Intel Corporation

Mcafee, Inc.

Scott H Robinson

Robert Conrad Knauerhase

Steven M Bennett

Vijay Tewari

Vincent J Zimmer

Michael Lemay

Karanvir S Grewal

Nitin V Sarangdhar

Ravi L Sahita

Andrew V Anderson

Geoffrey S Strongin

Howard C Herbert

Gustavo P Espinosa

Robin C Knauerhase

Konrad K Lai

Bin Xing

Jason Martin

James Paul Held

Keith L Shippy

Wen-Hann Wang

Ulhas S Warrier

Ansuya Negi

Jih-Kwon Peir

Steve Y Zhang

Ramkumar Venkatachary

Karanvir Ken S Grewal

Rita H Wouhaybi

Martin Guy Dixon

Carlos V Rozas

Tobias Max Kohlenberg

James W Tschanz

Shih-Lien L Lu

Christopher B Wilkerson

Scott Dion Rodgers

Uttam K Sengupta

Jonathan Lewis Edwards

Sham M Datta

Bo A Zhang

Richard T Beckwith

Jose K Sia, Jr

Mark Shanahan

Vinay Phegade

Larry O Smith

Mark E Scott-Nash

Vishakha Gupta

Shanwei Cen

Stephen J Allen

Maria Bezaitis

Bill Alexander

Timothy G Coppernoll

A method for unifying VMs comprises presenting, in a display device, a unified view that includes GUI elements for multiple applications that execute in respective VMs in a computing device. The operation of presenting the unified view may be performed by a unification console that executes in a dedicated VM. The method also comprises (a) after presenting the unified view, receiving, by the unification console, user input pertaining to a selected application; (b) redirecting the user input from the unification console in the dedicated VM to the selected application in its respective VM; (c) receiving, by the unification console outside of the VM for the selected application, application output from the selected application; and (d) rendering output for a user, based on the application output received by the unification console. Other embodiments are described and claimed.

Method, apparatus and system for transparent unification of virtual machines

Technologies for end-to-end biometric-based authentication and locality assertion include a computing device with one or more biometric devices. The computing device may securely exchange a key between a driver and a secure enclave. The driver may receive biometric data from the biometric sensor in a virtualization-protected memory buffer and encrypt the biometric data with the shared key. The secure enclave may decrypt the biometric data and perform a biometric authentication operation. The computing device may measure a virtual machine monitor (VMM) to generate attestation information for the VMM. A secure enclave may execute a virtualization report instruction to request the attestation information. The processor may copy the attestation information into the secure enclave memory. The secure enclave may verify the attestation information with a remote attestation server. If verified, the secure enclave may provide a shared secret to the VMM. Other embodiments are described and claimed.

Technologies for end-to-end biometric-based authentication and platform locality assertion

A computing device comprises instructions that, when executed, enable the computing device to present a logical representation of a unified view of virtual machines (VMs), each of which executes a respective application in the computing device. The logical representation of the unified view includes a plurality of graphical user interface (GUI) elements for the applications. The operation of presenting the logical representation of the unified view is performed, at least in part, by a unification console that executes in a dedicated VM. The unification console also facilitates operations such as receiving user input pertaining to a selected application among the applications and receiving application output from the selected application. The user input from the unification console is redirected to the selected application in its respective VM. Output is rendered for the user, based on the application output received by the unification console. Other embodiments are described and claimed.

Selective/controlled disclosure of user information to private workspaces of other users/invitees based on context/contextual relations, and a shared workspace or market to collaborate amongst the other users (e.g., to crowd-source gifts of interest to the recipient). Contextual disclosure may be based on common context or commonality under a set of conditions, such as a topic, which may include known topics of relationships amongst the users and/or undiscovered contexts. As an example, items of interest to each user are identified and clustered, keywords are assigned to the clusters indicative of topics/subjects of interests to the respective users, recipient keywords are compared to keywords of an invitee to identify common keywords as shared interests, and items of interest to the recipient that relate to the common keywords are disclosed to the invitee as a personalized wish-list. Keyword weighting and/or keyword/item level privacy designations may be provided to further control disclosure.

Selective sharing of user information based on contextual relationship information, such as to crowd-source gifts of interest to a recipient

Systems, apparatuses and methods may provide for verifying, from outside a trusted computing base of a computing system, an identity an enclave instance prior to the enclave instance being launched in the trusted computing base, determining a memory location of the enclave instance and confirming that the memory location is local to the computing system. In one example, the enclave instance is a proxy enclave instance, wherein communications are conducted with one or more additional enclave instances in the trusted computing base via the proxy enclave instance and an unencrypted channel.

Trusted launch of secure enclaves in virtualized environments

A technique allows for protecting a PCI device controller from a PCI BDF masquerade attack from Ring-and Ring-malware. The technique may use Virtualization technologies to create guest virtual machines that can use a hypervisor to allocate ACPI information from ACPI tables to a secure VM and using extended page tables (EPT) and VT-d policies to protect the MMIO memory range during illegal runtime events.

Method and apparatus for protecting a PCI device controller from masquerade attacks by malware

Sensor data may be filtered in a secure environment. The filtering may limit distribution of the sensor data. Filtering may modify the sensor data, for example, to prevent identification of a person depicted in a captured image or to prevent acquiring a user's precise location. Filtering may also add or require other data use controls to access the data. Attestation that a filter policy is being applied and working properly or not may be provided as well.

Verified sensor data processing

A virtual environment manager ('VEM') simplifies the usability of virtual machines and provides users with an enhanced design for creating and/or for managing virtual machines ('VMs'). For example, a user can select description information and management information to be included in descriptors and according to which a VEM will create and manage various VM environments for various host environments. The VEM automatically creates the VM environments and host environments by sending descriptor description information and data files associated with the description information to virtual machine monitors (VMMs), which create the VM environments according to the description information. A VEM at each host may manage VM environments executed by the VMM, according to the descriptor management information. Thus, a set of descriptors to create and manage a set of VMs for a home computer may be easily modified by a user to create and manage a set of VMs for a work or laptop computer.

Virtual environment manager

Solutions for controlling data exposure among computing entities are described. A data transfer agent (DTA) module includes a data payload portion to store information content conditionally transferable to at least one other DTA module, and a code portion containing instructions that operationally implement: a DTA connectivity link to the at least one other DTA module; an attestation module to obtain, via the DTA connectivity link, attestation from each of the at least one other DTA module indicating a data output connectivity configuration of that other DTA module; and a decision module to determine a degree of permissible interaction with each of the at least one other DTA module based the attestation and on decision criteria.

Attestable information flow control in computer systems

Technologies for sensor privacy on a computing device include receiving, by a sensor controller of the computing device, sensor data from a sensor of the computing device; determining a sensor mode for the sensor; and sending privacy data in place of the sensor data in response to a determination that the sensor mode for the sensor is set to a private mode. The technologies may also include receiving, by a security engine of the computing device, a sensor mode change command from a user of the computing device via a trusted input/output path of the computing device; and sending a mode command to the sensor controller to set the sensor mode of the sensor based on the sensor mode change command, wherein the sending the mode command comprises sending the mode command over a private bus established between the security engine and the sensor controller. Other embodiments are described herein.

Sensor privacy mode

Virtual environment manager for creating and managing virtual machine environments

According to an embodiment of the invention, a method for operating a data processing machine is described in which data about a state of the machine is written to a location in storage. The location is one that is accessible to software that may be written for the machine. The state data as written is encoded. This state data may be recovered from the storage according to a decoding process. Other embodiments are also described and claimed.

Accessing private data about the state of a data processing machine from storage that is publicly accessible

In one embodiment, a semiconductor integrated code (SIC) may be provided in a binary format by a processor manufacturer. This SIC may include platform independent code of the processor manufacturer. Such code may include embedded processor logic to initialize the processor and at least one link that couples the processor to a memory, and embedded memory logic to initialize the memory. Other embodiments are described and claimed.

Providing silicon integrated code for a system

Growing community of inventors

Portland, OR, United States of America

Scott H Robinson