Oracle International Corporation

Intel Corporation

Brian Spencer Payne

Pratibha Anjali Dohare

Saikat Chakrabarti

Rehan Loring Iftikhar

Vincent J Zimmer

Barry E Huntley

Scott Dion Rodgers

Jiewen Yao

Nicholas J Adams

Brian Delgado

The present embodiments relate to a secure boot partition for a cloud computing device of a cloud computing system. The computing device of the cloud computing system can transmit a first request for a pre-boot execution environment executable from a smart network interface card (SmartNIC). The computing device can receive the pre-boot environment executable from the SmartNIC and verify the pre-boot execution environment executable. The computing device can execute the pre-boot execution environment executable. Executing the pre-boot execution environment executable can include transmitting a second request secure boot metadata from the SmartNIC and receiving the secure boot metadata. Executing the pre-boot execution environment executable can further include mounting a boot partition, loading a boot loader obtained from the boot partition, verifying the boot loader based at least in part on the secure boot metadata, and executing the boot loader in response to verifying the boot loader.

Secure boot partition for cloud compute nodes

Techniques are disclosed for enabling attested end-to-end encryption for transporting data between devices. In one example, a destination device receives a policy profile that includes an origination key and a destination key, and the origination key corresponds to a public transfer key of a source device. The destination device verifies the policy profile based on the destination key corresponding to a public transfer key of the source device. The destination device receives a signed encrypted data encryption key from the source device. The destination device receives encrypted data from the source device. The destination device verifies the signed encrypted data encryption key originated from the source device based on the signed encrypted data key being signed with a private attestation identity key that corresponds to a public attestation identity key of the source device. The destination device decrypts encrypted data using a private transfer key of the destination device.

Attested end-to-end encryption for transporting sensitive data

The present embodiments relate to edge attestation of a host node to access a cloud infrastructure environment. A set of authentication data can be obtained from a console for authorization of the host node. The set of authentication data can include a first endorsement key and an authentication policy identifying characteristics of the host node. The host node can send a request for a network address to connect to the cloud infrastructure environment. The host node can generate a second endorsement key and authentication data that can be verified as corresponding to the set of authentication data received from the console. Responsive to validating the second endorsement key and the received host node authentication data, the network address can be provided to the host node that can be used to connect to the cloud infrastructure environment using the network address.

Edge attestation for authorization of a computing node in a cloud infrastructure system

Techniques are disclosed for enabling attested end-to-end encryption for transporting sensitive data between devices. In one example, an origination device receives and verifies, in a secure environment, a policy profile that includes an origination key of the origination device and a destination key of a destination device. The origination device generates and seals a data encryption key based on a characteristic of the secure environment. The origination device then encrypts the data encryption key with a public key of the destination device to form an encrypted data encryption key. The origination device then signs the encrypted data encryption key with a private attestation identity key of the origination device. The origination device encrypts the sensitive data with the sealed data encryption key to form encrypted data, and then transmits the signed encrypted data encryption key and the encrypted data to the destination device for subsequent decryption of the encrypted data.

Embodiments related to hardware configuration reporting and arbitration are disclosed herein. For example, an apparatus for hardware configuration reporting may include: a processing device having a trusted execution environment (TEE) and a non-trusted execution environment (non-TEE); request service logic, stored in the memory, to operate within the TEE to receive an indication of a request from arbiter logic, wherein the request represents a hardware configuration register; and reporting logic, stored in the memory, to operate within the TEE and to report an indicator of a value of the hardware configuration register represented by the request to the arbiter logic. Other embodiments may be disclosed and/or claimed.

Hardware configuration reporting systems

In an embodiment, a processor includes at least one core to execute instructions and a system management monitor to receive a platform query request from an external system, obtain status information regarding a configuration of one or more privileged resources of the processor, and report the status information to the external system. Other embodiments are described and claimed.

Growing community of inventors

Portland, OR, United States of America

Brian Spencer Payne