Intel Corporation

Broadcom Corporation

Idea Corporation

Derrick Chu Lin

Millind Mittal

Gilbert A Neiger

Francis X Mckeen

Shreekant S Thakkar

James A Sutton, Ii

Howard C Herbert

Roger A Golliver

Carl M Ellison

Ken Reneris

Benny Eitan

Alexander D Peleg

Larry M Mennemeier

Yaakov Yaari

Punit Minocha

Carole Dulong

Eiichi Kowashi

Andrew F Glew

Edward Thomas Grochowski

David Bistry

Mehrdad Mohebbi

Ramamohan R Vakkalagadda

David W Grawrock

Srinivas Chennupaty

Patrick Y Law

Joseph John Tardo

Suresh Krishna

Christopher Owen

Nimish H Modi

Milland Mittal

Varsha P Tagare

Doron Orenstein

Hans J Mulder

Wolf C Witt

Ed Grochowski

Ofri Wechsler

Phillip Smith

Romamohan R Vakkalagadda

Ramamohan Rao Vakkalagadda

Ahmet Bindal

Satchitanand Jain

Kay K Huang

Charkravaythy Kosaraju

Champa R Yellamilli

Provided is an architecture for a cryptography accelerator chip that allows significant performance improvements over previous prior art designs. In various embodiments, the architecture enables parallel processing of packets through a plurality of cryptography engines and includes a classification engine configured to efficiently process encryption/decryption of data packets. Cryptography acceleration chips in accordance may be incorporated on network line cards or service modules and used in applications as diverse as connecting a single computer to a WAN, to large corporate networks, to networks servicing wide geographic areas (e.g., cities). The present invention provides improved performance over the prior art designs, with much reduced local memory requirements, in some cases requiring no additional external memory. In some embodiments, the present invention enables sustained full duplex Gigabit rate security processing of IPSec protocol data packets.

Classification engine in a cryptography acceleration chip

Distributed processing in a cryptography acceleration chip

A method and apparatus for performing a shift operation on packed data elements having multiple values. One embodiment includes accessing the shift control signal of a first format from a memory. The shift control signal identifyies a first packed shift operation and whether the shift positions are byte positions or bit positions, and causes a processor to execute a set of control signals of a second format, thereby accessing the packed data, shifting the packed data by the number of shift positions according to the first packed shift operation, generating a first replacement data for one of the number of positions, and producing a shifted first packed data comprising the first replacement data.

Method and apparatus for executing packed shift operations

A method and apparatus for providing, in a processor, a shift operation on a packed data element having multiple values. One embodiment of a central processing unit (CPU) includes instruction fetch logic to fetch a single-instruction-multiple-data (SIMD) shift instruction. A register stores a multiple data elements to be operated upon by the SIMD shift instruction. A barrel shifter concurrently shifts the data elements in a bit-wise manner by a variable number of bit positions in response to the SIMD shift instruction.

Method and apparatus for providing packed shift operations in a processor

A method and apparatus for providing, in a processor, a shift operation on a packed data element having multiple values. The apparatus having multiple muxes, each of the multiple muxes having a first input, a second input, a select input and an output. Each of the multiple bits that represent a shifted packed intermediate result on a first bus is coupled to the corresponding first input. Each of the multiple bits representing a replacement bit for one of the multiple values is coupled to a corresponding second input. Each of the multiple bits driven by a correction circuit is coupled to a corresponding select input. Each output corresponds to a bit of a shifted packed result.

A processing system has a processor that can operate in a normal ringoperating mode and one or more higher ring operating modes above the normal ringoperating mode. In addition, the processor can operate in an isolated execution mode. A memory in the processing system may include an ordinary memory area that can be accessed from the normal ringoperating mode, as well as an isolated memory area that can be accessed from the isolated execution mode but not from the normal ringoperating mode. The processing system may also include an operating system (OS) nub, as well as a key generator. The key generator may generate an OS nub key (OSNK) based at least in part on an identification of the OS nub and a master binding key (BK) of the platform. Other embodiments are described and claimed.

Protecting software environment in isolated execution

In one embodiment, a method of attestation involves a special mode of operation. The method comprises storing an audit log within protected memory of a platform. The audit log is a listing of data representing one or more software modules loaded into the platform. The audit log is retrieved from the protected memory in response to receiving an attestation request. Then, the retrieved audit log is digitally signed to produce a digital signature in response to the attestation request.

Platform and method for remote attestation of a platform

In an embodiment of the present invention, a technique is provided for remote attestation. An interface maps a device via a bus to an address space of a chipset in a secure environment for an isolated execution mode. The secure environment is associated with an isolated memory area accessible by at least one processor. The at least one processor operates in one of a normal execution mode and the isolated execution mode. A communication storage corresponding to the address space allows the device to exchange security information with the at least one processor in the isolated execution mode in a remote attestation.

Attestation key memory device and bus

The present invention is a method and apparatus to generates an isolated bus cycle for a transaction in a processor. A configuration storage contains configuration parameters to configure a processor in one of a normal execution mode and an isolated execution mode. An access generator circuit generates an isolated access signal using at least one of the isolated area parameters and access information in the transaction. The isolated access signal is asserted when the processor is configured in the isolated execution mode. A bus cycle decoder generates an isolated bus cycle corresponding to a destination in the transaction using the asserted isolated access signal and the access information.

Generating isolated bus cycles for isolated execution

A file is sent to a remote signing authority via a network. The signing authority checks the file and provides a signature indicating file integrity of the file. The signature returned from the signing authority via the network is verified.

File checking using remote signing authority via a network

In one embodiment, a method comprises configuring an access transaction generated by a processor by a configuration storage containing configuration parameters. The processor has a normal execution mode and an isolated execution mode. The access transaction has access information. In a further embodiment, a method comprises checking the access transaction by an access checking circuit using at least one of the configuration parameters and the access information.

Managing accesses in a processor for isolated execution

A chipset is initialized in a secure environment for an isolated execution mode by an initialization storage. The secure environment has a plurality of executive entities and is associated with an isolated memory area accessible by at least one processor. The at least one processor has a plurality of threads and operates in one of a normal execution mode and the isolated execution mode. The executive entities include a processor executive (PE) handler. PE handler data corresponding to the PE handler are stored in a PE handler storage. The PE handler data include a PE handler image to be loaded into the isolated memory area after the chipset is initialized. The loaded PE handler image corresponds to the PE handler.

Managing a secure environment using a chipset in isolated execution mode

The present invention is a method and apparatus to protect a subset of a software environment. A key generator generates an operating system nub key (OSNK). The OSNK is unique to an operating system (OS) nub. The OS nub is part of an operating system in a secure platform. A usage protector uses the OSNK to protect usage of a subset of the software environment.

Briefly, one embodiment of a platform for generating and utilizing a protected audit log is described. The platform comprises a system memory and a memory to contain an audit log. The audit log includes a plurality of single-write, multiple read entries. At least one of the entries of the audit log includes stored data integrity information loaded into the system memory during its power cycle.

Platform and method for generating and utilizing a protected audit log

Growing community of inventors

Foster City, CA, United States of America

Derrick Chu Lin