Abstract: In various examples, a user may be authenticated without disclosing any confidential or private information of the user. An independent accumulator stores user confidential information, and accumulates items issued by various parties for the user. When another entity requests to verify the item and the user, the accumulator may verify the user by verifying his or her possession of the item and his or her private information. The accumulator may also verify the item with the issuing party and verify that the item was intended for the user. Once verification has occurred, the accumulator informs the requesting entity that their request is confirmed. In this manner, entities may verify items of a user, without requiring the user to disclose any of his or her confidential or private information to the requestor.

Abstract: The disclosure provides systems and processes for applying neural networks to detect intrusions and other anomalies in communications exchanged over a data bus between two or more devices in a network. The intrusions may be detected in data being communicated to an embedded system deployed in vehicular or robotic platforms. The disclosed system and process are well suited for incorporation into autonomous control or advanced driver assistance system (ADAS) vehicles including, without limitation, automobiles, motorcycles, boats, planes, and manned and un-manned robotic devices. Data communicated to an embedded system can be detected over any of a variety of data buses. In particular, embodiments disclosed herein are well suited for use in any data communication interface exhibiting the characteristics of a lack of authentication or following a broadcast routing scheme—including, without limitation, a control area network (CAN) bus.

Abstract: In examples, a parallel processing unit (PPU) operates within a trusted execution environment (TEE) implemented using a central processing unit (CPU). A virtual machine (VM) executing within the TEE is provided access to the PPU by a hypervisor. However, data of an application executed by the VM is inaccessible to the hypervisor and other untrusted entities outside of the TEE. To protect the data in transit, the VM and the PPU may encrypt or decrypt the data for secure communication between the devices. To protect the data within the PPU, a protected memory region may be created in PPU memory where compute engines of the PPU are prevented from writing outside of the protected memory region. A write protect memory region is generated where access to the PPU memory is blocked from other computing devices and/or device instances.

Abstract: In examples, trusted execution environments (TEE) are provided for an instance of a parallel processing unit (PPU) as PPU TEEs. Different instances of a PPU correspond to different PPU TEEs, and provide accelerated confidential computing to a corresponding TEE. The processors of each PPU instance have separate and isolated paths through the memory system of the PPU which are assigned uniquely to an individual PPU instance. Data in device memory of the PPU may be isolated and access controlled amongst the PPU instances using one or more hardware firewalls. A GPU hypervisor assigns hardware resources to runtimes and performs access control and context switching for the runtimes. A PPU instance uses a cryptographic key to protect data for secure communication. Compute engines of the PPU instance are prevented from writing outside of a protected memory region. Access to a write protected region in PPU memory is blocked from other computing devices and/or device instances.

Abstract: The technology disclosed herein enables an auxiliary device to run a service that can access and analyze data of a Trusted Execution Environment (TEE). The auxiliary device may establish an auxiliary TEE in the auxiliary device and establish a trusted communication link between the auxiliary TEE and the TEE (i.e., primary TEE). The primary TEE may execute a target program using the primary devices of a host device (e.g., CPU) and the auxiliary TEE may execute a security program using the auxiliary device (e.g., DPU). In one example, the primary and auxiliary TEEs may be established for a cloud consumer and the auxiliary TEE may execute a security service that can monitor data of the primary TEE even though the data is inaccessible to all other software executing external to the primary TEE (e.g., inaccessible to host operating system and hypervisor).

Abstract: Various approaches are disclosed to virtualizing intrusion detection and prevention. Disclosed approaches provide for an embedded system having a hypervisor that provides a virtualized environment supporting any number of guest OSes. The virtualized environment may include a security engine on an internal communication channel between the guest OS and a virtualized hardware interface (e.g., an Ethernet or CAN interface) to analyze network traffic to protect the guest OS from other guest OSes or other network components, and to protect those network components from the guest OS. The security engine may be on a different partition than the guest OS and the virtualized hardware interface providing the components with isolated execution environments that protect against malicious code execution. Each guest OS may have its own security engine customized for the guest OS to account for what is typical or expected traffic for the guest OS.

Abstract: Apparatuses, systems, and techniques to generate a trusted execution environment including multiple accelerators. In at least one embodiment, a parallel processing unit (PPU), such as a graphics processing unit (GPU), operates in a secure execution mode including a protect memory region. Furthermore, in an embodiment, a cryptographic key is utilzed to protect data during transmission between the accelerators.

Abstract: Apparatuses, systems, and techniques to generate a trusted execution environment including multiple accelerators. In at least one embodiment, a parallel processing unit (PPU), such as a graphics processing unit (GPU), operates in a secure execution mode including a protect memory region. Furthermore, in an embodiment, a cryptographic key is utilized to protect data during transmission between the accelerators.

Abstract: Approaches in accordance with various embodiments allow for zero-touch enrollment of devices with respective manager systems. In at least one embodiment, a device at startup can contact a central directory service (CDS) for information about an associated manager. The CDS can authenticate the device using device information included in the request, and can send a challenge token to the device in response. The challenge token can include information for the manager, protected with multiple layers of security that should only be able to be decrypted by the authenticated device. The device can decrypt this challenge token to determine the manager information, and can convert this challenge token to a bearer token. The device can then send a request to the determined manager that includes the bearer token, which the manager can use to authenticate the device. The manager can then send the device appropriate configuration information.

Abstract: Approaches in accordance with various embodiments allow for zero-touch enrollment of devices with respective manager systems. In at least one embodiment, a device at startup can contact a central directory service (CDS) for information about an associated manager. The CDS can authenticate the device using device information included in the request, and can send a challenge token to the device in response. The challenge token can include information for the manager, protected with multiple layers of security that should only be able to be decrypted by the authenticated device. The device can decrypt this challenge token to determine the manager information, and can convert this challenge token to a bearer token. The device can then send a request to the determined manager that includes the bearer token, which the manager can use to authenticate the device. The manager can then send the device appropriate configuration information.

Abstract: Approaches in accordance with various embodiments allow for zero-touch enrollment of devices with respective manager systems. In at least one embodiment, a device at startup can contact a central directory service (CDS) for information about an associated manager. The CDS can authenticate the device using device information included in the request, and can send a challenge token to the device in response. The challenge token can include information for the manager, protected with multiple layers of security that should only be able to be decrypted by the authenticated device. The device can decrypt this challenge token to determine the manager information, and can convert this challenge token to a bearer token. The device can then send a request to the determined manager that includes the bearer token, which the manager can use to authenticate the device. The manager can then send the device appropriate configuration information.

Abstract: This disclosure provides a method that allows connector pins of a USB-C connector to be dynamically repurposed between low bandwidth USB2 traffic and high bandwidth USB3 traffic. USB-C devices can negotiate the use of these pins for a dynamic transition to another function or functions. The pins can be the four center connector pins of a USB-C connection, pins A6, A7, B6, B7, that are originally designated as USB 2.0 differential pairs Changing the function of the pins provides flexibility for communicating using USB-C connectors. For example, the disclosed method/device/system can be used to support high-resolution cameras and sensors in high-resolution virtual reality headsets via a single USB-C connection instead of a user having to connect multiple cables.

Abstract: This disclosure provides a method that allows connector pins of a USB-C connector to be dynamically repurposed between low bandwidth USB2 traffic and high bandwidth USB3 traffic. USB-C devices can negotiate the use of these pins for a dynamic transition to another function or functions. The pins can be the four center connector pins of a USB-C connection, pins A6, A7, B6, B7, that are originally designated as USB 2.0 differential pairs Changing the function of the pins provides flexibility for communicating using USB-C connectors. For example, the disclosed method/device/system can be used to support high-resolution cameras and sensors in high-resolution virtual reality headsets via a single USB-C connection instead of a user having to connect multiple cables.

Abstract: Various approaches are disclosed to virtualizing intrusion detection and prevention. Disclosed approaches provide for an embedded system having a hypervisor that provides a virtualized environment supporting any number of guest OSes. The virtualized environment may include a security engine on an internal communication channel between the guest OS and a virtualized hardware interface (e.g., an Ethernet or CAN interface) to analyze network traffic to protect the guest OS from other guest OSes or other network components, and to protect those network components from the guest OS. The security engine may be on a different partition than the guest OS and the virtualized hardware interface providing the components with isolated execution environments that protect against malicious code execution. Each guest OS may have its own security engine customized for the guest OS to account for what is typical or expected traffic for the guest OS.

Abstract: Various approaches are disclosed for protecting vehicle buses from cyber-attacks. Disclosed approaches provide for an embedded system having a hypervisor that provides a virtualized environment supporting any number of guest OSes. The virtualized environment may include a security engine on an internal communication channel between the guest OS and an external vehicle bus of a vehicle to analyze network traffic to protect the guest OS from other guest OSes or other network components, and to protect those network components from the guest OS. Each guest OS may have its own security engine customized for the guest OS to account for what is typical or expected traffic for the guest OS (e.g., using machine learning, anomaly detection, etc.).

Abstract: The disclosure provides systems and processes for applying neural networks to detect intrusions and other anomalies in communications exchanged over a data bus between two or more devices in a network. The intrusions may be detected in data being communicated to an embedded system deployed in vehicular or robotic platforms. The disclosed system and process are well suited for incorporation into autonomous control or advanced driver assistance system (ADAS) vehicles including, without limitation, automobiles, motorcycles, boats, planes, and manned and un-manned robotic devices. Data communicated to an embedded system can be detected over any of a variety of data buses. In particular, embodiments disclosed herein are well suited for use in any data communication interface exhibiting the characteristics of a lack of authentication or following a broadcast routing scheme—including, without limitation, a control area network (CAN) bus.

Abstract: Typical hybrid graphics systems operate in either a “high-performance mode” or in an “energy saver mode.” While operating in the high-performance mode, a discrete graphics processing unit (dGPU) performs high-performance graphics processing operations and also receives and satisfies access requests targeting a configuration space within the dGPU. While operating in the energy saver mode, an integrated graphics processing unit (iGPU) performs graphics processing operations and the dGPU is powered down. In this scenario, a system management unit (SMU) intercepts and satisfies access requests targeting the dGPU. Since access requests targeting the dGPU are satisfied while the dGPU is powered down, the dGPU continues to be enumerated in the system using the same system resources as originally granted, and can therefore be switched to for implementing high-performance mode more quickly than if it was removed, and required a complete plug-and-play re-enumeration and re-allocation of system resources.

Abstract: A security command protocol provides secure authenticated access to an auxiliary security memory within a SCSI storage device. The auxiliary security memory acts as an authenticated separate secure storage area that stores sensitive data separately from the user data area of the SCSI storage device. The security command protocol is used to access the auxiliary security memory. The security command protocol allows a trusted execution environment to transport sensitive data to and from storage in the auxiliary security memory. The regular execution environment does not have access to the security command protocol or the auxiliary security memory. The security command protocol and auxiliary security memory eliminate the need for additional secure storage components in devices that provide the security features of firmware TPM.

Abstract: One embodiment of the present invention sets forth a technique for automatically provisioning a diskless computing device and an associated server system. A diskless computing device client incorporates an iSCSI initiator that is used to access resources provided by an iSCSI target that is resident on a server computing device. The iSCSI initiator is implemented in the client firmware, providing INT13 disk services entry points, thereby enabling the client to transparently access virtual storage devices at boot time. The client device conducts an apparently local installation using the virtual storage devices provided by the server computing device. A short signature value is associated with the boot image, uniquely associating the boot image with the specific client hardware configuration. When the client device boots normally, the signature value of the client device is presented to the server computing device to automatically reference the appropriate boot image.

Abstract: A security command protocol provides secure authenticated access to an auxiliary security memory within a SCSI storage device. The auxiliary security memory acts as an authenticated separate secure storage area that stores sensitive data separately from the user data area of the SCSI storage device. The security command protocol is used to access the auxiliary security memory. The security command protocol allows a trusted execution environment to transport sensitive data to and from storage in the auxiliary security memory. The regular execution environment does not have access to the security command protocol or the auxiliary security memory. The security command protocol and auxiliary security memory eliminate the need for additional secure storage components in devices that provide the security features of firmware TPM.