Hewlett-packard Development Company, L.p.

Bromium, Inc.

Bormium, Inc.

Adrian Taylor

Ian Pratt

Rahul Kashyap

Andrew Southgate

James McKenzie

Vikram Kapoor

Gaurav Banga

Deepak Khajuria

J McEnroe Samuel Navaraj

Rafal Wojtczuk

Arun Passi

Baibhav Singh

Simon Crosby

Sergei Vorobiev

Approaches for managing how the passage of time is observed by a software execution environment, such as a virtual machine or a sandbox environment. A computer system maintains a set of physical time sources. A set of virtual time sources are computed based on the set of physical time sources. The virtual time sources operate independently of the set of physical time sources. For example, the virtual time sources may observe time passing faster or slower than the set of physical time sources. The set of virtual time sources are presented to the software execution environment as the set of time sources. Many benefits may be obtained such as higher utilization of allocated resources and avoidance of timeouts.

Time dilation based on an amount of resources allocated to a software execution environment

Adaptive clock scaling using a hypervisor in a reserved portion of memory

Approaches for monitoring a host operating system. A threat model is stored and maintained in an isolated execution environment. The threat model identifies for any process executing on a host operating system how trustworthy the process should be deemed based on a pattern of observed behavior. The execution of the process and those processes in a monitoring circle relationship thereto are monitored. The monitoring circle relationship includes a parent process, any process in communication with a member of monitoring circle relationship, and any process instantiated by a present member of monitoring circle relationship. Observed process behavior is correlated with the threat model. Upon determining that a particular process has behaved in a manner inconsistent with a pattern of allowable behavior identified by the threat model for that process, a responsive action is taken.

Using a threat model to monitor host execution in a virtualized environment

Approaches for securely constructing a trusted operating environment. A trusted operating environment manager executes on a device and instantiates a trusted operating environment on the device by composing at least of portion of the trusted operating environment using data from an untrusted operating environment also executing on the device. The trusted operating environment manager only permits the trusted operating environment to access the data upon the trusted operating environment manager successfully confirming that the data is presently in a state that has been deemed trustworthy.

Securely constructing a trusted virtual environment

An isolated environment is instantiated in response to receiving a request to execute a process. One or more events occurring within the isolated environment in which the process executes are identified. Whether the actual behavior of the process executing within the isolated environment deviates from an expected behavior of the execution of the process is determined. Only when it is determined that the process deviates from the expected behavior is behavior data, which describes the actual behavior of the process during execution, stored. A determination is then made as to whether the process is compromised by analyzing the behavior data that describes the actual behavior of the process.

Micro-virtual machine forensics and detection

Adaptive clock scaling to optimize time-based operations within virtualized guest operating systems

Using threat model to monitor host execution in a virtualized environment

A consistent user interface is provided in a virtualized environment. A first and second application are executed within first and second operating systems running within separate virtual machines upon the same device. A first application receives, from the second application, a request that identifies a particular type of text to be received from a user. The first application selects an associated text input type and displays a text input interface on the device in a configuration allowing text in the selected text input type to be submitted. Optionally, the first virtual machine may have exclusive permission to display a user interface on the device; however, the user interface may include elements whose appearance was determined within other virtual machines.

Supporting a consistent user interface within a virtualized environment

Approaches for launching an application within a virtual machine. In response to receiving a request to launch an application, a device instantiates, without human intervention and based on a policy, a virtual machine in which the application is to be launched. The policy determines which resources of a device, such as a mobile device or computer system, are accessible to the virtual machine. The policy may, but need not, determine whether the virtual machine has access to a type of resource which obligates the user of the device to make a monetary payment for the user of the resource.

Isolation of applications within a virtual machine

Routing messages in a virtualized environment. A communication that was issued from an application executing on an operating system is intercepted. The communication is intended to be sent to an intended recipient that is executing on, or is a kernel of, the operating system. A determination is made, based upon a policy, whether to forward the communication to the intended recipient or to route the communication to a virtual machine executing upon the same physical device as the application. The policy allows a user to specify what types of information and device resources are available to each application.

Growing community of inventors

Cambridge, United Kingdom

Adrian Taylor