Intel Corporation

Vmware, Inc.

Hewlett-packard Development Company, L.P.

Alberto J Munoz

Xiaoxin Chen

Mohan J Kumar

Murugasamy K Nachimuthu

Sahil Rihan

Mahesh S Natu

Sorin Iacobovici

Jeffrey W Sheldon

Sergiu D Ghetie

Shamanna M Datta

Neeraj S Upasani

Johan G Van De Groenendaal

Wojciech S Powiertowski

Steve Orrin

Sagar V Dalvi

Jeanne Guillory

Chukwunenye S Nnebe

Scott T Durrant

Robert D Manchester

Lance Warren Russell

Thomas D Lovett

Tessil Thomas

Fong Pong

Dean A Mulla

Nhon Toai Quach

Todd M Rimmer

Brent D Thomas

Yeluri Raghuram

Anil S Keshavamurthy

James O Hays

Lu Xu

Valentin Anders

John W C Fu

Thomas Wylegala

Stephen L Hoyle

Yeluri Ranghuram

Dejan S Miloiicic

Technologies for attesting a deployment of a workload using a blockchain includes a compute engine that receives a request from a remote device to validate one or more parameters of a managed node composed of one or more sleds. The compute engine retrieves a blockchain associated with the managed node. The blockchain includes one or more blocks, each block including information about the parameters of the managed node. The compute engine validates the blockchain and sends an indication that the blockchain is valid to the requesting device.

Technologies for attesting a deployed workload using blockchain

Embodiments are generally directed apparatuses, methods, techniques and so forth to receive a sled manifest comprising identifiers for physical resources of a sled, receive results of an authentication and validation operations performed to authenticate and validate the physical resources of the sled, determine whether the results of the authentication and validation operations indicate the physical resources are authenticate or not authenticate. Further and in response to the determination that the results indicate the physical resources are authenticated, permit the physical resources to process a workload, and in response to the determination that the results indicate the physical resources are not authenticated, prevent the physical resources from processing the workload.

Techniques to verify and authenticate resources in a data center computer environment

Technologies for generating manifest data for a sled include a sled to generate manifest data indicative of one or more characteristics of the sled (e.g., hardware resources, firmware resources, a configuration of the sled, or a health of sled components). The sled is also to associate an identifier with the manifest data. The identifier uniquely identifies the sled from other sleds. Additionally, the sled is to send the manifest data and the associated identifier to a server. The sled may also detect a change in the hardware resources, firmware resources, the configuration, or component health of the sled. The sled may also generate an update of the manifest data based on the detected change, where the update specifies the detected change in the hardware resources, firmware resources, the configuration, or component health of the sled. The sled may also send the update of the manifest data to the server.

Technologies for providing manifest-based asset representation

Technologies for fabric security include one or more managed network devices coupled to one or more computing nodes via high-speed fabric links. A managed network device enables a port and, while enabling the port, securely determines the node type of the link partner coupled to the port. If the link partner is a computing node, management access is not allowed at the port. The managed network device may allow management access at certain predefined ports, which may be connected to one of more management nodes. Management access may be allowed for additional ports in response to management messages received from the management nodes. The managed network device may check and verify data packet headers received from a compute node at each port. The managed network device may rate-limit management messages received from a compute node at each port. Other embodiments are described and claimed.

Technologies for high-performance network fabric security

An apparatus and method for hardware protection of a virtual machine monitor (VMM) runtime integrity watcher is described. A set of one or more hardware range registers that protect a contiguous memory space that is to store the VMM runtime integrity watcher. The set of hardware range registers are to protect the VMM runtime integrity watcher from being modified when loaded into the contiguous memory space. The VMM runtime integrity watcher, when executed, performs an integrity check on a VMM during runtime of the VMM.

Hardware protection of virtual machine monitor runtime integrity watcher

A method, device, and system for securely migrating and provisioning a virtual machine image to a host device of a cloud service provider environment (CSPE) is disclosed. A customer device encrypts a virtual machine image (VMI) and stores the VMI in the CSPE. The host device retrieves the encrypted VMI from the object store and sends host trust data (including a symmetric key extracted from the encrypted VMI, the symmetric key being encrypted with the customer public key) to a key management server for trust attestation. If the key management server successfully attests the host device, the key management server decrypts the encrypted symmetric key using the customer private key and re-encrypts the symmetric key using the host public key. The host device receives the re-encrypted symmetric key from the key management server, decrypts it using the host private key, and decrypts the encrypted VMI using the symmetric key.

Method and system to securely migrate and provision virtual machine images and content

Embodiments of apparatus, computer-implemented methods, systems, devices, and computer-readable media are described herein for tracking per-virtual machine ('VM') resource usage independent of a virtual machine monitor ('VMM'). In various embodiments, a first logic unit may associate one or more virtual central processing units (&#x201c;vCPUs&#x201d;) operated by one or more physical processing units of a computing device with a first VM of a plurality of VMs operated by the computing device, and collect data about resources used by the one or more physical processing units to operate the one or more vCPUs associated with the first VM. In various embodiments, a second logic unit of the computing device may determine resource-usage by the first VM based on the collected data. In various embodiments, the first and second logic units may perform these functions independent of a VMM of the computing device.

Monitoring resource usage by a virtual machine

An apparatus and method for hardware protection of a virtual machine monitor (VMM) runtime integrity watcher is described. A set of one or more hardware range registers that protect a contiguous memory space that is to store the VMM runtime integrity watcher. The set of hardware range registers are to protect the VMM runtime integrity watcher from being modified when loaded into the contiguous memory space. The VMM runtime integrity watcher, when executed, performs an integrity check on a VMM during runtime of the VMM. Execution of the VMM runtime integrity watcher is triggered by a timer event generated based on multiple frequency bands.

Timer for hardware protection of virtual machine monitor runtime integrity watcher

Methods and apparatus to provide core sparing on multi-core platforms are described. In an embodiment, stored core state information of a target core (e.g., a core that has detected a fault condition (e.g., within its circuitry) or a request to offload operations from the target core (e.g., to enable run-time diagnostics without interfering with system software)) may be read by a spare core which is to operationally replace the target core. Other embodiments are also described.

Core sparing on multi-core platforms

The computer program includes a virtualization software that is executable on the new processor in the legacy mode. The new processor includes a legacy instruction set for a legacy operating mode and a new instruction set for a new operation mode. The switching includes switching from the new instruction set to the legacy instruction set and switching paging tables. Each of the new operating mode and the legacy operating mode has separate paging tables. The switch routine is incorporated in a switch page that is locked in physical memory. The switch page has a first section to store a part of switching instructions conforming to the new instruction set and a second section to store another part of the switching instructions conforming to the legacy instruction set.

Switching between multiple software entities using different operating modes of a processor

A virtual memory system implementing the invention provides concurrent access to translations for virtual addresses from multiple address spaces. One embodiment of the invention is implemented in a virtual computer system, in which a virtual machine monitor supports a virtual machine. In this embodiment, the invention provides concurrent access to translations for virtual addresses from the respective address spaces of both the virtual machine monitor and the virtual machine. Multiple page tables contain the translations for the multiple address spaces. Information about an operating state of the computer system, as well as an address space identifier, are used to determine whether, and under what circumstances, an attempted memory access is permissible. If the attempted memory access is permissible, the address space identifier is also used to determine which of the multiple page tables contains the translation for the attempted memory access.

Accessing multiple page tables in a computer system

In a virtual computer system, the invention virtualizes a primary protection mechanism, which restricts memory accesses based on the type of access attempted and a current hardware privilege level, using a secondary protection mechanism, which is independent of the hardware privilege level. The invention may be used to virtualize the protection mechanisms of the Intel IA-64 architecture. In this embodiment, virtual access rights settings in a virtual TLB are translated into shadow access rights settings in a hardware TLB, while virtual protection key settings in a virtual PKR cache are translated into shadow protection key settings in a hardware PKR cache, based in part on the virtual access rights settings. The shadow protection key settings are dependent on the guest privilege level, but the shadow access rights settings are not.

Virtualization system for computers having multiple protection mechanisms

Growing community of inventors

Los Altos, CA, United States of America

Alberto J Munoz