Intel Corporation

Daniel Nemiroff

Balaji Vembu

Suryaprasad Kareenahalli

Mousumi M Hazra

Ramesh Pendakur

Anoop Mukker

Zhenyu Zhu

Nobuyuki Suzuki

Francis Corrado

Raul N Gutierrez

David W Vogel

Vincent J Zimmer

Nitin V Sarangdhar

Jiangtao Li

Vidhya Krishnan

Xiaoyu Ruan

Walter C Gintz

Ned M Smith

Siddhartha Chhabra

Reshma Lal

Mallik Bulusu

Robert Charles Swanson

Scott R Janus

Ernie F Brickell

Jason Martin

William A Stevens, Jr

Malay Trivedi

Paritosh Saxena

Nicholas D Triantafillou

Amber D Huffman

Andrew H Gafken

Carlos Alfonso Tokunaga

Paul J Thadikaran

Robert W Cone

Piotr Michael Kwidzinski

Sandeep S Sodhi

John R Lindsley

Michael A Rothman

Jason W Brandt

Shay Gueron

Uday R Savagaonkar

Carlos V Rozas

Ankur N Shah

Vincent R Scarlata

James W Tschanz

David M Puffer

Simon P Johnson

Zohar Bogin

Howard C Herbert

Utkarsh Y Kakaiya

Robert W Strong

Rajeev K Nalawadi

Nimrod Diamant

Mojtaba Mirashrafi

Purushottam Goel

Moshe Maor

Ernest F Brickell

Jeffrey L Rabe

Carey W Smith

Kar Leong Wong

Geetani R Edirisooriya

John P Lee

Minki Cho

Debra Cablao

Kah Meng Yeem

Tsippy Mendelson

Yaxin Shui

Ben Furman

Jasper Balraj

Vincent Von Bokern

Fran Corrado

Yanai Moyal

David Puffer

Raul Gutierrez

An apparatus, system, and method for are provided. A device includes a first tunable replica circuit configured to detect an undervoltage and overclocking event, a second tunable replica circuit configured to detect an overvoltage and underclocking event, and a countermeasures component configured to alter a circuit of the device responsive to detection of the undervoltage and overclocking event or the overvoltage and underclocking event.

Overvoltage and slow clock glitch detection

An integrated circuit (IC) die comprises a sensor, which includes a pulse generator and a pulse expander. The pulse generator comprises gate circuits coupled to each other in an in-series arrangement. An input of the pulse generator is coupled to receive a voltage and the pulse generator is to generate a first signal based on the voltage. The pulse generator is to generate a first pulse of the first signal based on an event wherein radiation from a laser is incident upon the pulse generator. The pulse expander is coupled to receive the first signal from the pulse generator and to generate a second signal based on the first signal, wherein a second pulse of the second signal is based on the first pulse. A first duration of the first pulse is less than a second duration of the second pulse.

Detecting laser-injected faults

Device memory protection for supporting trust domains is described. An example of a computer-readable storage medium includes instructions for allocating device memory for one or more trust domains (TDs) in a system including one or more processors and a graphics processing unit (GPU); allocating a trusted key ID for a TD of the one or more TDs; creating LMTT (Local Memory Translation Table) mapping for address translation tables, the address translation tables being stored in a device memory of the GPU; transitioning the TD to a secure state; and receiving and processing a memory access request associated with the TD, processing the memory access request including accessing a secure version of the address translation tables.

Device memory protection for supporting trust domains

Connectionless trusted computing base recovery is described. An example of a system includes one or more processors to process data; hardware including a hardware RoT (root of trust); and firmware including a firmware TCB (trusted computing base), the firmware including the credentials including one or more certificates and one or more keys, wherein the one or more processors are to determine that the firmware TCB is compromised and that the hardware RoT is intact; issue new credentials by the hardware RoT to mutable firmware based on a version number or security version number (SVN) of the firmware; and revoke old versions of the credentials for the firmware.

Connectionless trusted computing base recovery

An example includes detecting receiving a bus turn-around (BTA) sequence after detecting a voltage level; sending a BTA acknowledgement in response to the BTA sequence; and sending a configuration command to a peripheral device after the interface is initialized based on the BTA acknowledgement.

Method for interface initialization using bus turn-around

An example method for initializing an interface includes driving a low voltage signal on data lanes and clock lanes. The method further includes performing a reset sequence and an initialization of a link configuration register. The method also includes driving a high voltage signal to the clock lanes and the data lanes. The method further includes driving a bus turn-around (BTA) sequence on the data lanes. The method also includes detecting that the BTA is acknowledged by a host controller.

An embodiment of a graphics apparatus may include a graphics processor including a kernel executor, and a security engine communicatively coupled to the graphics processor. The security engine may be configured to create a kernel security key, encrypt an executable kernel for the kernel executor in accordance with the kernel security key, and share the kernel security key with the graphics processor.

Graphics processor with encrypted kernels

Technologies for provisioning cryptographic keys include hardcoding identical cryptographic key components of a Rivest-Shamir-Adleman (RSA) public-private key pair to each compute device of a plurality of compute devices. A unique cryptographic exponent that forms a valid RSA public-private key pair with cryptographic key components hardcoded into each compute device is provided to each compute device so that each compute device has a unique public key. The public key of each compute device may be used to provision unique secrets to the corresponding compute device.

Technologies for provisioning cryptographic keys

In one embodiment, an apparatus comprises a first processor to generate a first cryptographic key in response to a request from a software application; receive a second cryptographic key generated by a second processor; encrypt the first cryptographic key using the second cryptographic key; and provide the encrypted first cryptographic key for use by the software application.

Method and apparatus for securely binding a first processor to a second processor

In embodiments, an apparatus for microcontroller (&#x3bc;C) or system-on-chip (SoC) computing includes a set of fuses disposed in a &#x3bc;C or a SoC to store a seed value and M pairs of loop counter values (LCVs) with which to locally generate M private keys from the seed value on the microcontroller or SoC, where M is a positive integer, each private key to decrypt data encrypted with a pre-defined public key cryptosystem, wherein each private key includes two prime numbers p and q (p,q), the LCVs being a number of iterations of a key derivation function (KDF) needed to respectively obtain p and q from the seed value; and a key decoder, disposed in the (&#x3bc;C) or the SoC, and coupled to the set of fuses, to read the seed value and the M pairs of LCVs, and, for each of the M private keys to: respectively generate (p,q) from the seed value by respectively iterating the KDF by the LCVs for that key.

Encoding process for multiple RSA and ECC keys

A system architecture provides a hardware-based root of trust solution for supporting distribution and playback of premium digital content. In an embodiment, hardware root of trust for digital content and services is a solution where the basis of trust for security purposes is rooted in hardware and firmware mechanisms in a client computing system, rather than in software. From this root of trust, the client computing system constructs an entire media processing pipeline that is protected for content authorization and playback. In embodiments of the present invention, the security of the client computing system for content processing is not dependent on the operating system (OS), basic input/output system (BIOS), media player application, or other host software.

Method and apparatus for building a hardware root of trust and providing protected content processing within an open computing platform

Embodiments of an invention for cryptographic key generation using a stored input value and a stored count value have been described. In one embodiment, a processor includes non-volatile storage storing an input value and a count value, and logic to generate a cryptographic key based on the stored input value and the stored count value.

Cryptographic key generation using a stored input value and a stored count value

An example method for power management of a user interface includes initiating a low power entry at a data lane of the user interface. The method further includes coordinating with a peripheral device to enter into an ultra-low power state. The peripheral device is to initiate a low power entry at the clock lane to enter the user interface into an ultra-low power state in response to detecting the low power entry at the data lane.

Power management of user interfaces with coordinated ultra-low power states

Growing community of inventors

Folsom, CA, United States of America

Daniel Nemiroff