Intel Corporation

Bo A Zhang

Carlos V Rozas

Francis X Mckeen

Vincent R Scarlata

Wesley Hamilton Smith

James D Beaney, Jr

Simon P Johnson

Sigang Qiu

Piotr Zmijewski

Eduardo Cabre

Mark Shanahan

Vedavalli Gomatam Krishnan

Uday R Savagaonkar

Bin Xing

Ravi L Sahita

Siddhartha Chhabra

Reshma Lal

Karanvir S Grewal

Koichi Yamada

Nitin V Sarangdhar

William A Stevens, Jr

Scott H Robinson

Mona Vij

Moshe Maor

Zhigang Wang

Jiwei Lu

Timothy D Wig

Karl W Wyatt

Alex Berenzon

Tao Liang

John Critchlow

Larry R Tate

Shanwei Cen

Oron Lenz

Mandayam Krishnan

Sergei Goffman

Prashant Pratap Tawade

Xuefeng Jiang

Tevi Devor

Yoram Zahavi

Welmin Sun

Vedavalli G Krishna

James D Beany

Palaniverlrajan Shanmugavelayutham

Embodiments include systems, methods, computer readable media, and devices configured to, for a first processor of a platform, generate a platform root key; create a data structure to encapsulate the platform root key, the data structure comprising a platform provisioning key and an identification of a registration service; and transmit, on a secure connection, the data structure to the registration service to register the platform root key for the first processor of the platform. Embodiments include systems, methods, computer readable media, and devices configured to store a device certificate received from a key generation facility; receive a manifest from a platform, the manifest comprising an identification of a processor associated with the platform; and validate the processor using a stored device certificate.

Platform attestation and registration for servers

A computing platform implements one or more secure enclaves including a first provisioning enclave to interface with a first provisioning service to obtain a first attestation key from the first provisioning service, a second provisioning enclave to interface with a different, second provisioning service to obtain a second attestation key from the second provisioning service, and a provisioning certification enclave to sign first data from the first provisioning enclave and second data from the second provisioning enclave using a hardware-based provisioning attestation key. The signed first data is used by the first provisioning enclave to authenticate to the first provisioning service to obtain the first attestation key and the signed second data is used by the second provisioning enclave to authenticate to the second provisioning service to obtain the second attestation key.

Flexible provisioning of attestation keys in secure enclaves

Technologies for establishing device locality are disclosed. A processor in a computing device generates an identifier distinct to the computing device. The processor transmits the identifier to a management controller via a hardware bus in the computing device. The processor generates a key and encrypts the key with the identifier to generate a wrapped key. The processor transmits the wrapped key to the management controller. In turn, the management controller unwraps the key using the identifier. Other embodiments are described and claimed.

Technologies for establishing device locality

Technologies for monitoring a movement of one or more objects include an autonomous compute device. The autonomous compute device includes an optical system, for example, a LIDAR system, to capture optical data that may be used to determine a relative position of the one or more objects relative to the autonomous compute device. Based on the optical data captured at one point in time and an indication of how much the autonomous compute device has moved, the autonomous compute device may predict where an object will be relative to the autonomous compute device at a later point in time. Based on optical data captured at the later point in time, the autonomous compute device may determine whether the position of the object has been changed and further analyze the changes to monitor the movement of the object.

Technologies for LIDAR based moving object detection

Apparatuses, methods and storage medium associated with application execution enclave cache management, are disclosed herein. In embodiments, an apparatus may include one or more processors with supports for application execution enclaves; cache memory coupled with the one or more processors to be organized into a plurality of cache pages; and an exception handler to be operated by the one or more processors to handle cache page fault exceptions, wherein to handle cache page fault exceptions includes to handle a cache page fault triggered to request additional allocation of one or more cache pages to an execution enclave of an application. Other embodiments may be described and/or claimed.

Application execution enclave memory page cache management method and apparatus

Systems, apparatuses and methods may provide for verifying, from outside a trusted computing base of a computing system, an identity an enclave instance prior to the enclave instance being launched in the trusted computing base, determining a memory location of the enclave instance and confirming that the memory location is local to the computing system. In one example, the enclave instance is a proxy enclave instance, wherein communications are conducted with one or more additional enclave instances in the trusted computing base via the proxy enclave instance and an unencrypted channel.

Trusted launch of secure enclaves in virtualized environments

An apparatus and method for page level monitoring are described. For example, one embodiment of a method for monitoring memory pages comprises storing information related to each of a plurality of memory pages including an address identifying a location for a monitor variable for each of the plurality of memory pages in a data structure directly accessible only by a software layer operating at or above a first privilege level; detecting virtual-to-physical page mapping consistency changes or other page modifications to a particular memory page for which information is maintained in the data structure; responsively updating the monitor variable to reflect the consistency changes or page modifications; checking a first monitor variable associated with a first memory page prior to execution of first program code; and refraining from executing the first program code if the first monitor variable indicates consistency changes or page modifications to the first memory page.

Method and apparatus for page-level monitoring

Technologies for secure access to platform security services include a computing device having a processor and a security engine. The computing device establishes a platform services enclave in a virtual machine of the computing device using secure enclave support of the processor. The platform services enclave receives a platform services request from an application enclave via a first authenticated session and transmits the platform services request to a virtual security engine established by a host environment via a second authenticated session. The first and second authenticated sessions may be authenticated by report-based attestation and quote-based attestation, respectively. The virtual security engine transmits the platform services request to the security engine via a long-term pairing session established by the virtual security engine with the security engine. The security engine performs the platform services request using hardware resources shared with other platform services enclaves. Other embodiments are described and claimed.

Technologies for virtualized access to security services provided by a converged manageability and security engine

A processing device provides a method for protecting a program from unauthorized copying. The processing device may include an encrypted version of the program. According to one example method, the processing device creates a secure enclave, and in response to a request to execute the encrypted program, the processing device automatically generates a decrypted version of the program in the secure enclave by decrypting the encrypted program in the secure enclave. After automatically generating the decrypted version of the program in the secure enclave, the processing device may automatically execute the decrypted version of the program in the secure enclave. Other embodiments are described and claimed.

Methods and apparatus for protecting software from unauthorized copying

Embodiments of apparatus, computer-implemented methods, systems, devices, and computer-readable media are described herein for identifying and encrypting a subset of a plurality of instructions, for execution in a more secure execution environment. In various embodiments, the subset may include a single entry point and a single exit point. In various embodiments, one or more instructions of the plurality of instructions that precede or follow the subset may be executed in a first execution environment with a first security level. In various embodiments, the subset may be executed in a second execution environment with a second security level that is more secure than the first security level.

Identification and execution of subsets of a plurality of instructions in a more secure execution environment

A method and apparatus is described herein for pulse shift modulation of output waveforms for reducing crosstalk on interconnects. Based on input pulses/bits, an output waveform is selectively delayed by a shift value to ensure transitions in a first direction occur in a first half of a period and transitions in a second direction occur in a second half of the period. When the same pulse shift modulation is implemented on surrounding traces, certain worst-case crosstalk scenarios are reduced; thus reducing crosstalk and increasing performance in power consumption and speed of data transfer.

Pulse shift modulation for reducing cross-talk of single ended I/O interconnects

Component-less termination for electromagnetic couplers used in high speed/frequency differential signaling is described. In one embodiment, the apparatus includes a first signal line and a second signal line forming a differential pair, a first electromagnetic coupler to provide sampled electromagnetic signals from the first signal line, and a second electromagnetic coupler to provide sampled electromagnetic signals from the second signal line, wherein the first electromagnetic coupler is far end short circuited and wherein the second electromagnetic coupler is far end open circuited. Other embodiments are also described and claimed.

Component-less termination for electromagnetic couplers used in high speed/frequency differential signaling

A technique is proposed to accurately estimate the Network CODEC levels for each PCM code a server modem generates. These levels are affected by the digital impairments such as Digital attenuation PAD in the trunk, the Robbed Bit Signaling, the type of CODEC (&#x3bc;-law or a-law&#x2014;or non standard), and by analog impairments such as loop distortion, noise, inter-modulation distortion, echo. At client modem equalizer output good estimates for these levels are derived. By detecting RBS pattern of the trunk, and using averages of decode levels of similar RBS slots, more accurate data points are obtained. By further replacing these levels with the closest CODEC receive levels, good accuracy is obtained. Non-monotonic points are detected and eliminated. An upper limit is set for constellation points to avoid saturation of the receiver. IMD correction is applied to the decode levels. Ideal points that are not signaled, are added if possible. When PAD-detection or Codec detection fails, PAD is set to 0 dB and the constellation is based on originally received and averaged data points. Techniques are presented for V.90 type modem constellation generation.

Receiver codec super set constellation generator

Growing community of inventors

Boxborough, MA, United States of America

Bo A Zhang