Mellanox Technologies, Ltd.

Nvidia Corporation

Ahmad Atamli

Ariel Shahar

Yuval Itkin

Miriam Menes

Ilan Pardo

Uria Basher

Yaniv Strassberg

Itsik Levi

Mor Hoyda Sfadia

Mark Douglas Hummel

Eitan Zahavi

Gil Bloch

Mark Alan Overby

Glenn A Dearth

Boris Pismenny

Shahaf Shuler

Edward L Riegelsberger

Rami Ailabouni

Ahmad Saleh

Thanh Nguyen

Gabi Liron

Meni Orenbach

Ariel Levanon

Varun Sampath

Nadir Muhammad Khan

The technology disclosed herein enables selective clearing of memory regions upon a context switch. An example method includes the operations of: receiving a memory access request referencing a memory region; determining an identifier of a current execution context associated with the memory region; determining an identifier of a previous execution context specified by metadata associated with the memory region; responsive to determining that the identifier of the current execution context does not match the identifier of the previous execution context, updating the metadata associated with the memory region to store the identifier of the current execution context; clearing at least a part of the memory region; and processing the memory access request with respect to the memory region.

Maintaining data confidentiality in shared computing environments

Embodiments of the present disclosure are directed to efficient processes for recovering a hardware device in a computing system. Generally speaking, embodiments of the present disclosure include a two-part device recovery process. In a first part of the two-part process, an initial firmware image can be provided to the recovery device over a first, slower communication bus of the computing system. This initial image can provide the core for the device to communicate using a second, faster communications by of the computing system. A second part of the two-part process can then take place utilizing the second, faster communication bus.

Efficient device recovery

A confidential computing (CC) apparatus includes a CPU and a peripheral device. The CPU is to run a hypervisor that hosts one or more Trusted Virtual Machines (TVMs). The peripheral device is coupled to the CPU and to an external memory. The CPU includes a TVM-Monitor (TVMM), to perform management operations on the one or more TVMs, to track memory space that is allocated by the hypervisor to the peripheral device in the external memory, to monitor memory-access requests issued by the hypervisor to the memory space allocated to the peripheral device in the external memory, and to permit or deny the memory-access requests, according to a criterion.

Confidential computing with device memory isolation

A computer system includes a volatile memory and at least one processor. The volatile memory includes a protected storage segment (PSS) configured to store firmware-authentication program code for authenticating firmware of the computer system. The at least one processor is configured to receive a trigger to switch to a given version of the firmware, to obtain, in response to the trigger, a privilege to access the PSS, to authenticate the given version of the firmware by executing the firmware-authentication program code from the PSS, to switch to the given version of the firmware upon successfully authenticating the given version, and to take an alternative action upon failing to authenticate the given version.

Secure in-service firmware update

The technology disclosed herein enables an auxiliary device to run a service that can access and analyze data of a Trusted Execution Environment (TEE). The auxiliary device may establish an auxiliary TEE in the auxiliary device and establish a trusted communication link between the auxiliary TEE and the TEE (i.e., primary TEE). The primary TEE may execute a target program using the primary devices of a host device (e.g., CPU) and the auxiliary TEE may execute a security program using the auxiliary device (e.g., DPU). In one example, the primary and auxiliary TEEs may be established for a cloud consumer and the auxiliary TEE may execute a security service that can monitor data of the primary TEE even though the data is inaccessible to all other software executing external to the primary TEE (e.g., inaccessible to host operating system and hypervisor).

Preserving confidentiality of tenants in cloud environment when deploying security services

Apparatuses, systems, and techniques are presented to configure computing resources to perform various tasks. In at least one embodiment, an approach presented herein can be used to verify whether a network of computing nodes is properly configured based, at least in part, on one or more expected data strings generated by the network of computing nodes.

Path attestation for computing resources

Growing community of inventors

Oxford, United Kingdom

Ahmad Atamli