Abstract: Approaches for monitoring a host operating system. A threat model is stored and maintained in an isolated execution environment. The threat model identifies for any process executing on a host operating system how trustworthy the process should be deemed based on a pattern of observed behavior. The execution of the process and those processes in a monitoring circle relationship thereto are monitored. The monitoring circle relationship includes a parent process, any process in communication with a member of monitoring circle relationship, and any process instantiated by a present member of monitoring circle relationship. Observed process behavior is correlated with the threat model. Upon determining that a particular process has behaved in a manner inconsistent with a pattern of allowable behavior identified by the threat model for that process, a responsive action is taken.

Abstract: Approaches for monitoring a host operating system. A threat model is stored and maintained in an isolated execution environment. The threat model identifies for any process executing on a host operating system how trustworthy the process should be deemed based on a pattern of observed behavior. The execution of the process and those processes in a monitoring circle relationship thereto are monitored. The monitoring circle relationship includes a parent process, any process in communication with a member of monitoring circle relationship, and any process instantiated by a present member of monitoring circle relationship. Observed process behavior is correlated with the threat model. Upon determining that a particular process has behaved in a manner inconsistent with a pattern of allowable behavior identified by the threat model for that process, a responsive action is taken.

Abstract: A current mode switching regulator circuit and operating method includes a variable duty cycle power switch controller, a voltage feedback loop that provides a feedback signal based on the output voltage, a current feedback loop that provides a current sense signal based on the output current, and an offset circuit having an external signal input and coupled to the current feedback loop. The power switch controller controls the switching regulator circuit to generate an output voltage and an output current. The offset circuit is configured to provide an offset output control signal, independently of the voltage feedback loop, to control the power switch controller so as to vary a duty cycle of the power switch controller based on the current sense signal and an external offset signal applied to the external signal input.

Abstract: A current mode switching regulator circuit and operating method includes a variable duty cycle power switch controller, a voltage feedback loop that provides a feedback signal based on the output voltage, a current feedback loop that provides a current sense signal based on the output current, and an offset circuit having an external signal input and coupled to the current feedback loop. The power switch controller controls the switching regulator circuit to generate an output voltage and an output current. The offset circuit is configured to provide an offset output control signal, independently of the voltage feedback loop, to control the power switch controller so as to vary a duty cycle of the power switch controller based on the current sense signal and an external offset signal applied to the external signal input.

Abstract: The present disclosure is directed towards methods and systems for maintaining state in a virtual machine when disconnected from graphics hardware. The virtual machine is one of a plurality of virtual machines hosted by a hypervisor executing on a computing device. A control virtual machine may be hosted by a hypervisor executing on a computing device. The control virtual machine may store state information of a graphics processing unit (GPU) of the computing device. The GPU may render an image from a first virtual machine. The control virtual machine may remove, from the first virtual machine, access to the GPU. The control virtual machine may redirect the first virtual machine to a GPU emulation program. The GPU emulation program may render the image from the first virtual machine using at least a portion of the stored state information.

Abstract: The methods and systems described herein provide for allocating a universal serial bus (USB) device to one of a trusted virtual machine and a non-trusted virtual machine. A control program receives data indicating a USB port on the computing machine received a USB device and identifies at least one attribute of the USB device. The control program selects, based on application of a policy to the identified at least one device attribute, one of a trusted virtual machine and a non-trusted virtual machine executing. The control program grants, to the virtual machine selected by the control program, access to the USB device.

Abstract: The present disclosure is directed towards methods and systems for maintaining state in a virtual machine when disconnected from graphics hardware. The virtual machine is one of a plurality of virtual machines hosted by a hypervisor executing on a computing device. A control virtual machine may be hosted by a hypervisor executing on a computing device. The control virtual machine may store state information of a graphics processing unit (GPU) of the computing device. The GPU may render an image from a first virtual machine. The control virtual machine may remove, from the first virtual machine, access to the GPU. The control virtual machine may redirect the first virtual machine to a GPU emulation program. The GPU emulation program may render the image from the first virtual machine using at least a portion of the stored state information.

Abstract: The methods and systems described herein provide for preventing a non-trusted virtual machine from reading the graphical output of a trusted virtual machine. A graphics manager receives a request from a trusted virtual machine to render graphical data using a graphics processing unit. The graphics manager assigns, to the trusted virtual machine, a secure section of a memory of the graphics processing unit. The graphics manager renders graphics from the trusted virtual machine graphical data to the secure section of the graphics processing unit memory. The graphics manager receives a request from a non-trusted virtual machine to read graphics rendered from the trusted virtual machine graphical data and stored in the secure section of the graphics processing unit memory, and prevents the non-trusted virtual machine from reading the trusted virtual machine rendered graphics stored in the secure section of the graphics processing unit memory.

Abstract: The present disclosure is directed towards methods and systems for maintaining state in a virtual machine when disconnected from graphics hardware. The virtual machine is one of a plurality of virtual machines hosted by a hypervisor executing on a computing device. A control virtual machine may be hosted by a hypervisor executing on a computing device. The control virtual machine may store state information of a graphics processing unit (GPU) of the computing device. The GPU may render an image from a first virtual machine. The control virtual machine may remove, from the first virtual machine, access to the GPU. The control virtual machine may redirect the first virtual machine to a GPU emulation program. The GPU emulation program may render the image from the first virtual machine using at least a portion of the stored state information.

Abstract: The methods and systems described herein are directed to providing, to virtual machines, access to data associated with a connection to a wireless local area network, in a computing device executing a hypervisor hosting a first virtual machine and a second virtual machine. A first driver executed by a first virtual machine of the first physical computing device establishes a network connection to a second physical computing device, via a wireless local area network interface of the first physical computing device. The first driver receives from a second driver executed by a second virtual machine of the first physical computing device, a request for a characteristic of the network connection. The first driver provides, responsive to the request, data comprising the requested characteristic to the second driver.

Abstract: The methods and systems described herein provide for preventing a non-trusted virtual machine from reading the graphical output of a trusted virtual machine. A graphics manager receives a request from a trusted virtual machine to render graphical data using a graphics processing unit. The graphics manager assigns, to the trusted virtual machine, a secure section of a memory of the graphics processing unit. The graphics manager renders graphics from the trusted virtual machine graphical data to the secure section of the graphics processing unit memory. The graphics manager receives a request from a non-trusted virtual machine to read graphics rendered from the trusted virtual machine graphical data and stored in the secure section of the graphics processing unit memory, and prevents the non-trusted virtual machine from reading the trusted virtual machine rendered graphics stored in the secure section of the graphics processing unit memory.

Abstract: The methods and systems described herein provide for allocating a universal serial bus (USB) device to one of a trusted virtual machine and a non-trusted virtual machine. A control program receives data indicating a USB port on the computing machine received a USB device and identifies at least one attribute of the USB device. The control program selects, based on application of a policy to the identified at least one device attribute, one of a trusted virtual machine and a non-trusted virtual machine executing. The control program grants, to the virtual machine selected by the control program, access to the USB device.

Abstract: The methods and systems described herein provide for establishing a secure communication channel between a non-trusted virtual machine and a trusted virtual machine, in a computing device executing a hypervisor hosting the trusted virtual machine, the non-trusted virtual machine, and a third virtual machine. The method includes writing, by a non-trusted virtual machine, a first string of data to a region of memory of the computing device. The method also includes detecting, by a trusted virtual machine, the first string of data written to the region of memory. The method further includes establishing a communication channel between the trusted virtual machine and the non-trusted virtual machine by locking, by the trusted virtual machine and responsive to the detection, the region of memory for the duration of the communication to prevent a third virtual machine from accessing the region of memory.

Abstract: The methods and systems described herein provide for granting a virtual machine exclusive access to an optical disc drive responsive to a determination the virtual machine initiated a transaction with the optical disc drive. A drive manager maps an optical disc drive connected to the computing device to a plurality of virtual machines hosted by a hypervisor executed by the computing device. The drive manager intercepts a transaction stream generated by the optical disc drive and converts the transaction stream to a command stream. The drive manager determines, based on an analysis of the command stream, a first virtual machine of the plurality of virtual machines initiated a transaction with the optical disc drive. Responsive to the determination, the drive manager locks the optical disc drive to grant the first virtual machine exclusive access to the optical disc drive.

Abstract: The methods and systems provide for allocating a universal serial bus (USB) device to one of a trusted virtual machine and a non-trusted virtual machine. A control program receives data indicating a USB port on the computing machine received a USB device and identifies at least one attribute of the USB device. The control program selects, based on application of a policy to the identified at least one device attribute, one of a trusted virtual machine and a non-trusted virtual machine executing. The control program grants, to the virtual machine selected by the control program, access to the USB device.

Abstract: The methods and systems provide for preventing a non-trusted virtual machine from reading the graphical output of a trusted virtual machine. A graphics manager receives a request from a trusted virtual machine to render graphical data using a graphics processing unit. The graphics manager assigns, to the trusted virtual machine, a secure section of a memory of the graphics processing unit. The graphics manager renders graphics from the trusted virtual machine graphical data to the secure section of the graphics processing unit memory. The graphics manager receives a request from a non-trusted virtual machine to read graphics rendered from the trusted virtual machine graphical data and stored in the secure section of the graphics processing unit memory, and prevents the non-trusted virtual machine from reading the trusted virtual machine rendered graphics stored in the secure section of the graphics processing unit memory.

Abstract: The present disclosure is directed towards methods and systems for maintaining state in a virtual machine when disconnected from graphics hardware. The virtual machine is one of a plurality of virtual machines hosted by a hypervisor executing on a computing device. A control virtual machine may be hosted by a hypervisor executing on a computing device. The control virtual machine may store state information of a graphics processing unit (GPU) of the computing device. The GPU may render an image from a first virtual machine. The control virtual machine may remove, from the first virtual machine, access to the GPU. The control virtual machine may redirect the first virtual machine to a GPU emulation program. The GPU emulation program may render the image from the first virtual machine using at least a portion of the stored state information.

Abstract: The methods and systems described herein provide for establishing a secure communication channel between a non-trusted virtual machine and a trusted virtual machine, in a computing device executing a hypervisor hosting the trusted virtual machine, the non-trusted virtual machine, and a third virtual machine. The method includes writing, by a non-trusted virtual machine, a first string of data to a region of memory of the computing device. The method also includes detecting, by a trusted virtual machine, the first string of data written to the region of memory. The method further includes establishing a communication channel between the trusted virtual machine and the non-trusted virtual machine by locking, by the trusted virtual machine and responsive to the detection, the region of memory for the duration of the communication to prevent a third virtual machine from accessing the region of memory.

Abstract: The methods and systems described herein provide for allocating a universal serial bus (USB) device to one of a trusted virtual machine and a non-trusted virtual machine. A control program receives data indicating a USB port on the computing machine received a USB device and identifies at least one attribute of the USB device. The control program selects, based on application of a policy to the identified at least one device attribute, one of a trusted virtual machine and a non-trusted virtual machine executing. The control program grants, to the virtual machine selected by the control program, access to the USB device.

Abstract: The methods and systems described herein provide for preventing a non-trusted virtual machine from reading the graphical output of a trusted virtual machine. A graphics manager receives a request from a trusted virtual machine to render graphical data using a graphics processing unit. The graphics manager assigns, to the trusted virtual machine, a secure section of a memory of the graphics processing unit. The graphics manager renders graphics from the trusted virtual machine graphical data to the secure section of the graphics processing unit memory. The graphics manager receives a request from a non-trusted virtual machine to read graphics rendered from the trusted virtual machine graphical data and stored in the secure section of the graphics processing unit memory, and prevents the non-trusted virtual machine from reading the trusted virtual machine rendered graphics stored in the secure section of the graphics processing unit memory.