Intel Corporation

Akshay Ramesh Kadam

Reshma Lal

Pradeep M Pappachan

Lawrence A Booth

Brent D Thomas

Salessawi Ferede Yitbarek

Nicholas D Triantafillou

Paritosh Saxena

Paul J Thadikaran

Karthikeyan Vaidyanathan

Ashwani Garg

Sagar Jogadhenu Pratap

Chirayu Patel

Hormuzd M Khosravi

Sanjeev N Trika

Alex Nayshtut

Eliezer Tamir

Men Long

Robert W Strong

Richard Paul Mangold

James T Doyle

Lokpraveen B Mosur

Simoni Ben-Michael

Mark E Scott-Nash

Paul S Schmitz

Royce Fernald

Edward J Pullin

Richard J Heiler

Vishnuvarthanan Balraj

Brad W Stewart

Carol L Barrett

Pradeep Malhotra

Embodiments are directed to protection of communications between a trusted execution environment and a hardware accelerator utilizing enhanced end-to-end encryption and inter-context security. An embodiment of an apparatus includes one or more processors having one or more trusted execution environments (TEEs) including a first TEE to include a first trusted application; an interface with a hardware accelerator, the hardware accelerator including trusted embedded software or firmware; and a computer memory to store an untrusted kernel mode driver for the hardware accelerator, the one or more processors to establish an encrypted tunnel between the first trusted application in the first TEE and the trusted software or firmware, generate a call for a first command from the first trusted application, generate an integrity tag for the first command, and transfer command parameters for the first command and the integrity tag to the kernel mode driver to generate the first command.

Protection of communications between trusted execution environment and hardware accelerator utilizing enhanced end-to-end encryption and inter-context security

A storage device is divided into a trusted storage region (TSR) and a standard storage region (SSR). A backup and recovery tool (BRT) is used to generate a public/private key pair and provide the public key to the storage device. The BRT detects a trigger to back up a file from the SSR to the TSR and sends a write instruction to the storage device to perform the backup. The BRT signs the write instruction with the private key. The storage device uses the public key to verify the write instruction and performs the backup based on the verification. The TSR cannot be accessed without the private key, therefore if a malware attack is detected in the storage device, the device may be formatted to delete infected files. A fresh operating system may be installed on the formatted storage device and the file may be recovered from the TSR.

File backups using a trusted storage region

Described herein are articles, systems, and methods for using a storage controller to protect secure data blocks through the enforcement of a read only policy. In some embodiments, the articles use a combination of hardware protections and software protections (e.g., virtualization) to protect a system against attack from malware while such secure data is updated. Also described are systems and methods for securely updating data blocks secured in this fashion, and detecting and preventing the corruption of data stored on secondary storage media using a disk eventing mechanism.

Methods and apparatus for a safe and secure software update solution against attacks from malicious or unauthorized programs to update protected secondary storage

Techniques for a data storage device to locally implement security management functionality. In an embodiment, a security management process of the data storage device is to determine whether an access to non-volatile media of the data storage device is authorized. In certain embodiments, the data storage device is to restrict access to a secure region of the non-volatile storage media, the secure region to store information used and/or generated by a security management process of the data storage device.

Techniques for security management provisioning at a data storage device

An anti-malware approach uses a storage drive with the capability to lock selected memory areas. Platform assets such as OS objects are stored in the locked areas and thus, unauthorized changes to them may not be made by an anti-malware entity.

Storage drive based antimalware methods and apparatuses

A high integrity storage manager protects critical system files by maintaining a list of protected disk blocks in hardware, such as in a memory of a microcontroller. The memory is inaccessible to software running on a host system comprising the microcontroller. This list of protected disk blocks is protected as 'read only' by the hardware so that no write operation issued by software running on the host platform can overwrite a protected disk block. The high integrity storage manager intercepts write operations issued by applications via the operating system and file system running on the host processor and compares the disk blocks targeted by those write operations to the list of protected disk blocks. A write operation that would overwrite a disk block in the list of protected disk blocks is prevented from completion. Other embodiments are described and claimed.

Protecting persistent secondary platform storage against attack from malicious or unauthorized programs

Method and apparatus relating to building distributed fault-tolerant/high-availability computer applications are described. In an embodiment, a system may include an application, a router, and an update module. The application may execute a process in a pure distributed mode, a pure fault tolerant mode, or a distributed fault tolerant mode. The router may route communications between the application and another application independent of location of the applications. The update module may provide distributed functionality in the application. Other embodiments are also disclosed.

Apparatus and method for building distributed fault-tolerant/high-availability computer applications

Software architecture for developing distributed fault-tolerant systems independent of the underlying hardware architecture and operating system. Systems built using architecture components are scalable and allow a set of computer applications to operate in fault-tolerant/high-availability mode, distributed processing mode, or many possible combinations of distributed and fault-tolerant modes in the same system without any modification to the architecture components. The software architecture defines system components that are modular and address problems in present systems. The architecture uses a System Controller, which controls system activation, initial load distribution, fault recovery, load redistribution, and system topology, and implements system maintenance procedures. An Application Distributed Fault-Tolerant/High-Availability Support Module (ADSM) enables an applications( ) to operate in various distributed fault-tolerant modes. The System Controller uses ADSM's well-defined API to control the state of the application in these modes. The Router architecture component provides transparent communication between applications during fault recovery and topology changes. An Application Load Distribution Module (ALDM) component distributes incoming external events towards the distributed application. The architecture allows for a Load Manager, which monitors load on various copies of the application and maximizes the hardware usage by providing dynamic load balancing. The architecture also allows for a Fault Manager, which performs fault detection, fault location, and fault isolation, and uses the System Controller's API to initiate fault recovery. These architecture components can be used to achieve a variety of distributed processing high-availability system configurations, which results in a reduction of cost and development time.

Apparatus and method for building distributed fault-tolerant/high-availability computed applications

Growing community of inventors

Bengaluru, India

Akshay Ramesh Kadam