Systems and methods for trusted cluster attestation

    公开(公告)号:US10291692B2

    公开(公告)日:2019-05-14

    申请号:US15298049

    申请日:2016-10-19

    Inventor: Andrew G. Kegel

    Abstract: Systems, apparatuses, and methods for implementing trusted cluster attestation techniques are disclosed. A cluster includes multiple computing devices connected together and at least one cluster security module. The cluster security module collects measurement logs and attestations from N computing devices, with N being a positive integer greater than one. The cluster security module also maintains a log and calculates an attestation for its own hardware and/or software. The cluster security module combines the logs from the N computing device and the log of the cluster security module into an aggregate log, with N+1 logs combined into the aggregate log. Then, the cluster security module generates a single attestation for the cluster to represent the cluster as a whole. The cluster security module is configured to provide the single attestation and aggregate log to an external device responsive to receiving a challenge request from the external device.

    SYSTEMS AND METHODS FOR TRUSTED CLUSTER ATTESTATION

    公开(公告)号:US20180109561A1

    公开(公告)日:2018-04-19

    申请号:US15298049

    申请日:2016-10-19

    Inventor: Andrew G. Kegel

    Abstract: Systems, apparatuses, and methods for implementing trusted cluster attestation techniques are disclosed. A cluster includes multiple computing devices connected together and at least one cluster security module. The cluster security module collects measurement logs and attestations from N computing devices, with N being a positive integer greater than one. The cluster security module also maintains a log and calculates an attestation for its own hardware and/or software. The cluster security module combines the logs from the N computing device and the log of the cluster security module into an aggregate log, with N+1 logs combined into the aggregate log. Then, the cluster security module generates a single attestation for the cluster to represent the cluster as a whole. The cluster security module is configured to provide the single attestation and aggregate log to an external device responsive to receiving a challenge request from the external device.

    Scheduling of data migration
    35.
    发明授权
    Scheduling of data migration 有权
    调度数据迁移

    公开(公告)号:US09594521B2

    公开(公告)日:2017-03-14

    申请号:US14629014

    申请日:2015-02-23

    Abstract: In one form, scheduling data migration comprises determining whether the data is likely to be used by an input/output (I/O) device, the data being at a location remote to the I/O device; and scheduling the data for migration from the remote location to a location local to the I/O device in response to determining that the data is likely to be used by the I/O device.

    Abstract translation: 在一种形式中,调度数据迁移包括确定数据是否可能被输入/输出(I / O)设备使用,该数据位于远离I / O设备的位置; 并且响应于确定数据可能被I / O设备使用而调度用于从远程位置迁移到I / O设备本地的位置的数据。

    Extensible I/O activity logs
    36.
    发明授权
    Extensible I/O activity logs 有权
    可扩展的I / O活动日志

    公开(公告)号:US09092486B2

    公开(公告)日:2015-07-28

    申请号:US14146565

    申请日:2014-01-02

    Inventor: Andrew G. Kegel

    Abstract: A method of managing peripherals is performed in a device coupled to a processor in a computer system. In the method, information associated with I/O activity for one or more peripherals is recorded in a first segment of a log. A second segment of the log is identified based on a next-segment pointer associated with the first segment of the log. In response to detecting a lack of available capacity in the first segment of the log, information associated with further I/O activity for the one or more peripherals is recorded in the second segment of the log.

    Abstract translation: 在耦合到计算机系统中的处理器的设备中执行管理外围设备的方法。 在该方法中,与一个或多个外围设备的I / O活动相关联的信息被记录在日志的第一段中。 基于与日志的第一段相关联的下一段指针来识别日志的第二段。 响应于检测到日志的第一段中的可用容量的缺乏,与一个或多个外围设备的进一步I / O活动相关联的信息被记录在日志的第二段中。

    Virtual interrupt filter
    37.
    发明授权
    Virtual interrupt filter 有权
    虚拟中断过滤器

    公开(公告)号:US09015374B2

    公开(公告)日:2015-04-21

    申请号:US13937917

    申请日:2013-07-09

    Inventor: Andrew G. Kegel

    CPC classification number: G06F13/24

    Abstract: A system for processing interrupts in a virtualized computing environment includes a virtual interrupt controller to provide virtual interrupts from peripherals to virtual machines. The system also includes a virtual interrupt filter that has an estimator circuit to provide an estimate of what proportion of interrupts from one or more of the peripherals are virtual interrupts. A determination is made as to whether the estimate satisfies a criterion; if it does, incoming interrupts are blocked.

    Abstract translation: 用于处理虚拟化计算环境中的中断的系统包括虚拟中断控制器,以提供从外围设备到虚拟机的虚拟中断。 该系统还包括虚拟中断滤波器,该虚拟中断滤波器具有估计器电路以提供来自一个或多个外围设备的中断的比例是虚拟中断的估计。 确定估计是否满足标准; 如果是,传入的中断被阻止。

    VIRTUAL INTERRUPT FILTER
    38.
    发明申请
    VIRTUAL INTERRUPT FILTER 有权
    虚拟中断过滤器

    公开(公告)号:US20150019765A1

    公开(公告)日:2015-01-15

    申请号:US13937917

    申请日:2013-07-09

    Inventor: Andrew G. Kegel

    CPC classification number: G06F13/24

    Abstract: A system for processing interrupts in a virtualized computing environment includes a virtual interrupt controller to provide virtual interrupts from peripherals to virtual machines. The system also includes a virtual interrupt filter that has an estimator circuit to provide an estimate of what proportion of interrupts from one or more of the peripherals are virtual interrupts. A determination is made as to whether the estimate satisfies a criterion; if it does, incoming interrupts are blocked.

    Abstract translation: 用于处理虚拟化计算环境中的中断的系统包括虚拟中断控制器,以提供从外围设备到虚拟机的虚拟中断。 该系统还包括虚拟中断滤波器,该虚拟中断滤波器具有估计器电路以提供来自一个或多个外围设备的中断的比例是虚拟中断的估计。 确定估计是否满足标准; 如果是,传入的中断被阻止。

    TECHNIQUES FOR IDENTIFYING AND HANDLING PROCESSOR INTERRUPTS
    39.
    发明申请
    TECHNIQUES FOR IDENTIFYING AND HANDLING PROCESSOR INTERRUPTS 有权
    识别和处理处理器中断的技术

    公开(公告)号:US20140173152A1

    公开(公告)日:2014-06-19

    申请号:US13718841

    申请日:2012-12-18

    Inventor: Andrew G. Kegel

    CPC classification number: G06F13/24 G06F21/572 G06F21/74 G06F21/82

    Abstract: A method for identifying and reporting interrupt behavior includes incrementing a counter when an interrupt signal is a designated type and is not received from an approved peripheral device, and performing a corrective action when the counter reaches a threshold value. In some embodiments, the designated type of the interrupt signal comprises a System Management Interrupt (SMI), which has the capability of halting operations at all processors within a system to execute associated instructions within a protected circumstance, resuming normal operations for each of the plurality of processors when the corrective action has been completed. In another embodiment, the corrective action includes creating a report identifying, within the same protected circumstance, the interrupt signal as an SMI. In some embodiments, the method performs a different corrective action when an interrupt signal is a designated type and is received from an approved peripheral device and decrements a counter. In some embodiments, the interrupt signal includes information indicating its source.

    Abstract translation: 一种用于识别和报告中断行为的方法包括当中断信号是指定类型时增加计数器,并且不从批准的外围设备接收,并且当计数器达到阈值时执行校正动作。 在一些实施例中,指定类型的中断信号包括系统管理中断(SMI),该系统管理中断具有在系统内的所有处理器上停止操作的能力,以在受保护的环境内执行相关联的指令,恢复对于多个 的处理器,当纠正措施已经完成。 在另一个实施例中,纠正措施包括在相同的受保护的环境中创建一个报告,将中断信号标识为SMI。 在一些实施例中,当中断信号是指定类型并且从批准的外围设备接收并递减计数器时,该方法执行不同的校正动作。 在一些实施例中,中断信号包括指示其源的信息。

Patent Agency Ranking