Microsoft Technology Licensing, LLC

Bryan David Kelly

Sriram Govindan

Badriddine Khessib

Mallik Bulusu

Mark Santaniello

Ling Tony Chen

Anirudh Badam

Peter David Waxman

Tom Long Nguyen

Neeraj Ladkani

John Joseph Siegler

Md Nazmus Sakib

Mark A Shaw

Shaun L Harris

Vishal Soni

Jie Jerry Liu

Eric Clarence Peterson

Mark Edward Shaw

Sean Michael James

Di Wang

Sriram Sankar

Ricardo Gouvea Bianchini

Bharat S Pillilli

Brandon Aaron Rubenstein

Ramakoti R Bhimanadhuni

Chris Ong

Ishwar Agarwal

Scott Chao-Chueh Lee

J Michael Andrewartha

Ronald Aigner

Muhammad Ashfaq Ahmed

Ravi Mysore Shantamurthy

Kushagra Vaid

Harry Raymond Rogers

Matthew Allen Faist

Woongki Baek

David Guy Weston

Pingfan Song

Christopher Lawrence Weimer

Priya Raghu

Ali Hassan Larijani

Nazmus Sakib

Brijesh Ramachandran

Jie Liu

Eric Peterson

Embodiments described herein are directed to firmware policy enforcement of a computing device. For example, a security processor of the computing device is utilized to boot the computing device. During a boot session, the security processor loads and executes specialized firmware. The specialized firmware, when executed, causes the security processor to determine whether other types of firmware to be executed on the computing device is in compliance with a policy specified by the specialized firmware. Based at least on a determination that the other firmware is in compliance with the policy, the security processor executes the other firmware. Based at least on a determination that the other firmware is not in compliance with the policy, the security processor performs a mitigation with respect to the other firmware.

Firmware policy enforcement via a security processor

Systems and methods for a confidential compute architecture integrated with direct swap caching are described. An example method for managing a near memory and a far memory includes, in response to determining that the far memory contains an encrypted version of a first block of data, retrieving from the far memory the encrypted version of the first block of data, decrypting the first block of data using a first key for exclusive use by a first virtual machine associated with the system, and providing a decrypted version of the first block of data to the requestor. The method further includes swapping out a second block of data having an address conflict with the first block of data from the near memory to the far memory, where the second block of data is encrypted using a second key for exclusive use by a second virtual machine associated with the system.

Confidential compute architecture integrated with direct swap caching

Systems and methods for an attestation service associated with a data center are provided. A method includes validating: (1) a first set of measurement logs against a first policy associated with a first cluster of nodes in a data center, and (2) a second set of measurement logs against a second policy, different from the first policy, associated with a second cluster of nodes in the data center. The method further includes upon successful validation: (1) sending a first encrypted package including a first encrypted machine certificate to a certificate authority associated with the data center and (2) sending a second encrypted package including a second encrypted machine certificate to the certificate authority associated with the data center. The method further includes the certificate authority: (1) sending the first encrypted package to the first attestation client and (2) sending the second encrypted package to the second attestation client.

Attestation service for enforcing payload security policies in a data center

Techniques for ensuring address translation services (ATS) functionality is used correctly and safely for any type of device that supports ATS, even for devices that might potentially be acting in a rogue manner, are disclosed. A host performs an integrity check on a device that uses ATS to prevent the device from maliciously using a locally cached HPA. The device submits a first ATS-enabled request to the host. The device receives metadata comprising (i) a first integrity check vector (ICV) that is usable to authenticate the device, (ii) the HPA, and (iii) an initialization vector (IV). The device locally caches the metadata in an address translation cache (ATC). The device submits a second ATS-enabled request, which includes the metadata. The host then independently authenticates the device using the received metadata in the request.

Securing ATS from rogue devices for confidential computing

Embodiments described herein are directed to transferring the ownership of a computing device from one entity to another entity. For example, a security processor is utilized to boot the computing device. During a boot session, the security processor loads and executes boot code, which determines whether specialized firmware authorized by the current owner indicates whether a transfer of ownership is to occur. In response to determining that the specialized firmware indicates that a transfer of ownership is to occur, the secure processor loads and executes the specialized firmware. The specialized firmware, when executed, causes the security processor to program a set of fuses with the public key of the new owner. Execution of the specialized firmware also causes the security processor to invalidate the public key of the original owner, which is stored in another set of fuses.

Transfer of ownership of a computing device via a security processor

Techniques are described herein that are capable of reducing latency of changing an operating state of a processor from a low-power state to a normal-power state. For example, providing a notification from a hardware system to the processor or receiving the notification at the processor, indicating that a transaction layer packet will be provided to the processor at a future time, may trigger the processor to change the operating state from the low-power state to the normal-power state. In another example, receipt of a transaction layer packet at the processor from a hardware system may trigger the processor to change the operating state from the low-power state to the normal-power state.

Reducing latency of changing an operating state of a processor from a low-power state to a normal-power state

Methods, systems, apparatuses, and computer-readable storage mediums described herein are configured to dynamically configure a baseboard management controller to monitor a state of a server. For example, a configuration schema may be provided to the baseboard management controller. The configuration schema specifies each of the devices of the server that is to be monitored by the baseboard management controller. The configuration schema also specifies additional configuration details with respect to each of the devices. Based on the configuration information included in the configuration schema, the baseboard management controller performs a discovery sequence with respect to each of the devices to verify that such devices are communicatively coupled to the baseboard management controller. If the discovery sequence is successful, the baseboard management controller begins monitoring the devices. However, if the discovery sequence is unsuccessful, the baseboard management controller issues an error, thereby enabling the proper personnel to remediate the issue.

Dynamically-configurable baseboard management controller

Methods, systems, apparatuses, and computer-readable storage mediums described herein enable executable code of a hardware security platform (HSP) circuit to communicate with a hypervisor in a separate processor. The hypervisor generates and manages virtual machines. The HSP code comprises trusted platform module (TPM) logic, that processes TPM commands received via the hypervisor, and in response to the processing, communicates security information (e.g., measurements, keys, authorization data) with the virtual machines via the hypervisor. The TPM logic receives security information related to a virtual machine from the hypervisor and stores the security information in non-volatile memory of the HSP circuit, where security information from a particular VM is distinguishable from security information from another VM in the HSP memory. The hypervisor (and VMs) communicate via a network fabric with the HSP circuit within an SOC, or the HSP may reside on a discrete chip and communicate via a secure encrypted channel.

Hardware virtualized TPM into virtual machines

A system includes a stored counter value and a stored boot manifest including a manifest type flag. A manifest type of the boot manifest is determined based on the manifest type flag, a tenancy mode is determined based on a parity of the counter value, a first boot is executed if the manifest type is a first manifest type and the tenancy mode is a first tenancy mode, a second boot flow is executed if the manifest type is the first manifest type and the tenancy mode is a second tenancy mode, a third boot flow is executed if the manifest type is a second manifest type and the tenancy mode is the first tenancy mode, and a fourth boot flow is executed if the manifest type is the second manifest type and the tenancy mode is the second tenancy mode.

Firmware-based secure tenancy transfer

A computing device is provided, including memory storing an instruction storage location. The computing device may further include a processor system including a plurality of processor threads. The processor system may suspend execution of one or more respective processor threads of the plurality of processor threads. The processor system may store one or more respective processor thread contexts of the one or more processor threads in the memory. The processor system may enter a system management mode (SMM). The processor system may determine that the instruction storage location includes a code update instruction. The processor system may perform a code update based on the code update instruction. The processor system may exit the SMM. The processor system may retrieve the one or more processor thread contexts from the memory and resume execution of the one or more processor threads without rebooting the computing device.

Code update in system management mode

A computing device includes circuitry that is configured to disable a physical interface between a baseboard management controller (BMC) and a processor when the BMC is not running and a logical interface between the BMC and the processor is not available. Disabling the physical interface prevents an attacker from writing malicious code to the BMC using the physical interface. The computing device also includes circuitry that enables the physical interface between the BMC and the processor in response to receiving a unique signal sequence from a trusted external entity. When firmware should be installed on the BMC, someone with proper authorization can cause the trusted external entity to send the unique signal sequence to the circuitry on the computing device, thereby enabling the physical interface between the BMC and the processor. The processor can then write the firmware to non-volatile memory within the BMC across the physical interface.

Secure installation of baseboard management controller firmware via a physical interface

Growing community of inventors

Carnation, WA, United States of America

Bryan David Kelly