Abstract: The disclosure provides an approach for multi-endpoint cryptographic orchestration. Embodiments include establishing, by a first endpoint of a plurality of endpoints related to a multi-endpoint secure communication session, a metadata channel with one or more other endpoints of the plurality of endpoints. Embodiments include sending, by the first endpoint, to a second endpoint of the one or more other endpoints, via the metadata channel, an indication of a cryptographic requirement related to the multi-endpoint secure communication session. Embodiments include performing, by the second endpoint, one or more cryptographic operations related to the multi-endpoint secure communication session based on the indication of the cryptographic requirement. Embodiments include attesting, by the second endpoint, via the metadata channel, that the one or more cryptographic operations comply with the cryptographic requirement.

Abstract: This disclosure relates generally to configuring a legacy application or service with a reconfigurable cryptographic provider capable of leveraging many different cryptographic algorithms, protocols or functions. The application or service can be configured with the reconfigurable cryptographic provider by redirecting cryptographic API calls intended for a linked static shared cryptographic library or provider to a cryptographic adapter configured to emulate responses provided by the linked static shared cryptographic library. A cryptographic adapter is also described and is configured to generate abstracted versions of the cryptographic API calls and pass them on to the reconfigurable cryptographic provider, which selects and implements an appropriate cipher solution based on the abstracted cryptographic API calls.

Abstract: A desktop is unlocked or locked using a mobile client device, such as a smart phone, tablet, smart watch, etc. The authentication mechanism of the mobile client device, such as fingerprint, facial recognition, voice recognition, username and password, is leveraged for faster, less-cumbersome user authentication on the desktop. In this vein, a client device is added to an authentication agent on the desktop, and the desktop recognizes successful attempts to access the mobile client device as a method of unlocking or locking the desktop.

Abstract: The current document is directed a resource-exchange system that facilitates resource exchange and sharing among computing facilities. The currently disclosed methods and systems employ efficient, distributed-search methods and subsystems within distributed computer systems that include large numbers of geographically distributed data centers to locate resource-provider computing facilities that match the resource needs of resource-consumer computing-facilities based on attribute values associated with the needed resources, the resource providers, and the resource consumers. Nested-hypervisor technology is employed, in disclosed implementations, to guarantee data security for, and prevent monitoring of operational states and characteristics of, resource-consumer virtual machines and virtual applications while they execute above leased computational resources in remote computing facilities.

Abstract: Solutions for discovering and onboarding edge devices at scale include: receiving, by a device aggregator, edge device state information including state information for a first edge device; based on at least the state information for the first edge device, configuring the first edge device to perform as a software-defined wide area network (SD-WAN) node; based on at least the edge device state information, determining a first device profile for the first edge device; and transmitting the first device profile to a workload manager. In some examples, the edge device state information includes state information for a second edge device; the second edge device is configured to perform as an SD-WAN node; and a second device profile is determined for the second edge device and transmitted to the workload manager. The workload manager allocates an SD-WAN workload among the first edge device and the second edge device.

Abstract: In one set of embodiments, hint metadata for a workload may be provided to a hypervisor, where the hint metadata includes information pertaining to the computational nature, preferences, and/or requirements of the workload (or some portion thereof). This hint metadata may be provided statically prior to VM power-on and/or dynamically during VM runtime. The hypervisor may then schedule the workload on one or more of a plurality of heterogenous processing cores based on the hint metadata.

Abstract: The disclosure provides an approach for multi-endpoint cryptographic orchestration. Embodiments include establishing, by a first endpoint of a plurality of endpoints related to a multi-endpoint secure communication session, a metadata channel with one or more other endpoints of the plurality of endpoints. Embodiments include sending, by the first endpoint, to a second endpoint of the one or more other endpoints, via the metadata channel, an indication of a cryptographic requirement related to the multi-endpoint secure communication session. Embodiments include performing, by the second endpoint, one or more cryptographic operations related to the multi-endpoint secure communication session based on the indication of the cryptographic requirement. Embodiments include attesting, by the second endpoint, via the metadata channel, that the one or more cryptographic operations comply with the cryptographic requirement.

Abstract: The disclosure provides an approach for providing cryptographic agility for data storage. Embodiments include receiving, by a cryptographic provider component, a request to perform a cryptographic operation with respect to a storage operation for a data object, wherein the cryptographic provider component is associated with an interception point between a metadata layer of a storage system and an object storage layer of the storage system. Embodiments include determining, by the cryptographic provider component, one or more attributes related to the request based on information received from the metadata layer about the data object. Embodiments include selecting, by the cryptographic provider component, based on the one or more attributes related to the request, a cryptographic technique for handling the request from a set of possible cryptographic techniques. Embodiments include storing, at the object storage layer, an encrypted version of the data object based on the selected cryptographic technique.

Abstract: The disclosure provides an approach for providing cryptographic agility for virtualized data storage. Embodiments include determining, by a hypervisor running on a host machine, one or more attributes of a virtual machine (VM) running on top of the hypervisor. Embodiments include sending, by the hypervisor, to a cryptographic provider component, a request to perform cryptographic functionality with respect to one or more virtual disks associated with the VM, wherein the request comprises the one or more attributes of the VM. Embodiments include selecting, by the cryptographic provider component, based on the one or more attributes of the VM and one or more cryptographic policies, one or more cryptographic techniques for handling the request from a set of possible cryptographic techniques. Embodiments include encrypting the one or more virtual disks in a virtual storage area network (VSAN) based on the selected one or more cryptographic techniques.

Abstract: The disclosure provides an approach for providing cryptography as a service. Embodiments include receiving, by a cryptographic provider component, policy information. Embodiments include receiving, by the cryptographic provider component, requests from a plurality of applications to perform cryptographic operations, wherein the plurality of applications comprise separate processes from the cryptographic provider component. Embodiments include selecting, by a cryptographic router of the cryptographic provider component, based on the policy information and information associated with the requests, one or more cryptographic implementation components for servicing each request of the requests.

Abstract: The disclosure provides an approach for cryptographic agility for multi-layer privacy-preserving data aggregation. Embodiments include receiving a request for dynamic cryptographic technique selection related to a data aggregation process involving a first aggregator device and a second aggregator device performing one or more computations on data provided from multiple endpoints. Embodiments include determining, based on contextual information, that the second aggregator device is associated with a confidential computing component and that the first aggregator device is not associated with any confidential computing component. Embodiments include selecting one or more homomorphic encryption techniques for protecting the data while in use by the first aggregator device based on the determining that the first aggregator device is not associated with any confidential computing component and selecting a confidential computing technique for protecting the data while in use by the second aggregator device.

Abstract: The disclosure provides an approach for multi-endpoint cipher negotiation. Embodiments include determining, by one or more first endpoints of a plurality of endpoints involved in a multi-party data aggregation process, a privacy-preserving version of an underlying function to be evaluated for cryptographic technique selection. Embodiments include sending, by the one or more first endpoints, to a second endpoint of the plurality of endpoints, the privacy-preserving version of the underlying function and encrypted input values related to attributes of the one or more first endpoints. Embodiments include evaluating, by the second endpoint, the privacy-preserving version of the function based on the encrypted input values and one or more additional encrypted input values. Embodiments include determining, based on the evaluating of the privacy-preserving version of the function, one or more cryptographic techniques to be used for the multi-party data aggregation process.

Abstract: Embodiments perform automatic document handling by retrieving icons from local document handlers or from an application volumes manager, without installing the application locally. Embodiments further perform on-demand application mounting by intercepting and suspending requests to launch applications until the appropriate virtual disk, corresponding to the application, is mounted to the disk subsystem by the application volumes manager. The application launch is then resumed.

Abstract: The disclosure provides an approach for cryptographic agility for privacy-preserving federated learning. Embodiments include receiving a request from an application for dynamic cryptographic technique selection related to a federated learning process, wherein the request indicates one or more types of mathematical operations that are to be performed by an aggregator device on data that is to be provided from multiple endpoints during the federated learning process. Embodiments include selecting, based on the one or more types of mathematical operations that are to be performed by the aggregator device, a cryptographic technique from a plurality of cryptographic techniques. Embodiments include providing a response to the application based on the selecting of the cryptographic technique, wherein the cryptographic technique is used to perform one or more cryptographic operations related to the federated learning process.

Abstract: The disclosure provides an approach for cryptographic agility for privacy-preserving data aggregation. Embodiments include receiving a request for dynamic cryptographic technique selection related to a data aggregation process, wherein the data aggregation process is to involve an aggregator device performing one or more computations on data that is to be provided from multiple endpoints. Embodiments include selecting a cryptographic technique based on contextual information related the request, wherein the contextual information comprises one or more of: one or more types of mathematical operations that are to be performed by the aggregator device on the data that is to be provided from the multiple endpoints during the data aggregation process; or an indication of whether the aggregator device is associated with a confidential computing component. Embodiments include providing a response based on the selecting of the cryptographic technique.

Abstract: The disclosure provides a method for scaling workloads. The method includes receiving information regarding resources of one or more host machines running one or more virtual machines. The method further includes determining, based on the information, to change a quantity of the one or more virtual machines running on the one or more host machines. The method further includes determining an amount to change the quantity of the one or more virtual machines running on the one or more host machines based on utilization of one or more resource types of the one or more host machines, the utilization indicated by the information. The method further includes causing a change in the quantity of the one or more virtual machines running on the one or more host machines by the determined amount.

Abstract: The disclosure provides an approach for certificate management for cryptographic agility. Embodiments include receiving, by a cryptographic agility system, a cryptographic request related to an application. Embodiments include selecting, by the cryptographic agility system, a cryptographic technique based on contextual information associated with the cryptographic request. Embodiments include determining, by the cryptographic agility system, based on the cryptographic request, a certificate for authenticating a key related to the cryptographic technique. Embodiments include providing, by the cryptographic agility system, the certificate to an endpoint related to the cryptographic request for use in authenticating the key.

Abstract: Solutions for discovering and onboarding edge devices at scale include: receiving, by a device aggregator, edge device state information including state information for a first edge device; based on at least the state information for the first edge device, configuring the first edge device to perform as a software-defined wide area network (SD-WAN) node; based on at least the edge device state information, determining a first device profile for the first edge device; and transmitting the first device profile to a workload manager. In some examples, the edge device state information includes state information for a second edge device; the second edge device is configured to perform as an SD-WAN node; and a second device profile is determined for the second edge device and transmitted to the workload manager. The workload manager allocates an SD-WAN workload among the first edge device and the second edge device.

Abstract: Embodiments perform automatic document handling by retrieving icons from local document handlers or from an application volumes manager, without installing the application locally. Embodiments further perform on-demand application mounting by intercepting and suspending requests to launch applications until the appropriate virtual disk, corresponding to the application, is mounted to the disk subsystem by the application volumes manager. The application launch is then resumed.

Abstract: The disclosure provides an approach for cryptographic agility. Embodiments include receiving a request from an application for a cryptographic operation, wherein the request is associated with a computing device. Embodiments include determining one or more resource constraints related to the computing device. Embodiments include selecting, based on the one or more resource constraints, a cryptographic technique from a plurality of cryptographic techniques associated with indications of resource requirements. Embodiments include performing the cryptographic operation using the cryptographic technique. Embodiments include providing a response to the application based on performing the cryptographic operation.