Microsoft Technology Licensing, LLC

Michael Bishop Ebersol

Hari R Pulapaka

Benjamin M Schultz

Frederick Justus Smith

John Andrew Starks

Jonathan David Wiswall

Margarit Simeonov Chenchev

Richard O Wolcott

Jin Lin

David Hepkin

Kevin Michael Broas

Wen Jia Liu

Alexander Daniel Grest

Mehmet Iyigun

Yevgeniy Bak

Xin Zhang

Steve Pronovost

Lars Reuther

Gerardo Diaz Cuellar

Bruce John Sherwin, Jr

Poornananda R Gaddehosur

Jonathan E Lange

Ivan Dimitrov Pashov

Jason Lin

Giridhar Viswanathan

Qiang Wang

Jason Stewart Wohlgemuth

Charles Glenn Jeffries

Aditya Bhandari

Gregory John Colombo

Ahmed Saruhan Karademir

Kapil Vaswani

Navin Narayan Pai

Jingbo Wu

Attilio Mainetti

Christopher Peter Kleynhans

Antoine Jean Denis Delignat-lavaud

Steven Adrian West

David Kimler Altobelli

Emily Cara Clemens

Stephen Louis-Essman Hufnagel

Shawn Michael Denbow

Stephanie Sumyi Luck

Vikram Mangalore Rao

Dexuan Cui

Michael Halstead Kelley

Sarah Elizabeth Stephenson

Carolina Cecilia Perez-vargas

Charles G Jeffries

The techniques disclosed herein enable a system to configure a confidential virtual resource unit by provisioning a security component to a tenant's virtual resource unit. The system creates multiple different virtual trust layers within the confidential virtual resource unit. This creation effectively defines security boundaries between the virtual trust layers. The virtual trust layers are associated with different privileges, such that a higher privileged virtual trust layer is provided with more privileges compared to a lower privileged virtual trust layer. In one example, a lower privileged virtual trust layer may include basic virtual resource components (e.g., drivers, applications, processes, functions, workloads executing within a guest operating system) and a higher privileged virtual trust layer is the location to which a virtual security component is provisioned by the system.

Provisioning a security component from a cloud host to a guest virtual resource unit

Isolating resources of a virtual machine (VM) guest from a host operating system. A computer system receives an acceptance request from a guest partition corresponding to an isolated VM. The acceptance request identifies a guest memory page that is mapped into a guest physical address space of the guest partition, and a memory page visibility class. The computer system determines whether a physical memory page that is mapped to the guest memory page meets the memory page visibility class. The computer system sets a page acceptance indication for the guest memory page from an unaccepted state to an accepted state based on the physical memory page meeting the memory page visibility class.

Software isolation of virtual machine resources

Methods, systems, and computer program products for direct assignment of physical devices to confidential virtual machines (VMs). At a first guest privilege context of a guest partition, a direct assignment of a physical device associated with a host computer system to the guest partition is identified. The guest partition includes the first guest privilege context and a second guest privilege context, which is restricted from accessing memory associated with the first guest privilege context. The guest partition corresponds to a confidential VM, such that a memory region associated with the guest partition is inaccessible to a host operating system. It is determined, based on a policy, that the physical device is allowed to be directly assigned to the guest partition. Communication between the physical device and the second guest privilege context is permitted, such as by exposing the physical device on a virtual bus and/or forwarding an interrupt.

Direct assignment of physical devices to confidential virtual machines

Distribution and management of services in virtual environments is described herein. In one or more implementations, a service distribution and management model is implemented in which system services and applications are seamlessly distributed across multiple containers which each implement a different runtime environment. In one or more implementations, a system for distributing access to services in a host operating system of a computing device includes a host operating system configured to implement a host runtime environment, and one or more services implemented by the host operating system. The system further includes a service control manager configured to enable communication between a client stub of a service implemented in a client runtime environment and a service provider of the service that is implemented in a service runtime environment that is separate from the first client runtime environment.

Distribution and management of services in virtual environments

Communicating a low-latency event across a virtual machine boundary. Based on an event signaling request by a first process running at a first virtual machine, the first virtual machine updates a shared register that is accessible by a second virtual machine. Updating the shared register includes updating a signal stored in the shared register. The first virtual machine sends an event signal message, which includes a register identifier, through a virtualization fabric to the second virtual machine. The second virtual machine receives the event signaling message and identifies the register identifier from the message. Based on the register identifier, the second virtual machine reads the shared register, identifying a value of the signal stored in the shared register. Based at least on the value of the signal comprising a first value, the second virtual machine signals a second process running at the second virtual machine.

Low-latency events across a virtual machine boundary

A host operating system running on a computing device monitors network communications for the computing device to identify network resources that are requested by the computing device. The host operating system compares requested network resources against security policies to determine if the requested network resources are trusted. When an untrusted network resource is identified, the host operating system accesses the untrusted network resource within a container that is isolated from the host operating system kernel using techniques discussed herein. By restricting access to untrusted network resources to isolated containers, the host operating system is protected from even kernel-level attacks or infections that may result from an untrusted network resource.

Hardware-based virtualized security isolation

Growing community of inventors

Woodinville, WA, United States of America

Michael Bishop Ebersol