Intel Corporation

Asher M Altman

Vincent R Scarlata

Simon P Johnson

David M Durham

Gilbert A Neiger

Uday R Savagaonkar

Carlos V Rozas

Prashant Dewan

Francis X Mckeen

John I Garney

Ernie F Brickell

Howard C Herbert

Gary L Graunke

Dion Rodgers

Michael A Goldsmith

Stephen R Van Doren

Stalinselvaraj Jeyasingh

Joseph Frank Cihula

Bernard Lint

Stephen J Tolopka

Don Alan Van Dyke

Jiang Tao Li

Mark A Schmisseur

John K Grooms

Robert Charles Swanson

Farid Adrangi

Prakash N Iyer

Henry M Mitchel

Sham M Datta

Thomas M Slaight

Anna Trikalinou

Shamanna M Datta

Gerald Lebizay

Mohamed Arafa

Daniel S Lake

Abhishek Das

Alan Stone

James (JR-Shian) Tsai

Techniques for tamper detection of a memory module having non-volatile memory devices resident on a printed circuit board (PCB) by circuitry of a controller also resident on the PCB. Examples include determining resistance values of a character pattern sprayed on a side of a cover facing the non-volatile memory devices using conductive ink following first and second boots of the memory module and asserting a bit of a register to indicate tampering of the memory modules based on a comparison of the resistance values. Tamper policy actions may be initiated based on detection of tampering.

Techniques for tamper detection and protection of a memory module

Technologies disclosed herein provide mitigations against warm boot attacks on memory modules. For instance, in one embodiment, a non-volatile dual in-line memory module (NVDIMM) in a host computing system may detect a transition from a low-power state to a full-power state, receive a nonce value from a processor of the host computing system after the transition, verify the nonce value, and allow access to data stored on the NVDIMM based on successful verification of the nonce value. In another embodiment, an NVDIMM may be locked in response to detecting a transition from a high-power state to a low-power state in a host computing system. After a transition from the low-power state to the full-power state, the NVDIMM may obtain one or more passphrases, verify the one or more passphrases, and allow access to data stored on the NVDIMM based on successful verification of the one or more passphrases.

Warm boot attack mitigations for non-volatile memory modules

A technique to enable secure application and data integrity within a computer system. In one embodiment, one or more secure enclaves are established in which an application and data may be stored and executed.

Method and apparatus to provide secure application execution

Various embodiments are directed to a system for accessing a self-encrypting drive (SED) upon resuming from a sleep power mode (SPM) state. An SED may be authenticated within a system, for example, upon resuming from a sleep state, based on unwrapping the SED passphrase with a SPM resume passphrase stored in a standby power register to receive power during the SPM state.

Secure resume from a low power state

The present application is directed to establishing ownership of a secure workspace (SW). A client device may provide a SW data structure (SWDS) to a SW configurator. A SWDS may comprise a hash of an original SW and a public key, and may be signed by a private key corresponding to the public key. The SW configurator may cause an execution container (EC) to be generated including a SW initiated using the SWDS. The client device may claim SW ownership using a request (signed by the private key) transmitted along with a copy of the public key. SW ownership may be determined by an ownership determination module that verifies the signature of the request using the public key received with the request, determines a hash of the received public key and compares the hash of the received public key to a hash of the public key in the SWDS.

System for establishing ownership of a secure workspace

Techniques and mechanisms for providing access to a storage device of a computer platform. In an embodiment, an agent executing on the platform may be registered for access to the storage device, the agent being allocated a memory space by a host operating system of the platform. Registration of the agent may result in a location in the allocated memory space being mapped to a location in the storage device. In another embodiment, the agent may write to the location in the allocated memory space to request access to the storage device, wherein the request is independent of any system call to the host OS which describes the requested access.

Method, system and apparatus for region access control

Methods and devices are disclosed for communicating in a wireless network using multi-protocol label switching (MPLS). A network service node is configured to send identical packets substantially simultaneously to each of a serving network access station and one or more target network access stations via two or more respective MPLS tunnels in response to a handoff trigger message. Additional embodiments and variations are also disclosed.

Mobile handover utilizing multicast in a multi-protocol label switching (MPLS)-based network

Growing community of inventors

Bedford, MA, United States of America

Asher M Altman