Microsoft Technology Licensing, LLC

Vishal Soni

Ishwar Agarwal

Thomas W Kuehnel

Siamak Tavallaei

Bryan David Kelly

Humayun Mukhtar Khan

Gursharan Singh Sidhu

Anish Desai

Mansoor Jafry

Ranveer Chandra

Bharat S Pillilli

John Mark Miller

Ruchir Astavans

Daniel Sebastian Berger

Lisa Ru-feng Hsu

Rao Salapaka

Janaina Barreiro Gambaro Bueno

Aninda Manocha

Rod G Fleck

John David Bruner

Mahendra D Sekaran

Sankaran Narayanan

James M Lyon

Namendra Kumar

Jeffrey B Kay

Abhilash Chandrasekharan Nair

Hugh A Teegan

Stanko Novakovic

Gaurav Pancholi

Lisa Ru-Feng Hsu

Tony Bell

Ken Wolfe

Systems and methods for a confidential compute architecture integrated with direct swap caching are described. An example method for managing a near memory and a far memory includes, in response to determining that the far memory contains an encrypted version of a first block of data, retrieving from the far memory the encrypted version of the first block of data, decrypting the first block of data using a first key for exclusive use by a first virtual machine associated with the system, and providing a decrypted version of the first block of data to the requestor. The method further includes swapping out a second block of data having an address conflict with the first block of data from the near memory to the far memory, where the second block of data is encrypted using a second key for exclusive use by a second virtual machine associated with the system.

Confidential compute architecture integrated with direct swap caching

A method for memory address mapping in a disaggregated memory system includes receiving an indication of one or more ranges of host physical addresses (HPAs) from a compute node of a plurality of compute nodes, the one or more ranges of HPAs including a plurality of memory addresses corresponding to different allocation slices of the disaggregated memory pool that are allocated to the compute node. The one or more ranges of HPAs are converted into a contiguous range of device physical addresses (DPAs). For each DPA, a target address decoder (TAD) is identified based on a slice identifier and a slice-to-TAD index. Each DPA is mapped to a media-specific physical element of a physical memory unit of the disaggregated memory pool based on the TAD.

Addressing for disaggregated memory pool

Systems and methods related to flush plus reload cache side-channel attack mitigation are described. An example method for mitigating a side-channel timing attack in a system including a processor having at least one cache is described. The method includes receiving a first instruction, where the first instruction, when executed by the processor, is configured to flush at least one cache line from the at least one cache associated with the processor. The method further includes, prior to execution of the first instruction by the processor, automatically mapping the first instruction to a second instruction such that the at least one cache line is not flushed from the at least one cache even in response to receiving the first instruction.

Systems and methods for flush plus reload cache side-channel attack mitigation

Techniques for ensuring address translation services (ATS) functionality is used correctly and safely for any type of device that supports ATS, even for devices that might potentially be acting in a rogue manner, are disclosed. A host performs an integrity check on a device that uses ATS to prevent the device from maliciously using a locally cached HPA. The device submits a first ATS-enabled request to the host. The device receives metadata comprising (i) a first integrity check vector (ICV) that is usable to authenticate the device, (ii) the HPA, and (iii) an initialization vector (IV). The device locally caches the metadata in an address translation cache (ATC). The device submits a second ATS-enabled request, which includes the metadata. The host then independently authenticates the device using the received metadata in the request.

Securing ATS from rogue devices for confidential computing

The present disclosure relates to systems, methods, and computer-readable media for tracking memory usage data on a memory controller system and providing a mechanism whereby one or multiple accessing agents (e.g., computing nodes, applications, virtual machines) can access memory usage data for a memory resource managed by a memory controller. Indeed, the systems described herein facilitate generation of and access to heatmaps having memory usage data thereon. The systems described herein describe features and functionality related to generating and maintaining the heatmaps as well as providing access to the heatmaps to a variety of accessing agents. This memory tracking and accessing is performed using low processing overhead while providing useful information to accessing agents in connection with memory resources managed by a memory controller.

Managing and ranking memory resources

A system includes a stored counter value and a stored boot manifest including a manifest type flag. A manifest type of the boot manifest is determined based on the manifest type flag, a tenancy mode is determined based on a parity of the counter value, a first boot is executed if the manifest type is a first manifest type and the tenancy mode is a first tenancy mode, a second boot flow is executed if the manifest type is the first manifest type and the tenancy mode is a second tenancy mode, a third boot flow is executed if the manifest type is a second manifest type and the tenancy mode is the first tenancy mode, and a fourth boot flow is executed if the manifest type is the second manifest type and the tenancy mode is the second tenancy mode.

Firmware-based secure tenancy transfer

Examples are disclosed that relate to a disaggregated memory pool. One example provides a memory system comprising a memory controller and memory attached to the memory controller and forming at least a portion of a disaggregated memory pool, the disaggregated memory pool including a plurality of slices that are each dynamically assigned to a respective compute node. The memory system is configured to receive a request to adjust an assignment of the memory pool to a requesting compute node, where the portion of the memory pool includes an unassigned slice that can satisfy the request, assign at least part of the unassigned portion to the requesting compute node, and where the portion of the memory pool does not include an unassigned slice that can satisfy the request, cause a request to be directed to another compute node to free at least one slice to the such compute node.

Disaggregated memory pool assignment

A continual learning process is applied to a class of risk estimate-based algorithms and associated risk thresholds used for deciding when to initiate a handoff between different types of network connections that are available to a mobile device having telephony functionality. The process is implemented as a virtuous loop providing ongoing tuning and adjustment to improve call handoff algorithms and risk thresholds so that handoffs can be performed with the goals of minimizing dropped calls and unacceptable degradation in call quality as well as avoiding premature handoffs. Device characteristics, environmental context, connection measurements, and outcomes of call handoff decisions are crowd-sourced from a population of mobile devices into a cloud-based handoff decision enabling service. The service evaluates potentially usable handoff decision algorithms and risk thresholds against archived crowd-sourced data to determine how they would have performed in real world situations and delivers improved algorithms and risk thresholds to the mobile devices.

Call handoff initiation in hybrid networks

Techniques and tools are described for transmitting beacon messages using a wireless communication protocol, such as the Bluetooth Low Energy protocol. In some examples, beacon messages can be generated in a compact format and included in an AdvData portion of a payload of a protocol data unit of a Bluetooth Low Energy advertising channel packet. A beacon message can be transmitted from a stationary beacon generation device and broadcast to an area within a transmission range of the beacon generation device, and mobile computing devices, such as mobile phones, can receive the beacon message and perform one or more actions in response to information contained in the beacon message, all while conserving energy used by the beacon generation device and the mobile computing device.

Low energy beacon encoding

Voice call continuity is provided for calls that are carried over a hybrid network infrastructure in which access connections are distributed over loosely coupled network portions including a backend network such as a core VoIP (Voice over Internet Protocol) service network, one or more cellular mobile networks, and a public switched telephone network ('PSTN'). The calls are routed through the core VoIP network regardless of their points of origination or termination in other network portions so that signaling and call context are anchored in the core VoIP network. The conditions under which user equipment operate are continuously monitored so that when a connection is determined to have been unacceptably degraded or is likely to be interrupted, and/or a more optimal connection is available, a handover of the call to another connection is initiated so that call continuity is maintained using the lowest cost connection that provides acceptable call quality.

Voice call continuity in hybrid networks

Growing community of inventors

Redmond, WA, United States of America

Vishal Soni