Secure hardware desktop buffer composition
AssigneeMicrosoft Corporation
InventorDan Wong
Life of this patent
Estimating the term…
Abstract
A plurality of virtual machines are executed on a host computer, the host computer including graphics hardware, and a display. The virtual machines write display data to their respective virtual desktop buffers. A virtual machine is selected to output to the display of the host computer. A composition buffer on the graphics hardware is enabled with respect to the selected virtual machine. The contents of the virtual desktop buffer associated with the selected virtual machine are copied to the composition buffer by the graphics hardware. The contents of the composition buffer are rendered and displayed by the graphics hardware. In addition, read access to the compositing buffer is restricted to the graphics hardware, thus preventing malicious software applications from capturing the display data across partitions.
Claims18
A method for desktop composition, the method comprising:
- executing at least two virtual machines at a host computer having graphics hardware, each virtual machine comprising a virtual desktop buffer;
- generating display data by the virtual machines to their corresponding virtual desktop buffer;
- executing a secure process comprising a hypervisor at the host computer to determine which virtual desktop buffer should be enabled;
- enabling at least one of the at least two virtual desktop buffers to instruct the graphics hardware to copy the display data of the enabled virtual desktop buffer;
- copying the display data of the enabled virtual desktop buffer to a composition buffer;
- copying the display data of the other one of the at least two virtual desktop buffers to the composition buffer wherein the composition buffer contains display data from the at least two virtual desktop buffers wherein the display data of each of the at least two virtual desktop buffers are displayed in separate windows;
- and
- transforming the display data into a format suitable for display on the host computer.
A computer, the computer comprising:
- a processor adapted to execute at least two virtual machines, each virtual machine generating display data into an associated virtual machine buffer, and a secure process comprising a hypervisor at the host computer to determine which associate virtual machine buffer should be enabled;
- memory adapted to store the virtual machine buffers;
- a graphics processor, the graphics processor comprising a composition buffer, and the graphics processor adapted to copy the contents of the virtual machine buffers that are enabled from the memory to the composition buffer, wherein the composition buffer is capable of containing display data from the two virtual machine buffers wherein the display data of each of the two virtual machine buffers are to be displayed in separate windows.
A system for desktop composition, the system comprising:
- an enabling component for enabling at least one virtual machine, the virtual machine executing on a host computer;
- a retrieval component for retrieving display data from the enabled virtual machine;
- a composition buffer for storing the retrieved display data from the at least two virtual desktop buffers wherein the display data of each of the at least two virtual desktop buffers are displayed in separate windows;
- a translation component for transforming the stored display data into a format suitable for display on the host computer;
- and
- a secure process component comprising a hypervisor to determine which virtual desktop buffer should be enabled.
Dependencies are inferred from the claim text.