Intel Corporation

Mcafee, Inc.

Adrian R Pearson

Peter Munguia

Jason R Cox

Thomas R Bowen

Christopher Andrew Thornburg

Steve J Brown

Gamil A Cain

Steven J Brown

Hormuzd M Khosravi

Jawad Basit Khan

Mahesh S Natu

Lokpraveen B Mosur

Sergiu D Ghetie

Faraz A Siddiqi

Patrick Fleming

Neeraj S Upasani

Brian S Hausauer

Prasenjit Biswas

Musa Jahanghir

Tony Hurson

James Chu

Ned M Smith

Ravi L Sahita

Sanjeev N Trika

Xiaoning Li

Dmitrii A Loukianov

David R Noeldner

Abhilasha Bhargav-Spantzel

Jason Sandri

Barak Hermesh

Bing Zhu

Jonathan M Hughes

Ziv Kfir

Raymond Ng

Yang Huang

Monib Ahmed

Elena Agranovsky

Teddy Gordon Greer

David Allan Schollmeyer

Jason Casmira

Benjamin Boyer

Christopher Ruesga

Niels Juel Reimers

Emily Po-Kay Chung

Ambika Krishnamoorthy

Tomas Winkler

Brandon Collier

Examples disclosed herein include are computing device hardware components, computing devices, systems, machine-readable mediums, and interconnect protocols that provide for code object measurement of a peripheral device and a method for accessing the measurements to verify integrity across a computing interconnect (e.g., Peripheral Component Interconnect Express—PCIe). For example, a cryptographic processor of a PCIe endpoint (such as a peripheral) may take a measurement (e.g., computing a hash value) of a code object on the device prior to executing the code object. This measurement may be placed in a register that is accessible to another component, such as a host operating system across a PCIe bus for interrogation. The host operating system may utilize an interconnect protocol, such as a PCIe protocol to access the measurement. These measurements may be consumed by a Trusted Platform Manager or other components of a host system that may verify the measurements.

Exposing cryptographic measurements of peripheral component interconnect express (PCIE) device controller firmware

Multi-mode protected memory in accordance with the present description includes a permanent mode and a transient mode of operation. In one embodiment of the permanent mode, an authentication key is programmable once and a write counter is not decrementable or resettable. In one embodiment of the transient mode, an authentication key may be programmed many times and a write counter may be reset many times. Other features and advantages may be realized, depending upon the particular application.

Multi-mode protected memory

Various embodiments are generally directed to an apparatus, method and other techniques to determine a secure memory region for a transaction, the secure memory region associated with a security association context to perform one or more of an encryption/decryption operation and an authentication operation for the transaction, perform one or more of the encryption/decryption operation and the authentication operation for the transaction based on the security association context, and cause communication of the transaction.

Techniques to provide client-side security for storage of data in a network environment

A self-encrypting drive (SED) comprises an SED controller and a nonvolatile storage medium (NVSM) responsive to the SED controller. The SED controller enables the SED to perform operations comprising: (a) receiving an encrypted media encryption key (eMEK) for a client; (b) decrypting the eMEK into an unencrypted media encryption key (MEK); (c) receiving a write request from the client, wherein the write request includes data to be stored and a key tag value associated with the MEK; (d) using the key tag value to select the MEK for the write request; (e) using the MEK for the write request to encrypt the data from the client; and (f) storing the encrypted data in a region of the NVSM allocated to the client. Other embodiments are described and claimed.

Technology for fine-grain encryption and secure key injection on self-encrypting drives

Examples disclosed herein include are computing device hardware components, computing devices, systems, machine-readable mediums, and interconnect protocols that provide for code object measurement of a peripheral device and a method for accessing the measurements to verify integrity across a computing interconnect (e.g., Peripheral Component Interconnect Express&#x2014;PCIe). For example, a cryptographic processor of a PCIe endpoint (such as a peripheral) may take a measurement (e.g., computing a hash value) of a code object on the device prior to executing the code object. This measurement may be placed in a register that is accessible to another component, such as a host operating system across a PCIe bus for interrogation. The host operating system may utilize an interconnect protocol, such as a PCIe protocol to access the measurement. These measurements may be consumed by a Trusted Platform Manager or other components of a host system that may verify the measurements.

Exposing cryptographic measurements of peripheral component interconnect express (PCIe) device controller firmware

Various embodiments are generally directed to an apparatus, method and other techniques to de determine a secure memory region for a transaction, the secure memory region associated with a security association context to perform one or more of an encryption/decryption operation and an authentication operation for the transaction, perform one or more of the encryption/decryption operation and the authentication operation for the transaction based on the security association context, and cause communication of the transaction.

Various embodiments are directed to a system for accessing a self-encrypting drive (SED) based on a blind challenge authentication response mechanism (BCRAM). An SED may be authenticated within a system, for example, upon resuming from a sleep state, based on a challenge generated within the SED, signed using a private key by a trusted execution environment (TEE) and authenticated using a corresponding public key within the SED.

Challenge response authentication for self encrypting drives

Systems, apparatuses and methods may provide for technology to conduct, by a storage device, a state analysis of the storage device based on an assert log associated with a failure condition in the storage device. The technology may also return, by the storage device, the storage device to service if the state analysis indicates that the storage device is operable. Additionally, the technology may remove, by the storage device, the storage device from service if the state analysis indicates that the storage device is inoperable.

Automated resetting of storage devices and remote reporting of assert logs

Systems, apparatuses and methods may provide for technology that digitally signs a hash table and a data payload, wherein the data payload is partitioned into a plurality of storage blocks and the hash table specifies how to index into and individually authenticate the plurality of storage blocks. Additionally, a write of the digitally signed hash table and data payload may be initiated to an aggregate storage array. In one example, the aggregate storage array authenticates the digital signature of the hash table and the data payload and conducts a write of the data payload to a plurality of drives in the aggregate storage array in accordance with the hash table.

Performing authenticated writes across aggregate storage volumes

A system for securing electronic devices includes a storage device including a storage device controller processor, at least one non-transitory machine readable storage medium in firmware of the storage device communicatively coupled to the storage device controller processor, and a monitor application comprising computer-executable instructions on the medium. The instructions are readable by the storage device controller processor. The monitor application is configured to provision one or more read-only areas of the storage device, provision a candidate copy area of the storage device, reduce a maximum capacity available for user data on the storage device by a size of the read-only areas and the candidate copy area, and secure access to the read-only areas of the storage device.

Remote provisioning and authenticated writes to secure storage devices

Provided are an apparatus, system, and method authenticating a system to access diagnostic interface in a storage device. The storage device includes a computer readable storage medium implemented to store data and a controller. The controller receives a request from the computer system to initiate a cryptographic nonce to access diagnostic interface in the storage device. The controller generates a nonce and returns to the computer system. Upon receiving an unlock request from the computer system to access the diagnostic interface including a signed nonce comprising at least the nonce encrypted with a private key by the authorized unlock system, the controller uses a public key that is a cryptographic pair with the private key to decrypt the signed nonce to determine whether to grant the computer system access to the diagnostic interface in the storage device.

Authenticating a system to enable access to a diagnostic interface in a storage device

In one embodiment, a system comprises a processor to, in response to a determination that a write command is suspect, identify a logical address associated with the write command; and send a checkpoint command identifying the logical address to a storage device to preserve data stored in the storage device at a physical address associated with the logical address.

Method and apparatus for range based checkpoints in a storage device

Methods, apparatus, systems and articles of manufacture are disclosed to initialize a platform. An example disclosed apparatus includes a boot loader manager to prevent operating system loading in response to detecting a power-on condition, a context manager to retrieve first context information associated with the platform, and a policy manager to identify a first operating system based on the first context information, the policy manager to authorize the boot loader manager to load the first operating system.

Methods, systems and apparatus to initialize a platform

Growing community of inventors

Hillsboro, OR, United States of America

Adrian R Pearson