Matthew J Eccleston4137 47Th St, Tulsa, OK 74135

7428636, Sep 23, 2008

May 30, 2003

10/448825

Carl A. Waldspurger - Atherton CA, US
Matthew Eccleston - San Francisco CA, US

VMware, Inc. - Palo Alto CA

H04L 9/00

713164, 713193

Upon occurrence of a trigger condition, writes of allocation units of data (including code) to a device, such as writes of blocks to a disk, are first encrypted. Each allocation unit is preferably a predetermined integral multiple number of minimum I/O units. A data structure is marked to indicate which units are encrypted. Upon reads from the device, only those allocation units marked as encrypted are decrypted. The disk protected by selective encryption is preferably the virtual disk of a virtual machine (VM). The trigger condition is preferably either that the virtual disk has been initialized or that the VM has been powered on. Mechanisms are also provided for selectively declassifying (storing in unencrypted form) already-encrypted, stored data, and for determining which data units represent public, general-use data units that do not need to be encrypted. The “encrypt-on-write” feature of the invention may be used in conjunction with a “copy-on-write” technique.

7793279, Sep 7, 2010

Jul 24, 2006

11/491852

Bich Cau Le - San Jose CA, US
Matthew Eccleston - San Carlos CA, US

VMware, Inc - Palo Alto CA

G06F 9/44
G06F 3/00

717168, 719321

An agent loaded in a computer's operating system (OS) simulates disconnection and reconnection of a device, with no need to actually disconnect the device logically from a computer. During simulated reconnection, when the OS requests the hardware ID of the device, the agent returns a substitute ID, which causes the OS to load a substitute driver. Substitution of the ID also allows driver substitution for a not yet logically connected device; in this cases, no simulated disconnection or reconnection is needed. Driver substitution is dynamic and reversible, with no need to restart the system or reboot the OS and substitution of a driver for one device of a type does not disturb other devices of the same type. The invention may be implemented entirely in software, with no need for hardware modifications or device customization.

7890754, Feb 15, 2011

Sep 2, 2008

12/202873

Carl A. Waldspurger - Palo Alto CA, US
Matthew Eccleston - San Francisco CA, US

VMware, Inc. - Palo Alto CA

H04L 29/06

713164, 713189, 726 1, 726 22, 726 27

Upon occurrence of a trigger condition, writes of allocation units of data (including code) to a device, such as writes of blocks to a disk, are first encrypted. Each allocation unit is preferably a predetermined integral multiple number of minimum I/O units. A data structure is marked to indicate which units are encrypted. Upon reads from the device, only those allocation units marked as encrypted are decrypted. The disk protected by selective encryption is preferably the virtual disk of a virtual machine (VM). The trigger condition is preferably either that the virtual disk has been initialized or that the VM has been powered on. Mechanisms are also provided for selectively declassifying (storing in unencrypted form) already-encrypted, stored data, and for determining which data units represent public, general-use data units that do not need to be encrypted. The “encrypt-on-write” feature of the invention may be used in conjunction with a “copy-on-write” technique.

8166474, Apr 24, 2012

Sep 19, 2005

11/231127

Matthew Delco - Sunnyvale CA, US
Matthew Eccleston - San Francisco CA, US
Matthew Ginzton - San Francisco CA, US
Gustav Wibling - Palo Alto CA, US

VMware, Inc. - Palo Alto CA

G06F 9/455
G06F 15/173

718 1, 709226

A virtualization framework provides security between multiple virtual machines with respect to network communications between the virtual machines and between the virtual machines and a physical network coupled to the underlying physical computer platform. The virtualization framework includes a network interface controller driver that provides an interface to the platform network interface controller and supports execution of a plurality of virtual machines. Each virtual machine includes a virtual network interface controller that provides a network communications path between the virtual machines and to the network interface controller driver. Each virtual network interface controller further contains a programmable network packet filter that controls the selective transfer of network packets with respect to a corresponding virtual machine.

8255806, Aug 28, 2012

Sep 15, 2009

12/560349

Yaron Halperin - Sunnyvale CA, US
Jad Chamcham - Mountain View CA, US
Christian Matthew Leroy - San Francisco CA, US
Gerald I. L. Cheong - East Palo Alto CA, US
Matthew B. Eccleston - San Francisco CA, US
Noah Wasmer - Palo Alto CA, US

VMware, Inc. - Palo Alto CA

G06F 3/00

715742, 715743, 709217, 709218, 709225, 709226, 718 1

A virtual machine (VM) is accessed by receiving user log-in information, the log-in information identifying a user and a corresponding VM, the VM having a local copy and a remote copy. A selected copy of the VM is identified based on at least one of a policy and a user selection, the selected copy being one of the local copy and the remote copy of the VM. A desktop generated by the selected copy of the VM is presented to the user in a common application graphical user interface, the common application graphical user interface being used regardless as to whether the selected copy of the VM is the local copy or the remote copy.

8528107, Sep 3, 2013

Sep 14, 2006

11/522172

Matthew Ginzton - San Francisco CA, US
Matthew Eccleston - San Francisco CA, US
Srinivas Krishnamurti - San Carlos CA, US
Gerald C. Chen - Palo Alto CA, US
Nicholas Ryan - Sunnyvale CA, US

VMware, Inc. - Palo Alto CA

G06F 11/30
G06F 12/14
G06F 9/455

726 29, 726 17, 726 22, 713193, 718 1

An administrator may set restrictions related to the operation of a virtual machine (VM), and virtualization software enforces such restrictions. There may be restrictions related to the general use of the VM, such as who may use the VM, when the VM may be used, and on what physical computers the VM may be used. There may be similar restrictions related to a general ability to modify a VM, such as who may modify the VM. There may also be restrictions related to what modifications may be made to a VM, such as whether the VM may be modified to enable access to various devices or other resources. There may also be restrictions related to how the VM may be used and what may be done with the VM. Information related to the VM and any restrictions placed on the operation of the VM may be encrypted to inhibit a user from circumventing the restrictions.

8640126, Jan 28, 2014

Feb 23, 2009

12/390819

Yaron Halperin - Sunnyvale CA, US
Jad Chamcham - Mountain View CA, US
Christian M. Leroy - San Francisco CA, US
Gerald I. L. Cheong - Palo Alto CA, US
Matthew Eccleston - San Francisco CA, US
Ji Feng - Sunnyvale CA, US

VMware, Inc. - Palo Alto CA

G06F 9/455
G06F 15/16

718 1, 709203

A server-based desktop-virtual machines architecture may be extended to a client machine. In one embodiment, a user desktop is remotely accessed from a client system. The remote desktop is generated by a first virtual machine running on a server system, which may comprise one or more server computers. During execution of the first virtual machine, writes to a corresponding virtual disk are directed to a delta disk file or redo log. A copy of the virtual disk is created on the client system. When a user decides to “check out” his or her desktop, the first virtual machine is terminated (if it is running) and a copy of the delta disk is created on the client system. Once the delta disk is present on the client system, a second virtual machine can be started on the client system using the virtual disk and delta disk to provide local access to the user's desktop at the client system. This allows the user to then access his or her desktop without being connected to a network.

2012018, Jul 19, 2012

Mar 28, 2012

13/432940

Matthew DELCO - San Francisco CA, US
Matthew ECCLESTON - San Francisco CA, US
Matthew GINZTON - San Francisco CA, US
Gustav WIBLING - Naerum, DK

VMWARE, INC. - Palo Alto CA

G06F 21/00

726 1, 726 13

A virtualization framework provides security between multiple virtual machines with respect to network communications between the virtual machines and between the virtual machines and a physical network coupled to the underlying physical computer platform. The virtualization framework includes a network interface controller driver that provides an interface to the platform network interface controller and supports execution of a plurality of virtual machines. Each virtual machine includes a virtual network interface controller that provides a network communications path between the virtual machines and to the network interface controller driver. Each virtual network interface controller further contains a programmable network packet filter that controls the selective transfer of network packets with respect to a corresponding virtual machine.