Intel Corporation

Other

Kapil Sood

Ned M Smith

Jesse R Walker

Francesc Guim Bernat

Kshitij Arun Doshi

Scott P Dubal

Andrew J Herdrich

Patrick L Connor

John Joseph Browne

Emily H Qi

David J Harriman

Manuel Nedbal

Ioannis T Schoinas

Rajesh Poornachandran

Karanvir S Grewal

Raghunandan Makaram

Tsung-Yuan Charles Tai

Alexander W Min

Timothy Verrall

Reshma Lal

Christian Maciocco

Susanne M Balle

Vincent J Zimmer

David M Durham

Ravi L Sahita

Muthaiah Venkatachalam

Vincent R Scarlata

Ravishankar Iyer

Jr-Shian Tsai

Vedvyas Shanbhogue

Siddhartha Chhabra

Travis T Schluessler

Karthik Kumar

Hormuzd M Khosravi

Ren Wang

Carlos V Rozas

Baiju V Patel

Thomas Willhalm

Mark A Schmisseur

Katalin Klara Bartfai-Walcott

Mats Gustav Agerstam

Sanjay Bakshi

Alexander Bachmutsky

Minyoung Park

Joey Chou

Matthew James Adiletta

Prashant Dewan

Eliezer Tamir

Suraj Prabhakaran

Xin Zeng

Tarun Viswanathan

James Robert Hearn

Valerie J Young

Yu-Yuan Chen

Brian J Skerry

Mesut A Ergin

John R Fastabend

Yeluri Raghuram

Stephen T Palermo

Mona Vij

Edwin Verplanke

Malini Krishnan Bhandaru

Jesse C Brandeburg

Yunhong Jiang

Trevor Cooper

Dinesh Kumar

Daniel J Dahle

Vijay Sarathi Kesavan

Ronald Perez

Lokpraveen B Mosur

Dario Sabella

Patrick G Kutch

Iosif Gasparakis

Somnath Chakrabarti

Thomas M Slaight

Nrupal R Jani

Patrick Fleming

Matthew Eldon Hoekstra

Thomas E Willis

Michael Hingston McLaughlin Bursell

William A Stevens, Jr

Ilango S Ganga

Niall D McDonnell

Nilesh K Jain

Ping Yu

Weigang Li

Manish Dave

Reouven Elbaz

Rajesh Gadiyar

Hari K Tadepalli

Wei Shen

Robert J Munoz

Meiyuan Zhao

Ajay G Gupta

Christopher J Lord

Kumar Narasimhan Dwarakanath

Marcin Spoczynski

Changzheng Wei

Bing Zhu

Maryam Tahhan

Various systems and methods for enabling derivation and distribution of an attestation manifest for a software update image are described. In an example, these systems and methods include orchestration functions and communications, providing functionality and components for a software update process which also provides verification and attestation among multiple devices and operators.

Attestation manifest derivation and distribution using software update image

Various methods, systems, and use cases for securely managing, generating, and controlling access to keys in a service mesh are discussed herein. In various examples, key protection operations include service mesh signing key protection and service mesh communication key protection, for a secure transport session between services such as conducted with mutual transport layer security (mTLS). For instance, such key protection operations may be used to establish communications between the service host and another entity within the service mesh, in a secure transport session, based on use of a private key (secured using a confidential computing technology) in a secure enclave or other secure compute environment to sign one or more keys for the secure transport session.

Secure key management for service mesh deployments

A network interface controller (NIC) to interact with virtual environments when they are within a trusted environment protected by a cryptography scheme. The NIC performs encryption of data in accordance with the cryptographic scheme of a target trusted environment prior to copying the data for access by the target trusted environment.

Network interface with data protection

Examples herein relate to an interface selectively providing access to a memory region for a work request from an entity by providing selective access to a physical address of the memory region and selective access to a cryptographic key for use by a memory controller to access the memory region. In some examples, providing selective access to a physical address conversion is based on one or more of: validation of a certificate received with the work request and an identifier of the entity being associated with a process with access to the memory region. Access to the memory region can be specified to be one or more of: create, read, update, delete, write, or notify. A memory region can be a page or sub-page sized region. Different access rights can be associated with different sub-portions of the memory region, wherein the access rights comprise one or more of: create, read, update, delete, write, or notify.

Protected data accesses using remote copy operations

Disclosed herein are embodiments related to security in cloudlet environments. In some embodiments, for example, a computing device (e.g., a cloudlet) may include: a trusted execution environment; a Basic Input/Output System (BIOS) to request a Key Encryption Key (KEK) from the trusted execution environment; and a Self-Encrypting Storage (SES) associated with the KEK; wherein the trusted execution environment is to verify the BIOS and provide the KEK to the BIOS subsequent to verification of the BIOS, and the BIOS is to provide the KEK to the SES to unlock the SES for access by the trusted execution environment.

Computing devices with secure boot operations

Systems and techniques for intelligent data forwarding in edge networks are described herein. A request may be received from an edge user device for a service via a first endpoint. A time value may be calculated using a timestamp of the request. Motion characteristics may be determined for the edge user device using the time value. A response to the request may be transmitted to a second endpoint based on the motion characteristics.

Intelligent data forwarding in edge networks

Various aspects of methods, systems, and use cases for multi-entity (e.g., multi-tenant) edge computing deployments are disclosed. Among other examples, various configurations and features enable the management of resources (e.g., controlling and orchestrating hardware, acceleration, network, processing resource usage), security (e.g., secure execution and communication, isolation, conflicts), and service management (e.g., orchestration, connectivity, workload coordination), in edge computing deployments, such as by a plurality of edge nodes of an edge computing environment configured for executing workloads from among multiple tenants.

Multi-entity resource, security, and service management in edge computing deployments

Technologies for providing secure utilization of tenant keys include a compute device. The compute device includes circuitry configured to obtain a tenant key. The circuitry is also configured to receive encrypted data associated with a tenant. The encrypted data defines an encrypted image that is executable by the compute device to perform a workload on behalf of the tenant in a virtualized environment. Further, the circuitry is configured to utilize the tenant key to decrypt the encrypted data and execute the workload without exposing the tenant key to a memory that is accessible to another workload associated with another tenant.

Technologies for providing secure utilization of tenant keys

Technologies for accelerated key caching in an edge hierarchy include multiple edge appliance devices organized in tiers. An edge appliance device receives a request for a key, such as a private key. The edge appliance device determines whether the key is included in a local key cache and, if not, requests the key from an edge appliance device included in an inner tier of the edge hierarchy. The edge appliance device may request the key from an edge appliance device included in a peer tier of the edge hierarchy. The edge appliance device may activate per-tenant accelerated logic to identify one or more keys in the key cache for eviction. The edge appliance device may activate per-tenant accelerated logic to identify one or more keys for pre-fetching. Those functions of the edge appliance device may be performed by an accelerator such as an FPGA. Other embodiments are described and claimed.

Technologies for accelerated hierarchical key caching in edge systems

In one embodiment, an apparatus comprises a processor to: receive a request to configure a secure execution environment for a first workload; configure a first set of secure execution enclaves for execution of the first workload, wherein the first set of secure execution enclaves is configured on a first set of processing resources, wherein the first set of processing resources comprises one or more central processing units and one or more accelerators; configure a first set of secure datapaths for communication among the first set of secure execution enclaves during execution of the first workload, wherein the first set of secure datapaths is configured over a first set of interconnect resources; configure the secure execution environment for the first workload, wherein the secure execution environment comprises the first set of secure execution enclaves and the first set of secure datapaths.

Composable trusted execution environments

Methods, apparatus, systems and articles of manufacture are disclosed to schedule workloads based on secure edge to device telemetry by calculating a difference between a first telemetric data received from a first hardware device and an operating parameter and computing an adjustment for a second hardware device based on the difference between the first telemetric data and the operating parameter.

Methods and apparatus to schedule workloads based on secure edge to device telemetry

Systems and techniques for automatic escalation of trust credentials are described herein. Requestor data may be received that describes workloads of a requestor. A set of trust credentials may be determined by using an escalation prediction model to evaluate the requestor data. The multi-access token may be assembled from the set of trust credentials. The multi-access token may be transmitted to an information provider to fulfill a request of a requestor.

Automatic escalation of trust credentials

First data is stored. A request for the first data is received from a communication device over a link established with a communication device. An access control engine comprising circuitry is to control access to the first data to the communication device based on an authentication state of the communication device and a protection state of the link.

Data release control based on authentication and link protection

Growing community of inventors

Beaverton, OR, United States of America

Kapil Sood