Abstract: A docking station operable in a plurality of modes is disclosed. An example method includes obtaining first data via a first interface of the docking station configured to couple the docking station to a computing device and second data via a second interface of the docking station configured to communicate with a network, responsive to operating in a first mode, obtaining third data via the second interface of the docking station, responsive to operating in a second mode, and selectively outputting the first and the second data, or the third data, to a display based on whether the docking station operates in the first or the second mode. The selectively outputting includes determining that the computing device is not coupled to the docking station, and in response, processing the third data by an application installed in a secure sandbox, and outputting the processed third data to the display.

Abstract: Fleets of mobile or desktop electronic devices are sometimes wrongly unenrolled from a security and management service. They must then be reenrolled individually, from the devices themselves. To overcome this, a calling agent in each device is only partially removed or disabled upon receipt of the unenrollment instruction. The remaining portion of the calling agent is removed after a cool-off period. During the cool-off period, a persistent component of the calling agent that remains active contacts a monitoring center to check whether there is a cancellation of the unenroll instruction. If there is, the devices can be reenrolled from the monitoring center. This persistent component is designed to survive device reimaging and reinstantiates itself in such an event. This tether provides the ability to reverse unintentional device unenrollment.

Abstract: In one set of embodiments, confidential data needed by a workload component running within a worker VM can be placed on an encrypted virtual disk that is attached to the worker VM and hardware-based attestation can be used to validate the worker VM's software and isolate its guest memory from its hypervisor. Upon successful completion of this attestation process, a data decryption key can be delivered to the worker VM via a secure channel established via the attestation, such that the hypervisor cannot read or alter the key. The worker VM can then decrypt the contents of the encrypted virtual disk using the data decryption key, thereby granting the workload component access to the confidential data.

Abstract: A framework is provided that assigns a digital certificate to each VM-based control plane element and computing node (i.e., worker VM) of a workload orchestration platform implemented in a virtualized environment, where the digital certificate is signed by a trusted entity and provides cryptographic proof that the control plane element/worker VM has been successfully attested by that trusted entity using hardware-based attestation. Each control plane element/worker VM is configured to verify the digital certificates of other platform components prior to communicating with those components. With these digital certificates in place, when an end-user submits to the platform's front-end control plane element a new workload for deployment, the end-user can verify the digital certificate of the front-end control plane element in order to be assured that the workload will be deployed and executed by the platform in a secure manner.

Abstract: A compositor receives, from each of a plurality of originating devices, compressed and/or encrypted image data portions of a frame of image data, together with portion metadata for each of the compressed and/or encrypted image data portions. Frame metadata for the frame of image data. The compositor then composites the image data portions without decompressing and/or decrypting them, based on the portion and frame metadata, by generating composited frame metadata for the composited image frame and amending the portion metadata for each of the compressed and/or encrypted image data portions to indicate a location of the compressed and/or encrypted image data portions in the composited image frame. The compressed and/or encrypted image data portions, the composited frame metadata and the amended portion metadata are then transmitted by the compositor to a display control device.

Abstract: A mobile device that can optionally communicate with a server, the mobile device including latitude/longitude determining capabilities, a display, a data communication system and a power source. The mobile device can be used to communicate, provide location information, track an individual, as well as allow alerting, such in a case of an emergency. This location information could be accompanied with one or more of video information, audio information, multimedia information, and pictures taken by the mobile device. The mobile devices also allow inner-communicability among the devices such as text messaging, chat, voice communications, and the like. The capabilities of the mobile device can also be used to determine if the device has traversed a geo-fence, or defined electronic perimeter, with the crossing of the perimeter capable of triggering special functionality such as the turning on of the mobile device, or smart phone, sending an alert, altering functionality, or the like.

Abstract: A mobile device that can optionally communicate with a server, the mobile device including latitude/longitude determining capabilities, a display, a data communication system and a power source. The mobile device can be used to communicate, provide location information, track an individual, as well as allow alerting, such in a case of an emergency. This location information could be accompanied with one or more of video information, audio information, multimedia information, and pictures taken by the mobile device. The mobile devices also allow inner-communicability among the devices such as text messaging, chat, voice communications, and the like. The capabilities of the mobile device can also be used to determine if the device has traversed a geo-fence, or defined electronic perimeter, with the crossing of the perimeter capable of triggering special functionality such as the turning on of the mobile device, or smart phone, sending an alert, altering functionality, or the like.

Abstract: Mechanisms to protect the integrity of memory of a virtual machine are provided. The mechanisms involve utilizing certain capabilities of the hypervisor underlying the virtual machine to monitor writes to memory pages of the virtual machine. A guest integrity driver communicates with the hypervisor to request such functionality. Additional protections are provided for protecting the guest integrity driver and associated data, as well as for preventing use of these mechanisms by malicious software. These additional protections include an elevated execution mode, termed “integrity mode,” which can only be entered from a specified entry point, as well as protections on the memory pages that store the guest integrity driver and associated data.

Abstract: In one set of embodiments, confidential data needed by a workload component running within a worker VM can be placed on an encrypted virtual disk that is attached to the worker VM and hardware-based attestation can be used to validate the worker VM's software and isolate its guest memory from its hypervisor. Upon successful completion of this attestation process, a data decryption key can be delivered to the worker VM via a secure channel established via the attestation, such that the hypervisor cannot read or alter the key. The worker VM can then decrypt the contents of the encrypted virtual disk using the data decryption key, thereby granting the workload component access to the confidential data.

Abstract: A framework is provided that assigns a digital certificate to each VM-based control plane element and computing node (i.e., worker VM) of a workload orchestration platform implemented in a virtualized environment, where the digital certificate is signed by a trusted entity and provides cryptographic proof that the control plane element/worker VM has been successfully attested by that trusted entity using hardware-based attestation. Each control plane element/worker VM is configured to verify the digital certificates of other platform components prior to communicating with those components. With these digital certificates in place, when an end-user submits to the platform's front-end control plane element a new workload for deployment, the end-user can verify the digital certificate of the front-end control plane element in order to be assured that the workload will be deployed and executed by the platform in a secure manner.

Abstract: A method is provided for performing receiver and transmitter tests of a phased array antenna using a test system including probe antennas for transmitting and receiving RF signals, respectively. For the receiver tests, the method includes receiving the RF signals at receiver channels over propagation paths corresponding to the probe antennas, where each of the receiver channels is set at a selected complex gain setting of multiple available complex gain settings; measuring a combined receive signal output from a single combined output of the phased array antenna; isolating complex gain and complex path loss products from the measured combined receive signal corresponding to the selected complex gain setting and the propagation paths at each of the receiver channels; and determining a relative value between the complex gain of one receiver channel and previous complex gain of the one receiver channel using the isolated complex gain and complex path loss products.

Abstract: A compositor receives, from each of a plurality of originating devices, compressed and/or encrypted image data portions of a frame of image data, together with portion metadata for each of the compressed and/or encrypted image data portions. Frame metadata for the frame of image data. The compositor then composites the image data portions without decompressing and/or decrypting them, based on the portion and frame metadata, by generating composited frame metadata for the composited image frame and amending the portion metadata for each of the compressed and/or encrypted image data portions to indicate a location of the compressed and/or encrypted image data portions in the composited image frame. The compressed and/or encrypted image data portions, the composited frame metadata and the amended portion metadata are then transmitted by the compositor to a display control device.

Abstract: Disclosed are various embodiments that utilize conflict cost for workload placements in datacenter environments. In some examples, a protected memory level is identified for a computing environment. The computing environment includes a number of processor resources. Incompatible processor workloads are prohibited from concurrently executing on parallel processor resources. Parallel processor resources share memory at the protected memory level. A number of conflict costs are determined for a processor workload. Each conflict cost is determined based on a measure of compatibility between the processor workload and a parallel processor resource that shares a particular memory with the respective processor resource. The processor workload is assigned to execute on a processor resource associated with a minimum conflict cost.

Abstract: A compositor receives, from each of a plurality of originating devices, compressed and/or encrypted image data portions of a frame of image data, together with portion metadata for each of the compressed and/or encrypted image data portions. Frame metadata for the frame of image data. The compositor then composites the image data portions without decompressing and/or decrypting them, based on the portion and frame metadata, by generating composited frame metadata for the composited image frame and amending the portion metadata for each of the compressed and/or encrypted image data portions to indicate a location of the compressed and/or encrypted image data portions in the composited image frame. The compressed and/or encrypted image data portions, the composited frame metadata and the amended portion metadata are then transmitted by the compositor to a display control device.

Abstract: Disclosed are various embodiments that utilize conflict cost for workload placements in datacenter environments. In some examples, a protected memory level is identified for a computing environment. The computing environment includes a number of processor resources. Incompatible processor workloads are prohibited from concurrently executing on parallel processor resources. Parallel processor resources share memory at the protected memory level. A number of conflict costs are determined for a processor workload. Each conflict cost is determined based on a measure of compatibility between the processor workload and a parallel processor resource that shares a particular memory with the respective processor resource. The processor workload is assigned to execute on a processor resource associated with a minimum conflict cost.