G06F9/455

Providing enhanced security for object access in object-based datastores
11580078 · 2023-02-14 · ·

A method of enhancing security in object based datastores is provided. The method mounts first and second datastores identified, respectively, by first and second datastore identifiers. The first and second datastores include, respectively, first and second namespace objects that are mapped to first and second subfolders in the first and second datastores. A first file within the first subfolder references a first object via a first object identifier, while a second file within the second subfolder references a second object via a second object identifier. The first and second objects are tagged with the first and second datastores' identifiers. The first and second datastores share an underlying storage and may be configured to have separate access permissions. The method receives a command to access the first object via a datastore identifier, compares the datastore identifier with the first datastore identifier, and if they match, allows access to the first object.

Annotated deterministic trace abstraction for advanced dynamic program analysis
11580006 · 2023-02-14 · ·

A virtual machine that includes a plurality of processes executes on a computer processor. A record-replay file, trace annotations, and an application program interface request are received into the computer processor. The trace annotations and application program interface request are translated into record-replay commands. The record-replay commands capture data from the record-replay file, and the captured data can be accessed via a programmatic interface.

Implicit integrity for cryptographic computing

In one embodiment, a processor includes a memory hierarchy and a core coupled to the memory hierarchy. The memory hierarchy stores encrypted data, and the core includes circuitry to access the encrypted data stored in the memory hierarchy, decrypt the encrypted data to yield decrypted data, perform an entropy test on the decrypted data, and update a processor state based on a result of the entropy test. The entropy test may include determining a number of data entities in the decrypted data whose values are equal to one another, determining a number of adjacent data entities in the decrypted data whose values are equal to one another, determining a number of data entities in the decrypted data whose values are equal to at least one special value from a set of special values, or determining a sum of n highest data entity value frequencies.

Containerized workload scheduling

A method for containerized workload scheduling can include determining a network state for a first hypervisor in a virtual computing cluster (VCC). The method can further include determining a network state for a second hypervisor. Containerized workload scheduling can further include deploying a container to run a containerized workload on a virtual computing instance (VCI) deployed on the first hypervisor or the second hypervisor based, at least in part, on the determined network state for the first hypervisor and the second hypervisor.

Method and system for processing commands in storage devices to improve quality of service

Operation of a non-volatile memory (NVM) storage module may comprise receiving a plurality of commands as associated with a plurality of priority-based queues from a host-memory. A received command is evaluated in accordance with a priority associated with the queue storing the command and a size of the command. The evaluated command is split into a plurality of sub-commands, each of the sub-commands having a size determined in accordance with the evaluation. A predetermined number of hardware resources are allocated for each of the evaluated command based on at least the size of each of the sub-commands to thereby enable a processing of the evaluated command based on the allocated resources. Quality of service (QoS) for the evaluated-command may thus be augmented.

Intra-aortic pressure forecasting

Aspects of the present disclosure describe systems and methods for predicting an intra-aortic pressure of a patient receiving hemodynamic support from a transvalvular micro-axial heart pump. In some implementations, an intra-aortic pressure time series is derived from measurements of a pressure sensor of the transvalvular micro-axial heart pump and a motor speed time series is derived from a measured back electromotive force of a motor of the transvalvular micro-axial heart pump. Furthermore, in some implementations, machine learning algorithms, such as deep learning, are applied to the intra-aortic pressure and motor speed time series to accurately predict an intra-aortic pressure of the patient. In some implementations, the prediction is short-term (e.g., approximately 5 minutes in advance).

Securing an injection of a workload into a virtual network hosted by a cloud-based platform

The disclosed system implements techniques to secure communications for injecting a workload (e.g., a container) into a virtual network hosted by a cloud-based platform. Based on a delegation instruction received from a tenant, a virtual network of the tenant can connect to and execute a workload via a virtual machine that is part of a virtual network that belongs to a resource provider. To secure calls and authorize access to the tenant's virtual network, authentication information provided with a call from the virtual network of the resource provider may need to match authorization information made available via a publication service of the cloud-based platform. Additionally or alternatively, an identifier of a NIC used to make a call may need to correspond to a registered name of the resource provider for the call to be authorized. These checks provide increased security by preventing unauthorized calls to the tenant's virtual network.

Securing an injection of a workload into a virtual network hosted by a cloud-based platform

The disclosed system implements techniques to secure communications for injecting a workload (e.g., a container) into a virtual network hosted by a cloud-based platform. Based on a delegation instruction received from a tenant, a virtual network of the tenant can connect to and execute a workload via a virtual machine that is part of a virtual network that belongs to a resource provider. To secure calls and authorize access to the tenant's virtual network, authentication information provided with a call from the virtual network of the resource provider may need to match authorization information made available via a publication service of the cloud-based platform. Additionally or alternatively, an identifier of a NIC used to make a call may need to correspond to a registered name of the resource provider for the call to be authorized. These checks provide increased security by preventing unauthorized calls to the tenant's virtual network.

Accelerated deep learning

Techniques in advanced deep learning provide improvements in one or more of accuracy, performance, and energy efficiency, such as accuracy of learning, accuracy of prediction, speed of learning, performance of learning, and energy efficiency of learning. An array of processing elements performs flow-based computations on wavelets of data. Each processing element has a respective compute element and a respective routing element. Each compute element has processing resources and memory resources. Each router enables communication via wavelets with at least nearest neighbors in a 2D mesh. Stochastic gradient descent, mini-batch gradient descent, and continuous propagation gradient descent are techniques usable to train weights of a neural network modeled by the processing elements. Reverse checkpoint is usable to reduce memory usage during the training.

Reduced memory consumption of compiler-transformed asynchronous methods

An asynchronous method is implemented in a manner that reduces the amount of runtime overhead needed to execute the asynchronous method. The data elements needed to suspend an asynchronous method to await completion of an asynchronous operation, to resume the asynchronous method at a resumption point, and to provide a completion status of the caller of the asynchronous method are consolidated into one or two reusable objects. An asynchronous method may be associated with a distinct object pool of reusable objects. The size of a pool and the total size of all pools can be configured statically or dynamically based on runtime conditions.