Intel Corporation

Eugene M Kishinevsky

Siddhartha Chhabra

Men Long

David M Durham

Uday R Savagaonkar

Kirk S Yap

Baiju V Patel

Alpa T Narendra Trivedi

Jungju Oh

Sriram R Vangal

Somnath Paul

Binata Bhattacharyya

Michael Abbott

Evgeny Zhyvov

Encryption interface technologies are described. A processor can include a system agent, an encryption interface, and a memory controller. The system agent can communicate data with a hardware functional block. The encryption interface can be coupled between the system agent and a memory controller. The encryption interface can receive a plaintext request from the system agent, encrypt the plaintext request to obtain an encrypted request, and communicate the encrypted request to the memory controller. The memory controller can communicate the encrypted request to a main memory of the computing device.

Encryption interface

Technologies for memory encryption include a computing device to generate a keyed hash of a data line based on a statistical counter value and a memory address to which to write the data line and to store the keyed hash to a cache line. The statistical counter value has a reference probability of incrementing at each write operation. The cache line includes a plurality of keyed hashes and each of the keyed hashes corresponds with a different data line. The computing device further encrypts the data line based on the keyed hash, the memory address, and the statistical counter value.

Technologies for memory confidentiality, integrity, and replay protection

The present disclosure is directed to attack detection through signal delay monitoring. An example system may comprise at least one device including a physical interface. At least one signal delay monitor may determine whether a signal being transmitted to the device is received as expected at the physical interface and indicate a potential attack when the signal is determined to not be received as expected. Determining whether the signal is received as expected may include determining whether the signal is received within a window defining a time period in which receipt of the signal is expected. An example signal monitor may comprise at least a new data reception monitoring module and an expected reception window monitoring module. These modules may include logic to determine whether the signal is received within the window. An indication of a potential attack may trigger, for example, security-related actions in the system.

Attack detection through signal delay monitoring

A processing or memory device may include a first encryption pipeline to encrypt and decrypt data with a first encryption mode and a second encryption pipeline to encrypt and decrypt data with a second encryption mode, wherein the first encryption pipeline and the second encryption pipeline share a single, shared pipeline for a majority of encryption and decryption operations performed by the first encryption pipeline and by the second encryption pipeline. A controller (and/or other logic) may direct selection of encrypted (or decrypted) data from the first and second encryption pipelines responsive to a region of memory to which a physical address of a memory request is directed. The result of the selection may result in bypassing encryption/decryption or encrypting/decrypting the data according to the first encryption mode or the second encryption mode. More than two encryption modes are envisioned.

Efficient sharing of hardware encryption pipeline for multiple security solutions

In an embodiment, a processor includes: at least one core to execute instructions; and a memory protection logic to encrypt data to be stored to a memory coupled to the processor, generate a message authentication code (MAC) based on the encrypted data, the MAC to have a first value according to a first key, obtain the encrypted data from the memory and validate the encrypted data using the MAC, where the MAC is to be re-keyed to have a second value according to a second key and without the encrypted data. Other embodiments are described and claimed.

Protecting a memory

In an embodiment, a processor includes: at least one core to execute instructions; a cache memory coupled to the at least one core to store data; and a tracker cache memory coupled to the at least one core. The tracker cache memory includes entries to store an integrity value associated with a data block to be written to a memory coupled to the processor. Other embodiments are described and claimed.

Providing enhanced replay protection for a memory

Techniques for resilient communication. A data path stores data to be transmitted over a link to a receiving node. An output stage is coupled between the data path and the link. The output stage includes double sampling mechanisms to preserve a copy of data transmitted over the link to the receiving node. Error detection circuitry is coupled with the output stage to detect transient timing errors in the data path or output stage. The error detection circuitry causes the output stage to send the copy of the data transmitted over the link in response to detecting an error.

Growing community of inventors

Hillsboro, OR, United States of America

Eugene M Kishinevsky