP on a localized or global level as the need dictate.
In another example, the MSP may utilize a mechanism to check and detect memory operations that are executed on behalf of an unregistered task or process. This feature helps to illuminate unauthorized tasks or processes that are common to spyware and/or rootkits.
In another example, the MSP may provide a secure installation mechanism for the ISO Module that is protected by the MSP Security Controller 7. The device then footprints the ISO Module and ensures correct allocation of the Master Credential (protected command-and-control token) and dynamic WakeUp control (specialty triggering command-and-control token).
In this manner, the MSP may provide one or more benefits and advantages over both current memory modules, and available security solutions.
The Memory Security Platform (MSP) described herein is a security device consisting of circuitry, software and/or firmware that provides a protective platform for normal computer systems or digital devices, and their associated security operations. As described herein, one security mechanism provided by the MSP is that of inline, real-time supervisor and security platform.
For purposes of the example, the exemplary ISO Module 9 and MSP Security Controller 7 are shown bridging the gap between the existing components of the computational architecture. ISO Module 9 may take the form of a kernel-level software component that monitors memory operations issued by Executive Program 4 or other software applications executed by CPU 2. ISO module 9 provides logic that may be resident in Executive Program 4, as well logic that may be resident within CPU 2 or memory controller 4. Likewise, MSP Security Controller 7 is a hardware-based security control that is positioned between CPU 2 and system memory 8. MSP Security Controller 7 provides logic that may reside in specific hardware and circuitry, or become integrated directly with existing digital device or computer system components such as circuitry of CPU 2, memory controller 4, or memory modules of system memory 8.
MSP Security Controller 7 acts as a security checkpoint for all operations across the memory subsystem of computing system 1. The components of the MSP cooperate to provide a mechanism to protect data, Executive Program 4 and application programmatic elements from attack.
The MSP described herein utilizes ISO Module 9. An exemplary ISO Module 9 is a special executive or OS kernel component that monitors, among other things, the active task and memory operations of the active task and communicates the information regarding the active task and memory operations of the active task to MSP Security Controller 7. For example, ISO Module 9 may capture or otherwise obtain important context and control information and communicate the captured information to MSP Security Controller 7. MSP Security Controller 7 monitors, processes and protects the memory subsystem and memory I/O operations that flow between CPU 2 and the actual memory chips of system memory 8. MSP Security Controller 7 may ensure that the software components of the invention, as well as the Executive Program 4, are operational and secure.
As a memory I/O request flows across the plurality of Security Blades 22 on a path of the memory I/O request to the memory, MSP processor 24 reviews, monitors, checks, transforms or blocks the memory I/O request at each stage of the stack of Security Blades 22 as directed by security settings. In other words, MSP processor 24 uses Security Blades 22 to determine whether the memory I/O request constitutes a security threat. If MSP processor 24 determines that the memory I/O request does not constitute a security threat, MSP processor 24 allows the memory I/O request to be performed. Security Blades 22 are shown inline for simplicity of illustration, but the MSP Security Controller 7 may process the Blade operations serially or in parallel as security conditions warrant.
Embodiments of the MSP utilize a multi-function application-specific integrated circuit (ASIC) kernel and control mechanism, i.e., the MSP Security Controller 7, physically embedded within the memory module itself to monitor and control access to system memory 8. This feature provides high-speed security functionality without diminishing overall system throughput or adding to CPU or bus contention.
MSP Security Controller 7 has circuitry that accepts the memory I/O request in real-time, and then imparts various security/monitoring operations on the memory I/O request as it continues its flow to and from the memory chips.
The MSP contains several additional security features by nature of its self-contained platform structure. The MSP Security Controller 7, for example, may have storage, computational and logic components that provide security operations for the host system, i.e., computing system 1.
On-board MSP processor 24 controls and coordinates security components 22, 26, 28 and 30 to deliver security features. One construct of the MSP is that these security features are provided to the base computer or digital system (i.e., computing system 1) because the MSP Security Controller 7 is embedded within the host system, yet the functionality is protected from rogue software components because the MSP Security Controller 7 control mechanisms are not directly accessible from the host system. For example, in some embodiments, at least in part, the MSP Security Controller 7 may be embedded within the memory module(s) of system memory 8. In other embodiments, the MSP Security Controller 7 may be embedded within the host memory controller 6.
Security Blades 22 are logical security processing elements used to administer security detection, monitoring and policy operations on the memory I/O cycle or against the memory elements themselves. Security Blades 22 may implement base security logic or may use configuration information downloaded and installed within MSP Security Controller 7 from third parties. The dynamically configurable information may control limited aspects of the operation of Security Blades 22 but do not constitute executable code. Because the dynamic configuration information does not constitute executable code, the configuration information may not constitute an active virus or rootkit.
Security Manager 26 is a base logical component of MSP Security Controller 7, and represents the main component that interacts with and provides an interface to ISO Module 9.
Credential Manager 28 is the logical security, storage and management element of MSP Security Controller 7 that governs standard and dynamic credential creation and control.
Key Manager 30 is a logical security, storage and management element of MSP Security Controller 7 that governs encryption, key control and associated access.
In general, MSP Security Controller 7 comprises the typical elements found on a compatible "memory stick" in order to monitor memory interface 33, and includes additional logic to provide specialized security functions. Because MSP Security Controller 7 is compatible within a "current day" PC system, such as computing system 1, the MSP Security Controller 7 may operate within timing requirements where memory busses are tuned to achieve high-speed bulk transfer of memory data.
In the example of
MSP Processor 32 is an embedded micro-controller, which directs all aspects of the MSP Security Controller 7 within the memory module.
Each of event engines 34 is a configurable logic block with the primary purpose of watching (i.e., snooping) system memory 8 as the data transfers are normally communicated between memory controller 4 and the memory modules of system memory 8. In some exemplary embodiments, MSP Security Controller 7 includes a plurality of parallel Event Engines 34, each with the ability to view a stream of memory transactions as the transactions would normally occur at real-time system speed. An "event" may be a programmed event (or sequence of events) that may comprise a particular data stream or address location accesses and the like. Each of Event Engines 34 has the ability to view all memory accesses within the stream and detect matching events.
As an example for illustration purposes, sample Event Engines #1, #2, #3, #4 may be configured to look for various rogue virus streams. Sample Event Engines #5-#n may be configured to determine if particular addresses or range of addresses are accessed from the memory controller to the memory elements within system memory 8.
MSP Processor 32 programs Event Engines 34 monitor memory access requests between CPU 2 and system memory 8. In addition, MSP Processor 32 programs Event Engines 32 to determine whether the monitored memory access requests constitutes security threats. For example, MSP Processor 32 may provide context information from ISO module 9 and/or configuration data to configure Event Engines 34 with respect to the particular memory transaction or series of transactions that Event Engines 34 are to monitor. In another example, the security threat may include a request from a software application to access data stored in system memory that is associated with another software application. In yet another example, Event Engines 34 may monitor a plurality of memory access requests between CPU 2 and system memory 8 and determine whether a pattern of the memory access requests constitutes a security threat. That is, Event Engines 34 may determine that individual memory access requests do not constitute a security threat individually, but a set or series of memory access requests as a whole may be a security threat. The Event Engines 34 may, additionally, monitor a plurality of memory locations for content, with or without consideration of units of time, to determine if such conditions constitute a security threat or monitoring event.
Event Engines 34 may assert response messages (e.g., flags) to MSP Processor 32 when Event Engines 34 detect matching events (e.g., a security threat) within the stream of memory transactions monitored by MSP Security Controller 7.
Credential Engine 36 is a configurable logic block with the primary purpose of constructing, managing and storing both standard and dynamic user and application credentials. Standard credentials are the security items typically associated with a user to gain access to network and domains. Dynamic Credentials are security items used to protect access to specific software applications such as desktop programs or web systems. Specifically, a Dynamic Credential is an encrypted, time-stamped, application-context sensitive control string that uniquely identifies an application user and provides protected ties to that user's unique application data. Credential Engine 36 provides a secure storage and access mechanism for Standard Credentials. Credential Engine 36 provides a unique construction mechanism and secure storage and access mechanism for Dynamic Credentials.
In-Band Communication unit 38 is responsible for determining if a series of memory reads or writes is typical memory access or, instead, a communication packet to configure components of the MSP Security Controller 7 itself. This concept of MSP Security Controller 7 allows ISO Module 9 to control registers within MSP Processor 32, configuration data for Event Engines 34, data for Credential Engine 36, a Paging Table, and read/write operations with a memory-latched control board. In-Band Communication Processing unit 38 may be able to determine if a memory access is simply a standard memory access, or is a unique memory transfer that allows data to be latched within this unit over the standard memory bus.
Off Board Serial Communication and Interrupt port 40 provides an off-board serial communication port that allows for an alternate path into MSP Security Controller 7. This component can be used for initial setup of MSP Security Controller 7, as well as a communication link between multiple MSP Complex units within a system or multiple device deployment. The MSP Interrupt Signal (INT) has the ability to interrupt the standard interrupt hardware structure within the host system, e.g., computing system 1. This feature is used to immediately alert computing system 1 upon triggering of an Event Engine flag.
Memory Area 42 comprises of four primary areas: a Read-Only Memory (ROM) area, a paging table area, a context control area, and a memory-latched control board area. The ROM area of memory area 42 is a read-only area of memory area 42 that may store software that is executable by MSP Processor 32. For example, the ROM area of memory area 42 may contain software that MSP processor 32 uses to boot. The Paging Table area of memory area 42 may store ownership information of memory blocks. The Context Control area of memory area 42 may store context information about the owner of the memory including state and control elements from Program Executive 4, CPU 2 and associated components.
The Memory-Latched Control area of memory area 42 may store command-and-control information for MSP Security Controller 7, and indirectly for ISO Module 9. The Memory-Latched Control area may provide a latching memory mechanism by which ISO Module 9 and MSP Security Controller 7 may share information from the standard memory bus slot. MSP Processor 32 posts information to the Memory-Latched Control area and may then cause that information to load into system memory 8 associated with the ISO Module 9. ISO Module 9 can indirectly write and/or read information, including Event Engine status, from the Memory-Latched Control area by directly writing or reading the system memory 8 associated with the ISO Module 9 and recognized as be "latched" by the MSP Processor 32.
MSP key storage area 44 is a non-volatile memory section within MSP Security Controller 7 that only MSP Processor 32 is able to read. MSP key storage area 44 may store mappings from sets of ownership information to encryption keys. For example, MSP key storage area 44 may include a mapping from a set of ownership information for a first person to an encryption key. Programming an initial key may be accomplished via Off-Board Serial Communication path 40. As a result, it may be virtually impossible for any rouge software applications executing on host computing system 1 to gather access to MSP key storage area 44 of MSP Security Controller 7.
Credential Storage 46 is a non-volatile memory section within MSP Security Controller 7 that can only be read from the MSP Processor 32. Software applications can request Credential functionality of MSP Security Controller 7 via ISO Module 9 and Credential Engine 36. This feature provides dynamic security elements that help protect system, application and user data from outside attack. As a result of the architecture, it may be virtually impossible for any rogue code executing on computer system 1 to gain access to Credential Storage 46.
The fast serial communication method typically relies on a high-speed serial communication using well-tuned differential logic. For example, the serial communication of FBDIMM utilizes a Serializer-Deserializer ("SERDES") device to transfer the serial communication into parallel data signals such as to memory elements.
Such memory transfer mechanisms are fast, but may take many clock cycles overhead (latency) to actual start a transfer packet. Once started, the packets can achieve bandwidth greater than previous design parallel transfer data busses. One potential advantage of MSP2 is that the serial communication latency period may be used to perform security functions on the memory request or actual data elements. This may provide a "packet inspection" protocol with potential comparison logic that is dynamic or preloaded into a comparator. This MSP2 security mechanism may be enabled with the comparison values on a "shadow RAM", or supplied dynamically with the same via a secure interface. Systems designed using a serial communication to system memory scheme enables programmable registers to make memory packet transfers deterministic in time.
Alternately explained, with high-speed serial communication memories, a system designer can assume a standard latency before a memory read packet is expected to be returned by memory to the requesting memory controller. Based on this system value, the MSP2 can provide different levels of security operations. For example, if this timing parameter is set tightly, MSP2 can offer a certain level of packet inspection security operations. However, if this value is set to a higher latency, offering more inspection time, a more thorough set of reviews can be implemented on the system. In general, a computing system is not sensitive to a lengthened memory cycle as long as a latency timer for the computing system is set appropriately. Moreover, only slight performance degradation occurs with a high level of latency. The MSP2 mechanism may also allow injecting into the code stream where such operations were previously difficult from a timing perspective.
Isolation Module (ISO Module) 9 functions as an executive kernel or hypervisory component that executes as a monitor of computer system operations that MSP Security Controller protects; communicating critical task, memory and operational state information from computer system 1 to MSP Security Controller 7. If implemented as a software component, ISO Module 9 is backed by the hardware power of MSP Security Controller 7 to help ensure that it always remains resident in the OS or hypervisory executive program of computer system 1. If a virus, spyware or rootkit intrusion should ever attach, discover and breach the security mechanisms of the software ISO Module, rendering it inoperative, MSP Security Controller 7 would detect the disabling or other interference with ISO Module 9 and prevent further access to the memory module of the system. Alternatively, ISO Module 9 may be implemented as control circuitry within CPU 2 or memory controller 4 to provide even greater security provisions.
Specifically, ISO Module 9 transmits context information from the application, OS and/or executive program operations to MSP Security Controller 7 such that MSP Security Controller 7 can enforce memory protections from rogue code execution and even from legitimate OS or executive program code under certain conditions. Additionally, ISO Module 9 utilizes a cooperative mechanism to check, detect and block memory operations that are executed on behalf of an "unregistered" (hidden) task or process and help illuminate unauthorized activity that is common to virus, spyware and rootkit intrusions.
ISO Module 9 places itself within critical operational procedures in order to collect, affect and communicate computer operations. In one embodiment, ISO Module 9 may take the form of an OS Kernel Driver and perform actions that may be comparable to a "rootkit"—the very thing that the MSP seeks to block. However, ISO Module 9 may also be migrated directly into core OS or executive programmatic code in order to better integrate and access key control and context data. As mentioned previously, as future computer systems are designed, portions of ISO Module 9 logic may find their way into CPU 2 and memory controller 6 circuitry.
ISO Module 9 is responsible for providing executive program/operating system/task and memory context information to MSP Security Controller 7 in order to provide advanced security features. In one embodiment, ISO Module 9 is typically embodied as an OS or Exec kernel module and/or a CPU functional unit.
As the CPU attempts to run a process instruction, it may fail because the instruction has not yet been loaded into memory from the computer disk. When this "page fault" failure occurs, the executive program or OS triggers a special piece of kernel code typically called the Memory Manager ("MM"). The MM locates the portion of disk file that contains the task's currently needed instruction and loads it, along with a surrounding "block" of disk program, into physical system memory. This process is known as "paging."
As part of the normal operating process of the computer, paging occurs almost constantly. As each program or executive code segment is loaded for operation, it triggers a page fault and then the MM to load or page the required code into memory.
An alternate description is that MSP Security Controller 7 is able to determine that memory a given page(i) belongs to a corresponding application(j). The diagram also depicts ISO Module 9 intercepting CPU, Exec, or Operating System events, and collecting process and operational information from the Exec control program and system hardware components in order to provide MSP Security Controller 7 with process and context information related to system operation. ISO Module 9 communicates this information to MSP Security Controller 7 in a similar fashion to that which is used for memory allocations so that the Security Controller can then offer advanced protection to the application or Exec program and its associated data/program contained within the memory. The example of
One key to a successful security platform may be its ability to support standard processing operations as well as provide a solid base for protected security operations. As such, embodiments of the MSP may utilize several unique security processes and procedures.
As mentioned previously, MSP Security Controller 7 may contain numerous security stations or "Security Blades" 22. Security Blades 22 may be individual logical processing units that may impart security operations on both the memory I/O request and response, and against the memory module itself in a background-processing mode. The Security Blade operations may be executed in parallel, or serially, in order to achieve the desired security or management effect.
For situations where the desired security/monitoring steps are too time intensive for execution within the memory request/response time allotment, MSP Security Controller 7 may process the steps against memory in the background in a deterministic manner.
In this example,
In this manner, MSP Event Engines 34 (i.e., logical Security Blades) are controllable blades that may be configured via command packets directed to MSP Security Manager 26. MSP Event Engines 34 are capable of performing the stated security operations on the specific memory I/O request, or they can scan the actual memory chips on a virtually continuous basis.
In this example, Security Blades 22 may contain multiple levels of security logic. For example, one type of logic might be the standard signature-based byte-comparison check used typically by anti-virus vendors. The difference in this example is that the signature operations would run in isolated MSP hardware, and against system memory in real time.
Another type of security logic would be handled completely within the memory I/O request cycle between CPU and the memory stick. This operation would provide real-time security features currently unavailable.
Yet another type of security logic would include the "context" information available due to the interaction of ISO Module 9 and MSP Security Controller 7. This configuration would allow advanced security and monitoring operations that are more comprehensive than signature-only solutions.
As mentioned previously, one feature of the MSP is that MSP Security Controller 7 can interject security mechanisms into the memory I/O request, ensuring that the memory response meets security guidelines or standards. These checks are performed in real-time and are unaffected by potential virus or rootkit modules installed on the host computer or digital system.
Additionally, the MSP can apply the security steps to the memory subsystem on a continuous basis in order to maintain specific security levels or apply broader security logic. Moreover, the MSP can perform these security/monitoring operations without negatively affecting native system performance or diminishing bus throughput.
Depending upon configuration, advanced security and monitoring information is communicated back to compliant MSP cooperative control programs on the computer, or off-system to a central management site, for user and management review.
Generic Memory, Memory Controller and CPU Imbedded
The MSP concept may be applicable even when "pluggable" memory slots are not available. The same approach can be used in memory applications such as the Smart Phone or other processor-based digital appliance having a limited footprint. The same apparatus and art that enables the MSP are applicable to non-pluggable memory systems. The main difference is the physical location where the enabling hardware is soldered next to the memory components in such devices.
In some embodiments, aspects of the MSP concept are embedded directly into the memory controller or CPU itself. For purposes of example, the document has been describing the concept of providing MSP logic on a memory stick or alongside of memory elements. However, all or portions of the logic and art described herein can sit inside a portion of the memory controller and provide the same function. Moreover, if this logic were implemented inside the memory controller or advanced CPU, a designer may have the ability to "relax" the timing constraints on the memory transfers and all operation described in the document would be fully available to all memory subsystems in all platforms.
SafeBus Security Interconnect
In one embodiment, the MSP uses a SafeBus Security Interconnect ("SSI") as an out-of-band physical communication medium within the computer system to transmit and receive critical operational data and control between logical MSP Security Manager 26 and the human security operator. In other words, SSI is not a memory-mapped interconnect. Such functionality may also be provided over standard communication mechanisms if the flow endpoint terminates directly at the MSP.
By using an out-of-band approach, the MSP ensures that sensitive control information is not disseminated over corrupt or breached communication channels within the host computer or digital appliance.
Some of this sensitive information may be bound for the Security Control Program and that is a standard User Mode application. Therefore, in one embodiment, ISO Module 9 performs initial security functions against the host computer system (keyboard loggers, rootkit detection, hooked system function calls) to ensure that the sensitive data is not exposed to rogue components within the computer system.
The SSI delivers such information and receives such control inputs from an optional Mobile Security FOB ("MS fob") that connects to the SSI through a special connector, as well as other SSI attachments that are used to transmit control and data sequences outside the computer system in a more secure global fashion—more akin to an encrypted, network interface.
The SSI facilitates the capture and emulation of memory I/O operations outside the host computer system to provide state and memory access playback feature to facilitate training, development and security research. This also includes compliance, logging and enforcement procedures that monitor and block operations as mandated by various regulations and laws.
Mobile Security FOB
The Mobile Security fob ("MS fob") is a piece of optional MSP hardware that a user may utilize to securely interact with MSP Security Manager 26 and Security Control Program. For example, an MS fob may be a small device that a user may attached to a keychain or carry in a pocket. To use an MS fob, the user may insert the MBFOB into an SSI port in an external housing of the MSP. The port may optionally be a Universal Serial Bus port that connects directly to the SSI. By using existing interconnects to the computer, the MS fob may provide a security user with the ability to configure and control the invention. By using the out-of-band communication path provided by the SSI, a security user can manage and regulate both the operational MSP hardware and ISO Module 9 through even more secure communication channels.
The MS fob contains encrypted storage that allows a security user to store control information needed to protect MSP command-and-control and other important operations. Additionally, the MS fob may provide input controls to manage and direct special operational features of MSP Security Manager 26 and MSP Security Controller 7.
A particular MS fob may be interoperable with numerous MSP Security Managers and MSP devices to allow a managing security operator to move from computer system to computer system configuring or managing MSP inventions as needed.
The MSP may also allow the MS fob to initiate management control, monitoring and data collection activities remotely to MSP devices.
The MS fob maintains strict security partitioning between the various instances of control information contained within.
Security Control Program
The MSP Security Control Program ("SCP") is a User Mode application that can be used to interact with and control much of the operational features of ISO Module 9 and MSP Security Controller 7 (outside of MS fob control). The SCP provides the security operator on the computer system with the access to key information and components of the MSP.
The SCP interacts with the user and then relays those commands and controls needed to operate the MSP to ISO Module 9 via encrypted communications. In order to effectively provide this command-and-control operation, the MSP uses a cooperating method of protection between the MSP Security Manager, ISO Module 9 and the SCP. Each of these components is used to help protect the others.
Embodiments of this coordinated protection scheme include the transmission of critical control data from the MSP Security Manger through the MS fob (via the SSI).
The command-and-control interaction between the ISO Module 9 and MSP Security Manager 26 may flow across a standard memory bus using traditional memory operations. Due to the unique nature of the MSP, MSP Security Manager 26 activates the MSP Command Packet ("MSP-CP") via the Memory Latch mechanism, upon MSP-CP's transmission from ISO Module 9 to standard memory 8 associated with ISO Module 9.
MSP Security Manager 26 captures the MSP-CP and validates its secure control mechanisms before carrying out the requested functionality.
The MSP-CP request travels in-band, as does any required response from MSP Security Manager 26. MSP Security Controller 7 processing (Security Blades, MSP Processor, Security Manager, Credential Manager, Key Manager, etc.) may occur in a side-band mode that is mainly independent of host computer operations (some interaction may occur when the MSP applies in-line filtering and response actions on the standard memory request).
Memory Word Inspection in Real Time
One aspect of the MSP is that it is able to inspect memory transfers in real-time at full system speed [e.g., MSP2], or at near full system speed [e.g., MSP1], in addition to extending the clock cycles of MSP2-type systems to gain even more security, management and monitor processing power. The extended-cycles processing, that is, auxiliary processing logic against memory I/O after the host system has issued its memory request, is an extremely powerful and novel concept. In essence, harnessing the available extended cycles delivers a powerful pipelining effect to improve overall security and increase flexibility of processing operations. Additionally the MSP may continually look for Event Engine matches when the host system processor does not have any immediate memory need. This may allow a constant scanning of host system memory regardless of the processors memory accesses.
When combined with the additional host system context information supplied b ISO Module 9, this unique processing capability may generate advanced security capabilities not available with existing security solutions. For example, this unique processing capability may enable the detection of previously unknown rogue code or new virus segments, typically called "zero-day exploits".
Unique Key Information on Memory Apparatus Hardwired
MSP Security Controller 7 memory may have the ability to hold (in non-volatile memory such as EEPROM or Flash) unique keys associated with the host computing system where MSP Security Controller 7 is installed. Additionally, the MSP can contain command-and-control keys that are used for command-and-control. The MSP may utilize a direct pathway outside the box, giving MSP Security Controller 7 direct communication to an outside source that is completely outside the processor code stream for programmable security functions.
Memory Word Inspection Side-Band
This section describes an exemplary method for on-the-fly Memory Word Inspection. Memory that passes the memory subsystem may be checked, without speed degradation, for virus or rogue code segments. However, there is a practical design limit when performing this function, i.e. only a certain number of live comparisons can be done at any one time in a given memory I/O cycle.
This memory concept adds two unique aspects to enhance security checking of system memory.
Embodiments of the MSP make use of in-band control signaling between the MSP control software and the hardware of the MSP. This mechanism may utilize a control structure that allows computer system designers to maintain the existing footprint and form factor of current day computer systems, and allows standard memory bus mechanism to provide command-and-control structure for the MSP. ISO Module 9, and other MSP protected applications and drivers, can safely communicate functional control information to the MSP Security Manager. The example of
Side-Band Security Operations
Embodiments of the MSP make use of special hardware circuitry that offers memory security operations in parallel with existing memory connections. The design allows CPU/Northbridge and DMA operations to access the memory modules without outside contention from the MSP. This is a unique MSP design that provides memory monitoring and access without adding contention problems plagued by standard PCI hardware or other security solutions.
Security Credentials and Encryption Key Storage
Special circuitry (i.e., the Credential Manager) on MSP Security Controller 7 may generate dynamic versions of the Credential and Encryption Keys as needed to manage MSP security and/or application and Exec operations as mandated by security needs.
These protected security tokens can be delivered via ISO Module 9 to the OS or Exec and applications to help make those components more secure in their operational capacity, or the tokens can be delivered out-of-band via the SafeBus and MS fob devices to allow critical control flow outside of normal system channels.
Such security tokens, and the management thereof, are essential for the safe operation of the computer systems and for the protection of user data contained or transformed by the computer system and associated programs.
Cooperating Security Initialization
A simplified picture is provided in
ISO Module 9, under full protection from MSP Security Controller 7 hardware helps ensure that the OS is clean and stable, thus providing security cover for SCP 100.
The sensitive control information is used in establishing the connection between the SCP 100 and ISO Module 9, and the connection is further protected via the security user's actions with the Mobile Security FOB (MS fob) to help ensure MSP communication integrity.
One feature of the MSP is that it offers hardware-backed protection of the critical software modules. This feature may ensure that the MSP security logic, along with any such logic as provided by authorized third-party security vendors, remains in operation. If some new forms of virus, spyware or rootkit intrusions seek to remove one of these protected security modules, the MSP hardware may block access to critical memory sections.
To extend the protective functionality of the invention, the MSP may make itself known to the installation process of the OS or Exec. For example, as the operating system is installed or updated, the OS will detect the presence of the device and securely communicate the existence of the new ISO-like module to the device so that the module can be footprinted; securely identifying the critical piece of software. Authorization of the process could flow through the installing user via the MS fob and/or SafeBus. This mechanism will allow OS or Exec developers to automatically invoke the protective cover of the device.
Integrated Command-and-Control Management
Special Security Operations
The MSP uses several operations that help ensure a secure operating environment. Specifically, the MSP utilizes a Watchdog Control mechanism (not unique in itself) to ensure that the critical ISO Module is not removed from operation on the system. By protecting the presence and operation of ISO Module 9, the MSP guarantees that the functionality provided is running on the host system.
The Watchdog Control works in combination with the MSP's Dynamic Credential mechanism to provide a timely command-and-control heartbeat connection between ISO Module 9 and the MSP Security Manager. Failure of the Watchdog Control causes the MSP hardware to immediately stop access to system memory, thereby providing protection against data breach in the event a rogue component enters the host system and targets the MSP control structure.
Additionally, the MSP makes use of a Tracer Control feature that tests the host system's ability to deliver accurate data and control information. By utilizing a coordinated approach, the MSP can inject queries into the system in such a way that other parts of the MSP discover if the reported information from the host system is indeed valid and correct.
The Tracer Control mechanism helps to provide a level of confidence in the overall operation of the host system when potentially exposed to unknown virus, spyware or rootkit intrusions. This is very important in that most security offerings today use signature-based solutions. In other words, they protect against know threats. The Tracer Control mechanism helps discover system anomalies that may indicate breach by a yet-as-known threat.
Without such a self-check mechanism, the integrity of application programming interfaces and control information offered by the OS or Exec cannot be ensured as new security threats are increasingly stealthy and prone to destroying the integrity of system information to help the rogue program cloak its presence. This is especially true of hypervisor or virtual-machine-based intrusions that embed themselves below the level of the O/S, thereby making their presence potentially invisible to O/S-based detection mechanisms.
Dynamic Form Factor and Management
MSP Security Controller 7 may be rendered in several form factors to better suit the operational needs or application of the host computer.
By integrating MSP Security Manager 26 units across host computer platforms (yet even optionally within the same Security Control Housing), the MSP can apply interactive security logic across multiple core memory units. As one problem or condition is detected, say, on computer(i), that discovery can be relayed to MSP Security Manager 26 on all other co-hosted MSP Security Controller units 200. This configuration is further supported by the extensibility of the new memory form factors soon to become available.
By utilizing the out-of-band SSI control conduit, the MSP can remote monitoring, logging and overall security information to an outside command center for global management purposes.
Kernel Firewall
Just as the MSP can perform the "side-band" scan of memory for security violations, the MSP is able to perform the same action against OS or Exec core memory in an attempt to ensure that the host computer system remains intact.
One current trend in rogue software is to attempt to modify the operating system or Exec system structures in order to gain control of the computer. Directing the side-band processing of MSP Security Controller 7 at the OS or Exec memory footprint itself can offer a very powerful "Kernel Monitor". If key components of the operating system or Exec are changed or requested for change without proper process context, MSP Security Controller 7 can block the requests and prevent further access. Consequently, the MSP can operate as a hardware-managed Kernel Firewall.
Memory Latency Timing
Adjustment of the memory access timing is critical to providing increased processing bandwidth and security operations on the MSP. This adjustment will allow enough time to monitor, inject, transform or block data as it flows through the memory stream. As discussed above, the exemplary MSP2 device makes use of the fact that new serial communication memory architectures (FBDIMM) have increased the time for memory accesses due to the inherent latency of constructing parallel memory data from a serial stream of data. However, relaxation of the memory constraints (increased memory latency timing) of existing memory architectures will also provide for adequate memory access timing to support the operations of the MSP. The important is that the concept of "timing relaxation" is by design; if a host's memory controller (regardless of location) is designed to relax the data retrieval rate, increased processing and security functionality can be achieved by the invention.
Referenced by
Original Image


text:
The yen sank to the weakest level since last trading at 100 per dollar four years ago as the Bank of Japan reiterated its stimulus program, driving investors into an array of higher-yielding assets.
Japan's success in building an economy that supplies the world with everything from cars to electronics is now undermining its own efforts to keep the yen from rising at a time when few countries want a strong currency.
The only consensus on the dollar is that there's no consensus.
"The dollar's certainly recovering."
- Robert Lynch on Oct 23, 2014


text:
If you're thinking of become a regular at gyms or sports equipment buyer insurance more than once that you ever wonder what are the most appropriate exercises for your body. We can recommend you some exercises, but prior to that the first thing you should do is to be clear is your mission in the gym, if keep you on your weight and maintain good physical form in general, or refine your body making a marked bodybuilding and more developed as possible. If your goal is essentially to maintain a proper physical condition you should invest most of your time using the accessories fitness that gives you your usual gym. You can ask your usual monitor, he will propose you a training plan based on the accessories fitness that will manage to you reach your physical form suited little by little and with greater guarantees. If your goal is rather to the contrary, achieve a sculpted body, you must give more importance to gymnastics apparatus. In this case the fitness equipment can't be present, then the need for warming up prior to your exercise session, but the fitness equipment are that focus most of your efforts. Here you decide which part of your body is you want to develop in a more pronounced way, to influence your training with apparatus gymnastics on this area in particular. Finally, the relaxation also they have their importance, though deemed to apparatuses for massage as something secondary. Not so, since a good session of massage equipment contributes to download the tension accumulated during the hours of exercise in your muscles, making your break more enjoyable and that meet the following session in apparatus gymnastics with your strength intact.
Fitness Accessories Equipment
Comments Off
Use Of Machines Fitness Step By Step
Improve your physical shape is possible without making great efforts; in the gym or at home, just a few simple exercises so that you can soon start to notice that your body is evolving towards the way you want. The only thing that you will need will be appropriate instruments and that Yes, a good dose of perseverance and patience, without which there is no fitness machines that are worth. For starters, paramount is losing those extra pounds avoiding loss of weight resulting in flabbiness. For this nothing better than starting your training session with some of the most appropriate fitness machines. The decision is yours, you decide which of the machines of fitness that are available is that you like: elliptical bike, stationary bike, rowing bench choose the one you like and start practicing exercise. When you have finished your session with fitness machines comes to relax, but you can take advantage of the time and at the same time that you're recovering from the exercise conducted can continue with your preparation with vibrating machines.
Vibratory machines will help you to continue burning extra fat and at the same time to tone up just that part of your body that need it most, since you will yourself be who decides about what part will most influence their effects. Finally, it is time to mold your body and mark that part that you most want to highlight. You can do so through the use of cufflinks. If you are a beginner start with a few small dumbbells, with the weight you will be able to handle without much effort. View gradually increasing the weight of the dumbbell and do not forget, it shines on those muscles that you want to develop further.
Comments Off
Muscle Toning Exercises
Do not worry. But in these exercises tone your muscles will. What is the tightened muscles? It is located in the lung muscle tension. If you make 5 or more approaches (sets), this leads to a central nervous system excitation center, which then stimulates a long time these muscles, keeping them polunapryazhennost. Try to engage in this system at least 2 weeks, so you and starts to enter into the habit of classes sports. Well, let's talk about teperdavayte increase in the intensity of our workouts.
The principles of increasing loads. If after a workout the next day your muscles – does not hurt, do not pull at all and feel comfortable, that means it was time to increase the load. Where do we start? On the approaches (sets) While we swing by its own weight, and add load, we can only repetitions of movements. So, we increase the number of approaches (sets) 1. Number approaches (sets), we will increase each time after a training session on the second day will be entirely restored.
The task to increase the number of sets to 7. If after seven approaches (sets) on the second day you do not feel tired feel free to increase the number of repetitions in the approach to 20 times (any weight), and the number of approaches (sets), reducing again to five. And after 2 weeks of lessons you multipliers go to the gym. Your body is now sufficient tough and ready to take on a serious training load. But for those who want to continue training at home, at this stage should still add 2 + 1 exercises. Day 1 – squat and push-ups. Push-up to start the such a large number of repetitions that you can, do 5 sets (sets). + Lie on the floor at his feet elevation (sofa, chair), hands in front of chest, lifting the body on the pres. The so-called twist, on a Roman chair. This is an exercise in pres. 5 sets, too. Day 2 – lean forward and pull the dumbbells to his standing in the slope or pulling on the bar. Also new to exercise should be chosen such that the number of repetitions you can perform 5 sets (sets) + lie on the floor at his feet elevation (sofa, chair), hands in front of chest, lifting the body on the pres. The so-called twist, on a Roman chair. This exercise is to pres. 5 sets, too. Every time you feel your muscles for a second day of rest completely, increase the load, add approach (set), but more than 7 do not. We got to seven and back again to 5 and increase the number of repetitions. When you are able to perform all 4 exercises 30 times in 7 approaches (Sets), you would either have to go all the same to the gym or buy a home gym. At this level you already fiznagruzki'll look like a real athlete.
Comments Off
Kickboxing, Thai Boxing
Boxing as a sport has a century history. He practiced ever since the Roman Empire by generations of people took as a form of amateur athletics and professional. Technique Boxing thoroughly investigated and perfected, it may seem as though it is close to ideal. Its history in Muay Thai kickboxing and modern as the sport itself is gaining worldwide recognition, although the number of its adherents are still relatively small. World Kickboxing still not unique, as many organizations in the world hold their own competition by different rules.
In addition, a fine line between this type and other full contact and semi-contact types of martial arts. Kickboxing is constantly enriched with new ideas and techniques and existing martial arts and combat sports such as karate, taekwondo, kung fu, etc. Thai boxing – one of the closest to the real fight martial arts. Muay Thai Kickboxing is different from the usual presence of elbows and knees, grabs and throws. Throughout the world, Thai boxers are most prepared for the tough fights contact fighters.
In Muay Thai uses extremely efficient, different from all other martial arts, engineering drawing of kicks, elbows and knees. Thai boxing in Russia and the CIS appeared relatively recently – around the beginning of the 90s. However, today he holds a strong position among the arts, and every year the number of his fans is growing. Distinguish: Thai boxing and professional amateur. Amateur Muay Thai is different from the professional softer rules of protective equipment, and tactics of conducting fight. An important fact in popularity of Thai boxing is able to regularly participate in competitions at various levels – from city to world and European championships, perform standards master of sports in Thai boxing. In the applied aspect of Thai boxing differs simplicity and efficiency. Thai boxing – a tough sport, but not cruel. Basis of preparation of Thai boxer – fight in different forms: conditional and free fighting (sparring), as well as slug work, filling learn the technique of Muay Thai strength and speed. In Thai boxing protectors are widely used, which, combined with the correct teaching methods that minimize the risk of injury. Diagram of a typical workout in muay thai as follows: warm – a lot of three-minute rounds with all types of strikes, work on the equipment and testing of equipment with a trainer, strength training (push-ups are especially popular in focus, strengthening abdominal muscles, the rotation of the housing) and stretching. Particular attention is paid to the psychological preparation and study of the most vulnerable areas of the body. Thai boxing – a streamlined system that allows a person to as soon as possible to master the techniques, tactics, and the number of physical and psychological qualities necessary for the successful conduct of the match.
Comments Off
Muscle Builders
For us to use another principle of the training process – slowly, slowly, but regularly and purposefully. Training should take place no more than three times a week and each training session should not exceed 40-45 minutes. Itself workout should consist of 5-7 basic exercises: squats, deadlift, bench press and bench sitting. In the first stage completely eliminated aerobic exercise, and exercise all the insulation on some groups muscles. A waste of time and effort – to increase muscle mass in a given area, inflate, for example, only the biceps and ignore the rest of the work of muscles. I assure you, you do not succeed, because nature is always and all striving for harmony, distributes the balance of muscle throughout the body and a "beauty" as a huge inflated biceps combined with skinny legs, would not be tolerated. Drill – light! And the light illuminated me the whole long path to the goal.
I read a lot of literature, he tried to understand my questions and how you can better understand the processes that occurred to me. It helped me a lot, though, because any deliberate action is always more efficient than the unconscious, not to mention the fact that the resulting knowledge has helped me avoid many foolish and hurtful mistakes. Plus a fascinating lesson on the theme that interested me Today you can find lots of information – in books, magazines, the Internet. In general, the work of the body based on the principle of balancing. So, while we exercise, our body produces active anabolic hormones – Muscle Builders: insulin, testosterone.
Comments Off
Aikido Beginners
Very often, after a couple of beginners workouts begin to ask the question – what would I advise them to read on Aikido? In fact, I would not recommend beginners to read anything related to Aikido in general! It's more harm than good. For First, it is enough that the instructor says. Indeed, in most editions of Aikido is not made in the general principles of this art, but only certain aspects of the individual styles of names that may be not indicated. Particularly wary of books written by the British and Americans, they even have distorted notions distort so that raskukozhit then will not work. The only thing that could read these books – the poor guy to introduce a newcomer to misleading, because the instructor says one thing and the book is written just the opposite. And if you buy, for example the five books of different authors, there surely will be a lot of contradictions. And if a student comes to do is read a book, it's generally a bad case. He will still ask after class, they say, you say so and so, as the book is written like this and like that.
But is it worth arguing? Book, in fact all the same trust as something more than words … What it appears that one can not read the book? Yes you can, just do not take seriously what is written in them, or better yet, give this book first to see your instructor. But even if the book is very well and good, still on first, it is not worth much to get involved. The practice should not be in the background, otherwise you can become a master theorist, who knows everything and does not know how little but how to find the truth a purely theoretical way. To begin with, better a couple of years having been occupied by an instructor, to visit a couple of international seminars. This will create in your mind an experience and understanding on the basis of which you can search for books confirmation of their theories and hypotheses. And what books to read better, and you yourself become a good deal. Discuss
Comments Off
Ants VL Powerlifting
Accounting program in the power cycle the bench is recommended to do the same. One workout a week conditionally "regimes", which places an emphasis on power and his bench press assistance exercises, and the other conventionally "foot", which focus attention on the leg-spin. However, only two workouts per week can not be a separate exercise on foot-and-back, although it would be preferable. Bench press in the second workout, too, do not forget, he is number two after the sit-ups and exercises for your back muscles. "Spins", we are forced to divide into two parts: the widest in one day, long in another.
In the short and rare training complete uniformity is difficult to achieve. 17. Concentrated vozdeystvie.Prodolzhenie principle of one-pointedness. Applied to a training group of exercises should be concentrated to work on a muscle. For example, if the triceps, the average grip bench press and parallel bars, or if the leg-spin – a squat, slope-hyperextension if the chest – bench press wide grip and wiring.
"Another good method to achieve good results in the bench lying down – do it in training focused on one group of muscles, thus fully working through it. Get more background information with materials from Herbalife. And if the switch in the process of training other muscle groups, the loss of the pump and the connection between "muscle-brain." Force, by the way, too, is lost. "18 Change of sredstv.Dlya increase results in a force bench approaches infinite increase in the main exercise is ineffective in mind a number of reasons. The main – impossibility to perform technically correct than 6 approaches the basic exercises experienced athlete (beginners can). Violation of proper technique leads to injury. To increase the effectiveness of training is required almost a complete change of exercise or the expansion of the funds at various stages of the annual cycle. 19. Change prioritetov.Zhimoviku amateur, unlike athletes, requires constant change of priorities in cycles. As shown, the ordinary fan can not over of the annual cycle as a whole, as a priority to have only the power bench press. Comes with the inevitability of overtraining. This process has to settle with the changing priorities in cycles. Necessary priorities change, shifting their feet to the side, back then in the direction of additional exercises, while carrying out a power bench press (or exercise his duties) as "number two" in the loop. 20. Motivatsiya.Bez it any workout meaningless. Should be set realistically attainable goal, otherwise no one and nothing will move you away. "And there is another method to increase strength and very effective – it's motivation. What do I need a beginner? First of all read sports literature: magazines, books, and watch the video competition … .. Better yet, attend the same competitions and powerlifting … .. Many weightlifters also watch videos of his, and not just performances. These observations help to master the technique of movements, and maintain high motivation, feeding the subconscious visual images. And in theory provide substantial assistance "These seemingly indisputable truths, such as stretching the chest muscles after each approach the bench press, and jogging after a workout I do not put the basic principles. But I have a special opinion about their great benefits for the power lift. USED REFERENCES: Ants VL Powerlifting. Path to the power / / Moscow, Publishing House, Svetlana P, 1998.Muravev VL PUSH lying! / / Moscow, Publishing House of Lana, 2001. Article from the book by Vladimir Muravyov "PUSH Lying-2!". Full text of the book "Lying-2 PUSH!" Is available at the author's website
Comments Off
Elliptical Trainer
Digression into the history of elliptical trainer. For 12 years we had the first of its kind elliptical trainer (orbitrek) – a mixture of stepper, treadmill and stationary bike, but after a couple of years the firm has created the first in KETTLER world – ergometer. Ergometer – this elliptical trainer a load is measured in watts. What possible to obtain accurate measurements of your computer and maintain accurate control over the load. Ergometers have been widely used in Prevention and treatment of many diseases. Features elliptical trainer first thing to note the unique structure of elliptical trainers.
Ego pedals move in an elliptical trajectory, which gives ability to maintain a natural upright posture stride, and it is this structure of elliptical trainer will get rid of pain in the joints. Elliptical trainer ideal suitable for people aged and suffered injuries. Differences elliptical trainer from his parents (stepper, treadmill and stationary bike.) 1. During a workout on the weight of the orbitreke transferred to the muscles – the legs, buttocks, thighs, and and muscles in the arms, shoulders, chest and back. Removing the load on the knee and ankle joints. 2. Only elliptical trainers allow you to move in front and back, which allows access to difficult places.
Classification Elliptical Trainers Elliptical trainers are classified for the principle of the braking system. Electromagnetic Electronic elliptical trainer elliptical trainer with an electronic braking system, allows accurate than others to change the load. Typically, an electronic programming orbitrek own load, selecting the most optimal for you. Mechanical Mechanical elliptical trainer elliptical simulator is the most simple and economical. Mechanical orbitrek powered by human muscle power. Unlike other versions of the mechanical orbitrek does not require connection to the network. Every load is regulated by the user. Magnetic elliptical trainer magnetic elliptical trainer brought in his best qualities: 1. quiet 2. ride 3.
Comments Off
Thrust Jogging
Judge yourself: to cower at 15 times its weight of 1.5! Therefore, to maintain for many years working the spine, do the deadlift in its pure form is not recommended. There are exercises that are at least good (and maybe even better) will load your back: Thrust Jogging, Trainers. If you would like to know more about Herbalife, then click here. The lift on the breast, jerk the weight (24 kg or 32 kg); Moreover, hyperextension performed regularly throughout the annual cycle! The remaining exercises are alternated in cycles. Press exercises such as hyperextension and abdominal exercises are particularly important, exclusively for athletes engaged in without the use of "pharma". The fact is that according to research conducted for the optimal release of the body to increase hormone responsible for the increase in strength and muscle, you must perform a series of exercises to "burning" long-time while under load. For the amateur zhimovika available only two such exercises: hyperextension, abdominal exercises. K these exercises, perhaps, be attributed, and the last one or two uploaders approach the bench press in the offseason with a light weight squats, and partly within the power cycle regimes. These exercises can be performed in a superset, in addition, they serve as an excellent warm-up before zhimom.
Spent just five minutes and is performed is the best workout + release necessary hormones + = improved external data as a result of a good mood! In the offseason You can reap prone to "burning" light weight in the final approach. Security. Classes bench press force is necessary to build such a way that would best protect themselves from injury. To do this, observing the simple generally accepted rules: warm-up followed carefully before a workout, use bandages and wrist strap shtangistsky. They are reliably prevented from travm.ispolzovat WARMING ointments, such as Nikofleks, in 20 minutes prior to The core exercises, stretching regularly target muscle immediately after the execution of each basic approach, used to recover all possible methods to prevent violations proper techniques of exercise due to premature fatigue, which can lead to injury.
Comments Off
Physical Readiness
Dogfight battle lasted from 30 seconds to 3 minutes, and then if a few enemies and they have a weapon. On such a small period of time sufficient physical resources in any untrained person. But to be on your head better any of the opponents, you must have a good stock of physical resursa.Zanimatsya physical education or not-you decide. One was in my practice, such a case. Additional information is available at Dr. Kevin Cahill. At our martial arts training began coming tyazheloatlety.K by the time we began working, they finished their training, and after his train were still with us. Our view of physical training they do refuse, because 'After their kind of go'. Even after a month workouts during training sparring they felt sorry for the accuracy smotret.Nikakoy strikes, if they knocked down-fall is very dangerous for sebya.Kachki not kept longer than a minute or impacted ustalost.vyvody do sami.Itak strictly on physical training. One and same training programs in different ways affect the physical condition of performing their boytsov.Hotya goal of any exercise for everyone is the same (for example, exercises designed to development of endurance), each of them spends a different time to achieve a certain result, and is usually carried out progreess skachkoobrazno.Nekotoroe time you perform the exercise without feeling conspicuous changes its state, then there is a sudden qualitative leap, followed by a period of apparent re-zastoya.Esli you slowly but neuklonnoprodolzhaete progress, then your training process is designed correctly, and you have nothing to worry about.
Each of us has the right arm is stronger left-hand (unless, of course, you're not a southpaw). If such a fact is not taken into account, it can easily turn into your nedostatok.Polagayas only on their strengths hand, you reach some success, but never become a real masterom.Poetomu train both your hands are parallel to each other, avoiding the lag in development of one of nih.Pust your left (right) hand will never be as strong and agile as a right (left), but with a certain effort you are capable enough to make her a formidable weapon. warm regards. Follow the exercises before each WARMING trenirovkoy.Ne Take the time to warm up and the quality of the main reasons polnostyu.Odnoy injury is substandard performance warm-up exercises or a complete rejection of nih.Udelyayte attention such exercises as running, jumping rope, riding a bike. Can choose any workout what you ponravitsya.Prokrutite some kata vkontse-QUALITY kontsov.Lish would warm up the joints, muscles and svyazki.Tolko then can move on to the main part of your workout.


text:
Bob Reeves Mouthpipe Adapter, Key of A
Sku #468418000000000
Bob Reeves
Mouthpiece Adapters
- Write a Review
45 day price guarantee, 45 day return policy, 100% secure shopping
Bob Reeves Mouthpipe Adapter, Key of A
The Bob Reeves A-extension slide for a Schilke piccolo trumpet allows a piccolo trumpet to play in the Key of A while using the Bb mouthpipe. Improves intonation and plays more evenly across all registers.
review resources /productDetail/reviews/productReviews.jsp 1
write a review
Also consider


text:
Welcome To Spirit HalloweenX
Thank you for signing up to receive Spirit Halloween emails!
You will now be eligible to receive special email offers and discounts.
So Much Fun It's Scary! - Only Days Until HALLOWEEN!
Green Mascara
1 - 1 of 1
Sort by:
1 of 1
Sort by:
1 of 1
Related Categories: Hairspray | Neon Hair Mascara | Hair Spray | Hair Color | Hair Spray Paint
Neon Green Hair Mascara
Add a splash of color to your locks using this Neon Green Hair Mascara! Paint desired strands with the brush to add vibrant highlights throughout the hair. Color suits witch and ghoul costumes and adds an exciting flare to any outfit.
Sort by:
1 of 1
Sign Up Today & Receive Discounts, Exclusive Offers & Breaking News!
I agree to receive Spirit Halloween Superstores LLC's newsletter containing news, updates and promotions regarding Spirit Halloween Superstores LLC's products. You can withdraw your consent at any time. Please refer to our Privacy Policy or Contact Us for more details


text:
Soul Ship A love story about soulmates
eBook (PDF), 240 Pages
Price: $8.99
Download immediately.
Have you ever given up the here and 'now' to see what might be ahead in the future? And, do you wonder who your soulmate is? Soul Ship is the story of Cara Lynn Brighton, a young woman looking to find adventure with her first job on a cruise ship. Soul Ship is a book about love and spiritual connections, with intrigue and danger, and perhaps a hint of the mystic. Readers of romantic novels will be drawn to this one for a love story that is both tender and charged with eroticism. Readers interested in the paranormal will find appeal as the principle character' begin to explore their own intuitions and their place in fate's plan. Adding to this, the setting of places like bustling New York City, exotic Bermuda, and the romantic cruise ship itself, this novel is a great read for all adults. Warning: Does include some adult content.
Available in PDF Format
Product Details
- 9781300314271
- Copyright
- Tina Lee (Standard Copyright License)
- Edition
- Third Edition
- Publisher
- Tina Lee
- Published
- October 16, 2012
- Language
- English
- Pages
- 240
- File Format
- File Size
Formats for this Ebook
|Required Software
|Any PDF Reader, Apple Preview
|Supported Devices
|Windows PC/PocketPC, Mac OS, Linux OS, Apple iPhone/iPod Touch... (See More)
|# of Devices
|Flowing Text / Pages
|Learn more about ebook formats and e-readers
Your notification has been sent
Lulu Staff has been notified of a possible violation of the terms of our Membership Agreement. Our agents will determine if the content reported is inappropriate or not based on the guidelines provided and will then take action where needed.
Thank you for notifying us. We will email you with the results and/or actions taken as a result of the investigation if you chose to receive confirmation.
We were unable to complete your request.
We were unable to complete your request.
- love ,
- romance ,
- love story ,
- soul mate ,
- soul mates ,
- soulmate ,
- soulmates ,
- psychics ,
- intuitives ,
- spirit communication ,
- erotic ,
- ships ,
- metaphysical ,
- new age ,
- newage ,
- mystery ,
- eroticism ,
- mediumship ,
- danger ,
- spiritual ,
- ghosts ,
- spirits ,
- developing psychic ability