Microsoft Technology Licensing, LLC

Bryan William Tuttle

Mark Eugene Russinovich

James Ernest Johnson

Ajay Mani

Ashish Consul

Yimin Deng

Carlos Jose Cela

Huy Hoang

Alejandro Matute Gonzalez

Huy Vu-Bao Hoang

Albert Gordon Greenberg

Robert George Atkinson

Daniel Max Firestone

Pankaj Garg

Louis Lafreniere

James W Kelly

Saurabh Mohan Kulkarni

Robert M Price

Robert P Reichel

Melur K Raghuraman

Richard M Shupak

Philip Lucido

Yue Zuo

HoYuen Chau

Ho-Yuen Chau

Brandon R Bray

Hoyuen Chau

Daniel R Spalding

Ho Yuen Chau

A bare metal resource includes a trusted portion and an untrusted portion. The trusted portion includes trusted hardware, an image repository, and a clearance manager. The clearance manager is executable during bootup of the bare metal resource to perform a clearance process on the untrusted portion, including deleting the BIOS in the untrusted portion and loading a trusted BIOS from the image repository on the untrusted hardware, to place the untrusted portion in a trusted state. The bare metal resource may be provisioned to a tenant of a cloud provider after being placed in the trusted state.

Clearance of bare metal resource to trusted state usable in cloud computing

A graphics rendering system is provided for controlling the rendering of images to manage expected errors. The graphics rendering system receives a specification of a render task to be performed to render an image of a graphics scene and then identifies computing devices that each have a graphics processing unit. The graphics rendering system directs each of the identified computing devices to render the image specified by the render task such that each identified computing device renders the same image. When the graphics rendering system detects that a computing device has completed the render task successfully, it provides the image rendered by that computing device as the rendered image of the render task such that any other image rendered by another of the computing devices is not needed.

Management of graphics processing units in a cloud platform

In various embodiments, methods and systems for optimizing allocation of dynamic resources are provided. A user service request resource instance is received at an allocator. The user service request resource instance is based on a dynamic resource protocol that supports generating and communicating resource instances between components in a resource allocation platform. The dynamic resource protocol also defines a set of rules for translating and representing resources as logical resource types and logical units. At a node, a node resource instance is generated and communicated, based on the dynamic resource protocol, from the node to the allocator. The node resource instance specifically comprises a resource interaction matrix that indicates dependencies between resource types. A resource allocation instance is generated at the allocator for the user service request resource instance. The resource allocation instance is communicated, such that, resource types on the node are allocated based on the resource allocation instance.

Optimal allocation of dynamic cloud computing platform resources

Computing systems, devices, and associated methods of managing secure communication using hardware accelerators are disclosed herein. In one embodiment, a method includes receiving messages from a peer computing device via a computer network at a FPGA of a hardware accelerator and examining each of the received messages to determine whether the received messages contain application data. The method can then include forwarding a first subset of the received messages that do not contain application data to the processor for further processing and processing a second subset of the messages containing application data according to a security protocol without forwarding the second subset to the processor to reduce a consumption of bandwidth across the communications bridge.

Hardware-accelerated secure communication management

The present invention extends to methods, systems, and computer program products for offloading packet processing for networking device virtualization. A host maintains rule set(s) for a virtual machine, and a physical network interface card (NIC) maintains flow table(s) for the virtual machine. The physical NIC receives and processes a network packet associated with the virtual machine. Processing the network packet includes the physical NIC comparing the network packet with the flow table(s) at the physical NIC. When the network packet matches with a flow in the flow table(s) at the physical NIC, the physical NIC performs an action on the network packet based on the matching flow. Alternatively, when the network packet does not match with a flow in the flow table(s) at the physical NIC, the physical NIC passes the network packet to the host partition for processing against the rule set(s).

Offloading packet processing for networking device virtualization

Safe exceptions detect and intervene in a malicious attack against an application or system component, even in the presence of a coding flaw such as a buffer overrun. A list of all the exception handlers in an image (e.g., a DLL or EXE) is desirably created. When loading the image into a process, the operating system loader finds and stores a reference to this list. When a subsequent attack targets exception handling by creating an attacker provided exception handler, the new attacker provided exception handler is compared to a list of the real exception handlers. The list of real exception handlers is stored in memory, and desirably cannot be modified. In particular, when an exception occurs, the operating system finds the proper exception handler from information on the stack (this may be under attack, so the information is not trusted) and compares it to the previously created read-only reference list. If the exception handler that has occurred is found on the reference list, the exception handler is allowed to execute. Otherwise, the operating system assumes the application is under attack and terminates the process' execution.

Safe exceptions

A certification or signature is incorporated in a computer program, an executable file, or code to assure its authenticity and integrity, particularly for receiving it over an open computer network like the Internet. The executable file may be of any executable form, including an executable or portable executable .exe file format, a .cab cabinet file format, an .ocx object control format, or a Java class file. The certification includes a keyed source confirmation with a secure representation of the executable file. In an embodiment, the certification is referenced in a header of the executable file, the reference including a pointer to the keyed source confirmation and an indication of the size of the keyed source confirmation.

Embedding certifications in executable files for network transmission

Growing community of inventors

Newcastle, WA, United States of America

Bryan William Tuttle