-
公开(公告)号：US11507415B2
公开(公告)日：2022-11-22
申请号：US16822054
申请日：2020-03-18
Applicant: VMWARE, INC.
Inventor： Vivek Mohan Thampi , Alok Nemchand Kataria , Martim Carbone , Deep Shah
Abstract: Techniques for supporting invocations of the RDTSC (Read Time-Stamp Counter) instruction, or equivalents thereof, by guest program code running within a virtual machine (VM), including guest program code running within a secure hardware enclave of the VM, are provided. In one set of embodiments, a hypervisor can activate time virtualization heuristics for the VM, where the time virtualization heuristics cause accelerated delivery of system clock timer interrupts to a guest operating system (OS) of the VM. The hypervisor can further determine a scaling factor to be applied to timestamps generated by one or more physical CPUs, where the timestamps are generated in response to invocations of a CPU instruction made by guest program code running within the VM, and where the scaling factor is based on the activated time virtualization heuristics. The hypervisor can then program the scaling factor into the one or more physical CPUs.
-
2.发明授权公开(公告)号：US10922402B2
公开(公告)日：2021-02-16
申请号：US14550881
申请日：2014-11-21
Applicant: VMware, Inc.
Inventor： Wei Xu , Alok Nemchand Kataria , Rakesh Agarwal , Martim Carbone
Abstract: In a computer system operable at more than one privilege level, an interrupt security module handles interrupts without exposing a secret value of a register to virtual interrupt handling code that executes at a lower privilege level than the interrupt security module. The interrupt security module is configured to intercept interrupts generated while executing code at lower privilege levels. Upon receiving such an interrupt, the interrupt security module overwrites the secret value of the register with an unrelated constant. Subsequently, the interrupt security module generates a virtual interrupt corresponding to the interrupt and forwards the virtual interrupt to the virtual interrupt handling code. Advantageously, although the virtual interrupt handling code is able to determine the value of the register and consequently the unrelated constant, the virtual interrupt handling code is unable to determine the secret value.
-
Patent Agency Ranking
公开(公告)号：US20200218792A1
公开(公告)日：2020-07-09
申请号：US16296273
申请日：2019-03-08
Applicant: VMWARE, INC.
Inventor： ALOK NEMCHAND KATARIA , Achindra Bhatnagar , Sachin Shinde , Martim Carbone , Deep Shah
Abstract: Techniques for verifying the integrity of application data using secure hardware enclaves are provided. In one set of embodiments, a client system can create a secure hardware enclave on the client system and load program code for an integrity verifier into the secure hardware enclave. The client system can further receive a dataset from a server system and store the dataset at a local storage or memory location, and receive, via the integrity verifier, a cryptographic hash of the dataset from the server system and store the received cryptographic hash at a memory location within the secure hardware enclave. Then, on a periodic basis, the integrity verifier can compute a cryptographic hash of the stored dataset, compare the computed cryptographic hash against the stored cryptographic hash, and if the computed cryptographic hash does not match the stored cryptographic hash, determine that the stored dataset has been modified.
-
公开(公告)号：US20240028336A1
公开(公告)日：2024-01-25
申请号：US17870651
申请日：2022-07-21
Applicant: VMware, Inc.
Inventor： Frederick Joseph Jacobs , Sam Scalise , Martim Carbone
CPC classification number: G06F9/30145 , G06F9/545 , G06F9/45533
Abstract: In one set of embodiments, an operating system (OS) kernel of a computer system can receive an invocation of a system call by a user program running on the computer system. The OS kernel can further fetch a plurality of subsequent instructions that will be executed by the user program after the invocation of the system call and decode the plurality of subsequent instructions into a plurality of decoded instructions. The OS kernel can then analyze whether the plurality of decoded instructions include an additional system call invocation and whether other decoded instructions that appear between the invocation of the system call and the additional system call invocation are viable for emulation by the OS kernel.
-
公开(公告)号：US11327782B2
公开(公告)日：2022-05-10
申请号：US16561051
申请日：2019-09-05
Applicant: VMWARE, INC.
Inventor： Alok Nemchand Kataria , Martim Carbone , Deep Shah
Abstract: The present disclosure provides an approach for migrating the contents of an enclave, together with a virtual machine comprising the enclave, from a source host to a destination host. The approach provides a technique that allows the contents of the enclave to remain secure during the migration process, and also allows the destination host to decrypt the contents of the enclave upon receiving the contents and upon receiving the VM that includes the enclave. The approach allows for the VM to continue execution on the destination host. The enclave retains its state from source host to destination host. Applications using the enclave in the source host are able to continue using the enclave on the destination host using the data migrated from the source host to the destination host.
-
公开(公告)号：US11170077B2
公开(公告)日：2021-11-09
申请号：US16296273
申请日：2019-03-08
Applicant: VMWARE, INC.
Inventor： Alok Nemchand Kataria , Achindra Bhatnagar , Sachin Shinde , Martim Carbone , Deep Shah
Abstract: Techniques for verifying the integrity of application data using secure hardware enclaves are provided. In one set of embodiments, a client system can create a secure hardware enclave on the client system and load program code for an integrity verifier into the secure hardware enclave. The client system can further receive a dataset from a server system and store the dataset at a local storage or memory location, and receive, via the integrity verifier, a cryptographic hash of the dataset from the server system and store the received cryptographic hash at a memory location within the secure hardware enclave. Then, on a periodic basis, the integrity verifier can compute a cryptographic hash of the stored dataset, compare the computed cryptographic hash against the stored cryptographic hash, and if the computed cryptographic hash does not match the stored cryptographic hash, determine that the stored dataset has been modified.
-
公开(公告)号：US20210019166A1
公开(公告)日：2021-01-21
申请号：US16561051
申请日：2019-09-05
Applicant: VMWARE, INC.
Inventor： ALOK NEMCHAND KATARIA , Martim Carbone , Deep Shah
Abstract: The present disclosure provides an approach for migrating the contents of an enclave, together with a virtual machine comprising the enclave, from a source host to a destination host. The approach provides a technique that allows the contents of the enclave to remain secure during the migration process, and also allows the destination host to decrypt the contents of the enclave upon receiving the contents and upon receiving the VM that includes the enclave. The approach allows for the VM to continue execution on the destination host. The enclave retains its state from source host to destination host. Applications using the enclave in the source host are able to continue using the enclave on the destination host using the data migrated from the source host to the destination host.
-
-
-
-
-
-
Search Results
7
records
(took 0.011 seconds)
