Nvidia Corporation

Mellanox Technologies, Ltd.

Mark Alan Overby

Andrew Currid

Robert William Chapman

Nirmal Raj Saxena

Naveen Cherukuri

Mark Hairgrove

Lucien Dunning

Daniel Jonas Major

Vyas Venkataraman

Michael Asbury Woodmansee

Gobikrishna Dhanuskodi

Dwayne Frank Swoboda

Sudeshna Guha

Philip John Rogers

Xing Cindy Chen

Nicola Di Miscio

Yong Zhang

Varadharajan Kannan

Rick Dingle

Shailender Chaudhry

David Wyatt

Franck Diard

Sagheer Ahmad

Michael John Sebastian Smith

Ambuj Kumar

David G Reed

Rambod Jacoby

Luc R Bisson

Christopher Schneider

Ahmad Atamli

John George Mathieson

Ahmad Saleh

Rami Ailabouni

Thanh Nguyen

Cyndi Jung

Hon Fei Chong

Suyash Ranjan

Ariel Levanon

Gorkem Batmaz

Nicola DiMiscio

Ildiko Pete

Amy Leigh Schneider Rose

Francesco Saracino

Daniel Rohrer

Muralidharan Soundararajan Chilukoor

In various examples, a user may be authenticated without disclosing any confidential or private information of the user. An independent accumulator stores user confidential information, and accumulates items issued by various parties for the user. When another entity requests to verify the item and the user, the accumulator may verify the user by verifying his or her possession of the item and his or her private information. The accumulator may also verify the item with the issuing party and verify that the item was intended for the user. Once verification has occurred, the accumulator informs the requesting entity that their request is confirmed. In this manner, entities may verify items of a user, without requiring the user to disclose any of his or her confidential or private information to the requestor.

Conducting multi-party authentication in a privacy preserving manner

Approaches in accordance with various embodiments allow for zero-touch enrollment of devices with respective manager systems. In at least one embodiment, a device at startup can contact a central directory service (CDS) for information about an associated manager. The CDS can authenticate the device using device information included in the request, and can send a challenge token to the device in response. The challenge token can include information for the manager, protected with multiple layers of security that should only be able to be decrypted by the authenticated device. The device can decrypt this challenge token to determine the manager information, and can convert this challenge token to a bearer token. The device can then send a request to the determined manager that includes the bearer token, which the manager can use to authenticate the device. The manager can then send the device appropriate configuration information.

Token-based zero-touch enrollment for provisioning edge computing applications

Apparatuses, systems, and techniques to generate a trusted execution environment including multiple accelerators. In at least one embodiment, a parallel processing unit (PPU), such as a graphics processing unit (GPU), operates in a secure execution mode including a protect memory region. Furthermore, in an embodiment, a cryptographic key is utilized to protect data during transmission between the accelerators.

Implementing trusted executing environments across multiple processor devices

Secure execution for multiple processor devices using trusted executing environments

Various approaches are disclosed for protecting vehicle buses from cyber-attacks. Disclosed approaches provide for an embedded system having a hypervisor that provides a virtualized environment supporting any number of guest OSes. The virtualized environment may include a security engine on an internal communication channel between the guest OS and an external vehicle bus of a vehicle to analyze network traffic to protect the guest OS from other guest OSes or other network components, and to protect those network components from the guest OS. Each guest OS may have its own security engine customized for the guest OS to account for what is typical or expected traffic for the guest OS (e.g., using machine learning, anomaly detection, etc.). Also disclosed are approaches for corrupting a message being transmitted on a vehicle bus to prevent devices from acting on the message.

Protecting vehicle buses from cyber-attacks

The technology disclosed herein enables an auxiliary device to run a service that can access and analyze data of a Trusted Execution Environment (TEE). The auxiliary device may establish an auxiliary TEE in the auxiliary device and establish a trusted communication link between the auxiliary TEE and the TEE (i.e., primary TEE). The primary TEE may execute a target program using the primary devices of a host device (e.g., CPU) and the auxiliary TEE may execute a security program using the auxiliary device (e.g., DPU). In one example, the primary and auxiliary TEEs may be established for a cloud consumer and the auxiliary TEE may execute a security service that can monitor data of the primary TEE even though the data is inaccessible to all other software executing external to the primary TEE (e.g., inaccessible to host operating system and hypervisor).

Preserving confidentiality of tenants in cloud environment when deploying security services

The disclosure provides systems and processes for applying neural networks to detect intrusions and other anomalies in communications exchanged over a data bus between two or more devices in a network. The intrusions may be detected in data being communicated to an embedded system deployed in vehicular or robotic platforms. The disclosed system and process are well suited for incorporation into autonomous control or advanced driver assistance system (ADAS) vehicles including, without limitation, automobiles, motorcycles, boats, planes, and manned and un-manned robotic devices. Data communicated to an embedded system can be detected over any of a variety of data buses. In particular, embodiments disclosed herein are well suited for use in any data communication interface exhibiting the characteristics of a lack of authentication or following a broadcast routing scheme—including, without limitation, a control area network (CAN) bus.

Detecting data anomalies on a data interface using machine learning

Various approaches are disclosed to virtualizing intrusion detection and prevention. Disclosed approaches provide for an embedded system having a hypervisor that provides a virtualized environment supporting any number of guest OSes. The virtualized environment may include a security engine on an internal communication channel between the guest OS and a virtualized hardware interface (e.g., an Ethernet or CAN interface) to analyze network traffic to protect the guest OS from other guest OSes or other network components, and to protect those network components from the guest OS. The security engine may be on a different partition than the guest OS and the virtualized hardware interface providing the components with isolated execution environments that protect against malicious code execution. Each guest OS may have its own security engine customized for the guest OS to account for what is typical or expected traffic for the guest OS.

Virtualized intrusion detection and prevention in autonomous vehicles

This disclosure provides a method that allows connector pins of a USB-C connector to be dynamically repurposed between low bandwidth USB2 traffic and high bandwidth USB3 traffic. USB-C devices can negotiate the use of these pins for a dynamic transition to another function or functions. The pins can be the four center connector pins of a USB-C connection, pins A6, A7, B6, B7, that are originally designated as USB 2.0 differential pairs Changing the function of the pins provides flexibility for communicating using USB-C connectors. For example, the disclosed method/device/system can be used to support high-resolution cameras and sensors in high-resolution virtual reality headsets via a single USB-C connection instead of a user having to connect multiple cables.

Method to increase the bandwidth of a USB-C connector

Embodiments of the present technology provide for migrating processes executing one any one of a plurality of cores in a multi-core cluster to a core of a separate cluster without first having to transfer the processes to a predetermined core of the multi-core cluster. Similarly, the processes may be transferred from the core of the separate cluster to the given core of the multi-core cluster.

Processor cluster migration techniques

Typical hybrid graphics systems operate in either a 'high-performance mode' or in an 'energy saver mode.' While operating in the high-performance mode, a discrete graphics processing unit (dGPU) performs high-performance graphics processing operations and also receives and satisfies access requests targeting a configuration space within the dGPU. While operating in the energy saver mode, an integrated graphics processing unit (iGPU) performs graphics processing operations and the dGPU is powered down. In this scenario, a system management unit (SMU) intercepts and satisfies access requests targeting the dGPU. Since access requests targeting the dGPU are satisfied while the dGPU is powered down, the dGPU continues to be enumerated in the system using the same system resources as originally granted, and can therefore be switched to for implementing high-performance mode more quickly than if it was removed, and required a complete plug-and-play re-enumeration and re-allocation of system resources.

System and method for masking transistions between graphics processing units in a hybrid graphics system

A security command protocol provides secure authenticated access to an auxiliary security memory within a SCSI storage device. The auxiliary security memory acts as an authenticated separate secure storage area that stores sensitive data separately from the user data area of the SCSI storage device. The security command protocol is used to access the auxiliary security memory. The security command protocol allows a trusted execution environment to transport sensitive data to and from storage in the auxiliary security memory. The regular execution environment does not have access to the security command protocol or the auxiliary security memory. The security command protocol and auxiliary security memory eliminate the need for additional secure storage components in devices that provide the security features of firmware TPM.

Secure storage with SCSI storage devices

The muxed HDMI debug port methods and apparatuses are directed toward means for detecting an extended display identification data (EDID) code indicating a debug cable or debug host device coupled to the high-definition multimedia interface (HDMI) port of a computing device. In addition, the methods and apparatuses include means for disabling a display data channel (DDC) bus of the high-definition multimedia interface (HDMI) port in response to the extended display identification data (EDID) code indicating the debug cable or debug host device. Furthermore, the method and apparatuses include means for transmitting and receiving debug commands and data on a serial input (RXD) and serial output (TXD) of the high-definition multimedia interface (HDMI) port in response to the extended display identification data (EDID) code indicating the debug cable or debug host device.

HDMI-muxed debug port methods and apparatuses

One embodiment of the present invention sets forth a technique for automatically provisioning a diskless computing device and an associated server system. A diskless computing device client incorporates an iSCSI initiator that is used to access resources provided by an iSCSI target that is resident on a server computing device. The iSCSI initiator is implemented in the client firmware, providing INT13 disk services entry points, thereby enabling the client to transparently access virtual storage devices at boot time. The client device conducts an apparently local installation using the virtual storage devices provided by the server computing device. A short signature value is associated with the boot image, uniquely associating the boot image with the specific client hardware configuration. When the client device boots normally, the signature value of the client device is presented to the server computing device to automatically reference the appropriate boot image.

System and method for operating system installation on a diskless computing platform

Growing community of inventors

Bothell, WA, United States of America

Mark Alan Overby