Microsoft Technology Licensing, LLC

Alibaba Group Holding Limited

Li Shen

Danny Levin

Xiaoning Li

Yanhui Zhao

Rajesh Ramanathan

Tin Qian

Mahendra D Sekaran

Vadim Eydelman

Bimal Kumar Mehta

Gurdeep Singh Pall

Paul D Tidwell

Tim M Moore

Shiwei Wang

Russell P Bennett

Techniques for establishing a secure communication channel between a trusted portion of a system and another portion of the system and providing data over the secure communication channel are described herein. For example, a system may implement a Trusted Execution Environment (TEE) and a TEE component associated with the TEE. The TEE component may establish a secure communication channel with a Network Interface Controller (NIC) on the system, such as a smart NIC that is configured to encrypt/decrypt data and/or perform other operations. The TEE component may receive one or more cryptographic keys from a service provider and provide the one or more cryptographic keys to the NIC via the secure communication channel. The NIC may use the one or more cryptographic keys to encrypt data to send to another device, decrypt data that is received from another device, or otherwise encrypt/decrypt data.

Secure communication channel between encryption/decryption component and trusted execution environment

One embodiment provides a system for establishing a secure network. During operation, a server can distribute at least one symmetric encryption key among a plurality of hosts to enable the hosts to communicate securely with each other. Each host comprises at least a smart network interface card and a central processing unit (CPU) of each host computer supports remote attestation. Distributing the symmetric encryption key among the hosts can include performing a remote attestation operation to establish a trusted channel between the server and a protected region within the CPU of a respective host; and transmitting, over the trusted channel, the symmetric encryption key to the CPU of the respective host, which in turn forwards the symmetric encryption key to the smart network interface card of the respective host over a secure channel established between the protected region within the CPU and the smart network interface card.

Method and system for preventing data leakage from trusted network to untrusted network

Systems, methods and computer program products for facilitating the recovery of lost real-time media packets within a computer network real-time application implementing Forward Error Control (FEC), such that server performance is not affected from a CPU and memory perspective, are disclosed. In an embodiment, a conference server that is part of a communication network compliant with the Real Time Transport Protocol (RTP) is able to avoid regenerating FEC packets by not performing any FEC coding operation on the packets unless it is flagged to indicate regeneration via an FEC (e.g., Reed-Solomon) coding is necessary. Absent the flag, the conference server updates the received FEC packet as per the RTP and transmits the packet to its ultimate destination. Such disclosed systems, methods and computer program products are independent of the nature of the media being protected and flexible enough to support a wide variety of FEC techniques.

Lost real-time media packet recovery

Independent telephony systems are integrated by using symmetric forking from both systems. Calls received by either system are forked to the other system. Thus, a call can be accepted by one of the systems, using its external interfaces, and presented to all devices in both systems. Each system is enabled to leverage internal call control advanced features to enhance overall user experience. Internally inserted parameters to call requests are used between the two systems for preventing endless loop of calls between the integrated systems.

Accommodation of two independent telephony systems

Procedures for identifying audio clients in a media session are described. A gateway device may provide a unique identifier for identifying the audio client/user agent instance. In an example, a globally routable user agent universal resource indicator (GRUU) may be mapped to the gateway device servicing the audio client and a unique identifier may be provided. In examples, the gateway device may include a grid and grid value for identifying the audio client.

Global routable and grid identification for audio provider in media session

Growing community of inventors

Bellevue, WA, United States of America

Li Shen