Amazon Technologies, Inc.

Barak Wasserstrom

Ori Cohen

Andrew Robert Sinton

Ron Diamant

Nafea Bshara

Anthony Nicholas Liguori

Guy Nakibly

Yaniv Shapira

Alex Levin

Saar Gross

Erez Tsidon

Ronen Shitrit

Guy Zalik

Adi Habusha

Matthew Shawn Wilson

Georgy Machulsky

Said Bshara

Brian William Barrett

Clint Joseph Sbisa

Hani Ayoub

Tzachi Zidenberg

Moshe Raz

Tal Zilcer

Noam Efraim Bashari

Daniel Joseph Grey

Akram Baransi

Omri Itach

Asaf Modelevsky

Usama Nassir

Erez Izenberg

Erez Sabbag

Robert Klein

Idan Saar

Ronen Krupnik

Or Yochanan

Talel Shenhar

Idan Aharoni

Yaniv Meidan

Technologies are disclosed for using hardware-embedded monitors to monitor pages of local memory and detect attribute violations or other unauthorized operations relating to the memory. The attribute violations may include determining that a measurement of an executable page to be loaded into memory does not match any entry in a list of allowed pages for the memory. Responsive to detecting a violation, an alert or other mitigation protocol, which may include an audit of activities surrounding the violation, may be performed.

Secure monitors for memory page protection

A modified measured boot approach is utilized for establishing a secure communication link between two devices. Each device may execute a respective boot process until the device reaches the stage responsible for establishing the communication link with the other device. Each device may exchange its respective self-signed certificate and extend its certificate chain with the self-signed certificate received from the other device. A secure link can be established using the public key of the other device as a based key for a key exchange protocol.

Extending measured boot for secure link establishment

A boot process for a computing device, such as integrated circuit, includes security features that are inaccessible during certain operation modes. An image including permission to access those security features is received during the boot process and may be verified using one or more keys. In operation, access to the security features is permitted during the operation modes after the image is verified. Such an approach enables a boot process to permit access to certain features after receipt and verification of different images.

Combination boot for an integrated circuit

Technologies are disclosed for using hardware-embedded monitors to monitor pages of local memory and detect attribute violations or other unauthorized operations relating to the memory. The attribute violations may include mismatches of attributes (e.g., designating a page as writeable versus executable or vice versa) in entries in a translation buffer that point to a same physical address or other mismatches between designations of attributes for a page in physical and virtual space. Responsive to detecting a violation, an alert or other mitigation protocol, which may include an audit of activities surrounding the violation, may be performed.

An operational mode can be designated for a computing device, such as an integrated circuit. In particular, an input signal may be used to determine an operational mode, which may lead to bypassing or otherwise restricting one or more boot operations to permit use of the computing device. Such an approach provides improved flexibility to permit use of the computing device for testing or debugging while maintaining security features used during other operational modes.

Designating an operational mode for an integrated circuit

Multiple independent endpoint devices can be emulated using a single system on chip (SoC) device. Such a SoC can have multiple cores that can emulate ports according to a specified protocol, such as the peripheral component interconnect express (PCIe) protocol useful for data communications. An emulation agent can manage various aspects of these emulated endpoint devices in software, including serving interrupts for relevant emulated devices according to a determined priority scheme. Interrupts can be registered for each device, and data structures allocated dynamically for a determined number and type(s) of PCIe endpoint devices to be emulated. Each PCIe core on the SoC can function as a separate PCIe endpoint device endpoint for communicating with one or more hosts or other such devices.

Multiple port emulation

A coherent connection and a non-coherent connection are provided between system-on-chips (SoCs). The coherent connection can be coupled to coherent interconnects on the SoCs, and the non-coherent connection can be coupled to non-coherent interconnects on the SoCs. An input/output (I/O) transaction from an I/O device on a first SoC that is targeted to a second SoC can be transmitted via the non-coherent connection, and a processor transaction from the first SoC that is targeted to the second SoC can be transmitted via the coherent connection.

Non-coherent and coherent connections in a multi-chip system

Approaches in accordance with various embodiments can be used to provide bootstrap data for a computing device, such as a system on chip (SoC). In particular, various embodiments can use one or more shift registers to receive bits of a sequence of bootstrap data in parallel. Individual bits of this bootstrap data sequence can then be provided to the SoC, from the shift register(s), serially and using a single input. Such an approach prevents the need for multiple bootstrap pins on the SoC, as well as the need to multiplex those pins for use with other external devices.

Serial bootstrap

A modified measured boot approach is utilized for establishing a secure communication link between two devices. Each device may execute a respective boot process until the device reaches the stage responsible for establishing the communication link with the other device. Each device may exchange its respective self-signed certificate and extend its certificate chain with the self-signed certificate received from the other device. Each device can then generate a new pair of keys based on its extended certificate chain that includes the identity of the other device, and exchange the public key of the new key pair with the other device. A secure link can be established using the public key of the other device as a based key for a key exchange protocol. A central management entity can attest the measurements of the boot stages for each device using the corresponding public key.

A system-on-chip (SoC) can include a processor, a network controller configured to provide a network interface, and a memory controller configured to perform memory scrubbing. A memory patrol driver executing on the processor can initiate direct memory access (DMA) transfers to read successive portions of the memory by configuring corresponding DMA descriptors at a certain time interval. The network controller can perform each DMA transfer to read a corresponding portion of the memory, which can cause the memory controller to scrub the corresponding portion of the memory. The scrubbed data is sent to the network controller, which is discarded by the network controller.

Memory scrub using memory controller

Execution flows of a program can be characterized by a series of execution events. The rates at which these execution events occur for a particular program can be collected periodically, and the execution events statistics can be utilized for both training a machine learning model, and later on for making classification inferences to determine whether a program run contains any abnormality. When an abnormality is encountered, an alert can be generated and provided to supervisory logic of a computing system to indicate that an abnormal program flow has been detected.

Program flow classification

A one-time programmable (OTP) memory can be programmed over a number of programming sessions in which each programming session writes a different portion of the memory. To provide the OTP memory with data integrity check capability, the OTP memory stores multiple error detection code entries. With each programming session, a new error detection code is stored in a previously unused entry. When the OTP memory is read, the error detection code corresponding to the latest programming session is used to verify the content of the OTP memory.

Data integrity check for one-time programmable memory

A multi-phase boot operation of a virtualization manager at a virtualization host is initiated at an offload card. In a first phase of the boot, a security key stored in a tamper-resistant location of the offload card is used. In a second phase, firmware programs are measured using a security module, and a first version of a virtualization coordinator is instantiated at the offload card. The first version of the virtualization coordinator obtains a different version of the virtualization coordinator and launches the different version at the offload card. Other components of the virtualization manager (such as various hypervisor components that do not run at the offload card) are launched by the different version of the virtualization controller.

Secure booting of virtualization managers

Disclosed herein are techniques for enabling device communication in a secure environment. In one example, a system comprises a storage in a server, a first component in the server, the first component being isolated in a secure environment in the server, and an entry point device authorized to access the first component via the secure environment. The entry point device may receive a request to access the first component. The entry point device may store a notification in a region of the storage accessible by the first component, wherein the notification is to be read by the first component from the storage to set the first component to an operation mode. The entry point device may store operation data in the storage, wherein the operation data is to be acquired by the first component from the storage to control an operation of the first component in the operation mode.

Growing community of inventors

Mitzpe Aviv, Israel

Barak Wasserstrom