Intel Corporation

Michael Berger

Mukesh Kataria

Joshua Resch

Jasmeet Chhabra

Ranjit S Narjala

Eli Elik Kupermann

Amol Kulkarni

Mazen G Gedeon

Hormuzd M Khosravi

Mahesh S Natu

Michael N Derr

Purushottam Goel

Bharat S Pillilli

Izoslav Tchigevsky

Yasser Rasheed

Zhenyu Zhu

David Birnbaum

Venkat R Gokulrangan

Nivedita Aggarwal

Xiaoyu Ruan

Jeffrey Tripp

Khee Wooi Lee

Hung Huynh

Steven W Deutsch

Mark Segal

Dan Horovitz

Gary Joe Calhoun

Jeffrey John Vick

An apparatus comprising a computer platform, including a central processing unit (CPU) comprising a first security engine to perform security operations at the CPU and a chipset comprising a second security engine to perform security operations at the chipset, wherein the first security engine and the second security engine establish a secure channel session between the CPU and the chipset to secure data transmitted between the CPU and the chipset.

Platform security mechanism

An apparatus to facilitate descriptor resiliency in a computer system platform is disclosed. The apparatus comprises a non-volatile memory to store firmware for a computer system platform, wherein the firmware comprises a primary descriptor including access permission details for platform components and a secondary descriptor including a backup copy of the access permission details and a controller, coupled to the first non-volatile memory, including recovery hardware to detect a problem during a platform reset with the primary descriptor, recover the contents of the primary descriptor from the backup copy included in the secondary descriptor and store the contents of the backup copy to primary descriptor.

Firmware descriptor resiliency mechanism

Various systems and methods for implementing fuse-based integrity protection are described herein. A system for validating a read-only memory (ROM), the system comprising a ROM reader logic, implemented at least partly in hardware, to: access a read-only memory (ROM) having a plurality of permanently programmable electric couplings (PPECs), the PPECs having been programmed; survey a number of permanently altered PPECs in the set of PPECs to produce a counter value; read a binary representation of the counter value from PPEC values stored as a PPEC signature; and read a binary representation of the binary complement of the counter value from PPEC values in the PPEC signature; and a ROM validation logic, implemented at least partly, in hardware, to verify the integrity of the ROM using a combination of at least two of: the counter value, the binary representation of the counter value, and the binary representation of the binary complement of the counter value.

Fuse-based integrity protection

A system to provide an always-on embedded anti-theft protection for a platform is described. The system comprises in one embodiment, a storage including encryption to protect data, a risk behavior logic to detect a potential problem when the data is not encrypted, a core logic component to provide logic to analyze the potential problem and to trigger a security action logic to perform the security action, when the potential problem indicates a theft suspicion, and the security action logic, to cause the platform to attempt a transition to a reduced power state when triggered by the core logic component, the transition causing the data to be encrypted.

Always-available embedded theft reaction subsystem

A method and apparatus is disclosed herein for performing write-only inter processor reset synchronization. In one embodiment, the processing unit comprises: a communication unit to transmit information to the second processing unit; memory to store reset synchronization information and message information; and processing logic to perform write-only reset synchronization between itself and the second processing unit based on bit indications set in the memory.

Method and apparatus for write-only inter-processor reset synchronization

A platform including a security system is described. The security system comprises, in one embodiment, a multi-state system having a plurality of modes, available whenever the platform has a source of power. The modes comprise an unarmed mode, in which the security system is not protecting the platform, an armed mode, in which the platform is protected, the armed mode reached from the unarmed mode, after an arming command, and a suspecting mode, in which the platform is suspecting theft, the suspecting mode reached from the armed mode, when a risk behavior is detected.

Various systems and methods for implementing fuse-based integrity protection are described herein. A system for validating a read-only memory (ROM), the system comprising a ROM reader logic, implemented at least partly in hardware, to: access a read-only memory (ROM) having a plurality of permanently programmable electric couplings (PPECs), the PPECs having been programmed; survey a number of permanently altered PPECs in the set of PPECs to produce a counter value; read a binary representation of the counter value from PPEC values stored as a PPEC signature; and read a binary representation of the binary complement of the counter value from PPEC values in the PPEC signature; and a ROM validation logic, implemented at least partly in hardware, to verify the integrity of the ROM using a combination of at least two of: the counter value, the binary representation of the counter value, and the binary representation of the binary complement of the counter value.

A system comprising a platform protected by an always-on always-available security system is described. In one embodiment, the system includes a risk behavior logic to detect a potential problem, a core logic component to provide logic to analyze the potential problem and to move the platform to a suspecting mode when the potential problem indicates a theft suspicion, and the security action logic, to send periodic alerts to a security server when the platform is in the suspecting mode, the alert including movement related data, such that the security server can take an action to protect the platform.

A system to provide an always-on embedded anti-theft protection for a platform is described. The system in one embodiment comprises an arming logic to move the platform to an armed mode when receiving an arming command, a disarming logic to move the platform to an unarmed mode when receiving a disarming command, the disarming logic active while the platform is in a low power state, and a power transition logic to move the system from the low power state to an ON state in response to a user request, the power transition logic to present a log-in screen when the platform is armed, and to move the platform to the ON state without a log-in screen when the platform is unarmed.

A platform including an always-available theft protection system is described. In one embodiment, the system comprises an arming logic to arm the platform, when an arming command is received, a risk behavior logic to detect a potential problem when the platform is armed, and a core logic component to provide logic to analyze the potential problem, and to move the platform to a suspecting mode, when the potential problem indicates a theft suspicion. The system, in one embodiment, further comprises configuration logic to configure settings for the system when the platform is in an unarmed mode, the configuration logic including a user logic enabling an authorized user to alter settings and an administrator logic enabling an administrator to alter the settings using an authenticated set request.

A system to provide an always-on always-available security system for a platform is described. The system comprises a multi-mode system having a plurality of modes, available whenever the platform has a source of power, the modes comprising an unarmed mode, in which the security system is not protecting the platform, an armed mode, in which the platform is protected, the armed mode reached from the unarmed mode, after an arming command, and a suspecting mode, in which the platform is suspecting theft, the suspecting mode reached from the armed mode, when a risk behavior is detected. The system further enabling the unarmed mode to be reached from the armed mode when a user disarms the platform, and the unarmed mode reached from the armed mode through the suspecting mode when an override command is received.

A platform protected by an always-available security system, the system is described. The system, in one embodiment, comprises a near field communications (NFC) reader, a pairing logic to identify an NFC device as an authorized device for arming and disarming the system, an arming logic to arm the system upon receipt of an arming command, and a disarming logic to disarm the system upon receipt of a disarming command, wherein the arming command and the disarming command may use the NFC device, and wherein the NFC reader is powered in a plurality of power states, enabling disarming and arming of the platform in the plurality of power states.

A system comprising a platform protected by an always-on always-available security system is described. The system, in one embodiment, includes a core logic component to provide logic to move the platform to an armed mode upon receipt of an arming command, a battery access controller to prevent access to a battery of the platform, when the platform is in the armed mode, a disarming logic to receive a disarming command from a user, the disarming command causing the battery access controller to provide the access to the battery, such that when the platform is disarmed the battery can be accessed, whereby the system prevents removal of the battery when the platform is in the armed mode to ensure that the platform remains powered to perform a security action when needed.

A platform protected by a system, the platform including a power source, is described. The system in one embodiment comprises a risk behavior logic to detect a potential problem, a core logic component to provide logic to analyze the potential problem and to trigger a security action logic to perform a security action, when the potential problem indicates a theft suspicion, and the security action logic to utilize a kill pill to disable the platform, when the platform has set a high security status authorizing use of a self-kill pill or the platform sends an alert and receives a remote instruction to utilize a remote kill pill.

A platform including an always-available theft protection system is described. In one embodiment, the system comprises a power management logic to selectively power elements of the system, a disarming logic to disarm the platform from an armed mode when a disarming command is received via an interface, the interface powered when the platform is in the armed and suspecting modes to detect the disarming command. The system further comprises, in one embodiment, a risk behavior logic to detect a potential problem via a interface, the interface powered when the platform is in the armed mode to detect the potential problem, and a core logic component to provide logic to analyze the potential problem, and to move the platform to a suspecting mode, when the potential problem indicates a theft suspicion, the core logic powered when the risk behavior logic detects the potential problem.

Growing community of inventors

Jerusalem, Israel

Michael Berger