Intel Corporation

Other

Intel Corproation

Michael E Kounavis

David M Durham

Shay Gueron

Vinodh Gopal

Sergej Deutsch

Wajdi K Feghali

Martin Guy Dixon

Srinivas Chennupaty

Raghunandan Makaram

Karanvir S Grewal

Steven R King

Frank L Berry

Santosh Ghosh

Siddhartha Chhabra

Michael Lemay

Alok Kumar

Raj S Yavatkar

Amitabh Das

Ram K Krishnamurthy

Sanu K Mathew

Ravi L Sahita

Arun Raghunath

Michael D LeMay

Saeedeh Komijani

Wenjie Xiong

Gilbert A Neiger

Glen J Anderson

Vedvyas Shanbhogue

Jason W Brandt

Barry E Huntley

Baiju V Patel

Ravishankar Iyer

Alex Nayshtut

Oleg Pogorelik

Jr-Shian Tsai

Omesh Tickoo

Vadim Sukhomlinov

Salmin Sultana

Joseph Frank Cihula

Mingwei Zhang

Josh Triplett

Krishna Bhuyan

Harrick M Vin

Andrew James Weiler

Ye Zhuang

James C Farwell

Antonios Papadimitriou

Ned M Smith

Gilbert M Wolrich

David I Poisner

Edward Thomas Grochowski

Ohad Falik

Sreenivas Subramoney

Prashant R Chandra

Ioannis T Schoinas

Omer Ben-Shalom

Sridhar Lakshmanamurthy

Ashok Raj

Xin Zeng

David A Koufaty

Stanislav Shwartsman

Dan Baum

Micah James Sheller

Gokcen Cilingir

Zoran Zivkovic

Rameshkumar G Illikkal

Abhishek Basak

Jayesh Gaur

Alpa T Narendra Trivedi

Rupin H Vakharwala

Michael E Deisher

Anant V Nori

Mark R Francis

Farhana Sheikh

Rajendra S Yavatkar

Li Chen

Anna Trikalinou

Weigang Li

Chen-Chi Kuo

Cory Cornelius

Junyuan Wang

Sadagopan Srinivasan

Makaram Raghunandan

Ron Shalev

Aaron DeBattista

Kaijie Guo

Anindya Sankar Paul

Yao Huo

Raizy Kellermann

Zijuan Fan

Brian Will

Serge J Deutsch

Carlos Abad Vazquez

Brandon Edwards

Qianjun Xie

Yuan Wang

Aaron Debattista

Nikhil Pantpratinidhi

An embodiment of an integrated circuit may comprise memory to store respective resource control descriptors in correspondence with respective identifiers, and an input/output (IO) memory management unit (IOMMU) communicatively coupled to the memory, the IOMMU including circuitry to determine resource control information for an IO transaction based on a resource control descriptor stored in the memory that corresponds to an identifier associated with the IO transaction, and control utilization of one or more resources of the IOMMU based on the determined resource control information. Other embodiments are disclosed and claimed.

PASID granularity resource control for IOMMU

Systems and methods for memory isolation are provided. The methods include receiving a request to write a data line to a physical memory address, where the physical memory address includes a key identifier, selecting an encryption key from a key table based on the key identifier of the physical memory address, determining whether the data line is compressible, compressing the data line to generate a compressed line in response to determining that the data line is compressible, where the compressed line includes compression metadata and compressed data, adding encryption metadata to the compressed line, where the encryption metadata is indicative of the encryption key, encrypting a part of the compressed line with the encryption key to generate an encrypted line in response to adding the encryption metadata, and writing the encrypted line to a memory device at the physical memory address. Other embodiments are described and claimed.

Technologies for memory replay prevention using compressive encryption

A processor, a system, a machine readable medium, and a method. The processor comprises first circuitry to: encrypt a first code image using a first code key; load the encrypted first code image into a memory area allocated in memory for the first code image by an operating system miming on the processor; and send to the operating system a substitute key that corresponds to the first code key, wherein the first code key is concealed from the operating system; and an instruction cache including control circuitry; and second circuitry coupled to the instruction cache, the second circuitry to: receive the substitute key from the operating system; in response to a first request from the operating system to execute the first code image to instantiate a first process, perform a first cryptographic function using a hardware key to generate the first code key from the substitute key; and program the control circuitry of the instruction cache with the first code key to enable the first code image to be decrypted using the first code key.

Cryptographic computing in multitenant environments

Techniques and mechanisms for metadata, which corresponds to cached data, to be selectively stored to a sequestered memory region. In an embodiment, integrated circuitry evaluates whether a line of a cache can accommodate a first representation of both the data and some corresponding metadata. Where the cache line can accommodate the first representation, said first representation is generated and stored to the line. Otherwise, a second representation of the data is generated and stored to a cache line, and the metadata is stored to a sequestered memory region that is external to the cache. The cache line include an indication as to whether the metadata is represented in the cache line, or is stored in the sequestered memory region. In another embodiment, a metric of utilization of the sequestered memory region is provided to software which determines whether a capacity of the sequestered memory region is to be modified.

Sequestered memory for selective storage of metadata corresponding to cached data

Technologies disclosed herein provide cryptographic computing. An example method comprises executing a first instruction of a first software entity to receive a first input operand indicating a first key associated with a first memory compartment of a plurality of memory compartments stored in a first memory unit, and execute a cryptographic algorithm in a core of a processor to compute first encrypted contents based at least in part on the first key. Subsequent to computing the first encrypted contents in the core, the first encrypted contents are stored at a memory location in the first memory compartment of the first memory unit. More specific embodiments include, prior to storing the first encrypted contents at the memory location in the first memory compartment and subsequent to computing the first encrypted contents in the core, moving the first encrypted contents into a level one (L1) cache outside a boundary of the core.

Cryptographic isolation of memory compartments in a computing environment

In one embodiment, the present invention includes a method for receiving incoming data in a processor and performing a checksum operation on the incoming data in the processor pursuant to a user-level instruction for the checksum operation. For example, a cyclic redundancy checksum may be computed in the processor itself responsive to the user-level instruction. Other embodiments are described and claimed.

Performing a cyclic redundancy checksum operation responsive to a user-level instruction

In one example, an apparatus for Advanced Encryption Standard (AES) substitutions box (S-box) encryption includes an S-Box logic function and a MixColumns multiplication operation. The S-box logic function takes as input a state and is an 8-bit to 8-bit logic function, and wherein the S-box logic function is minimized such that an S-box round comprises nine not-and (NAND) levels and duplications of a logical product of the minimized S-box logic function are eliminated. The MixColumns multiplication operation comprises a plurality of factors that are exclusive ORed (XOR) with an output of the S-box round to obtain a scaled 16-byte output.

Ultra-low latency advanced encryption standard

Technologies disclosed herein provide one example of a processor that includes a register to store a first encoded pointer for a first memory allocation for an application and circuitry coupled to memory. Size metadata is stored in first bits of the first encoded pointer and first memory address data associated with the first memory allocation is stored in second bits of the first encoded pointer. The circuitry is configured to determine a first memory address of a first marker region in the first memory allocation, obtain current data from the first marker region at the first memory address, compare the current data to a reference marker stored separately from the first memory allocation, and determine that the first memory allocation is in a first state in response to a determination that the current data corresponds to the reference marker.

Mitigating security vulnerabilities with memory allocation markers in cryptographic computing systems

In one embodiment, an encoded pointer is constructed from a stack pointer that includes offset. The encoded pointer includes the offset value and ciphertext that is based on encrypting a portion of a decorated pointer that includes a maximum offset value. Stack data is encrypted based on the encoded pointer, and the encoded pointer is stored in a stack pointer register of a processor. To access memory, a decoded pointer is constructed based on decrypting the ciphertext of the encoded pointer and the offset value. Encrypted stack data is accessed based on the decoded pointer, and the encrypted stack is decrypted based on the encoded pointer.

Encoded stack pointers

Embodiments are directed to collision-free hashing for accessing cryptographic computing metadata and for cache expansion. An embodiment of an apparatus includes one or more processors to: receive a physical address; compute a set of hash functions using a set of different indexes corresponding to the set of hash functions, wherein the set of hash functions combine additions, bit-level reordering, bit-linear mixing, and wide substitutions, wherein the plurality of hash functions differ in the bit-linear mixing; access a plurality of cache units utilizing the set of hash functions; read different sets of the plurality of cache units in parallel, where a set of the different sets is obtained from each cache unit of the plurality of cache units; and responsive to the physical address being located one of the different sets, return cache line data of the set corresponding to the set of the cache unit having the physical address.

Collision-free hashing for accessing cryptographic computing metadata and for cache expansion

Embodiments are directed to aggregate GHASH-based message authentication code (MAC) over multiple cachelines with incremental updates. An embodiment of a system includes a controller comprising circuitry, the controller to generate an error correction code for a memory line, the memory line comprising a plurality of first data blocks, generate a metadata block corresponding to the memory line, the metadata block comprising the error correction code for the memory line and at least one metadata bit, generate an aggregate GHASH corresponding to a region of memory comprising a cacheline set comprising at least the memory line, encode the first data blocks and the metadata block, encrypt the aggregate GHASH as an aggregate message authentication code (AMAC), provide the encoded first data blocks and the encoded metadata block for storage on a memory module comprising the memory line, and provide the AMAC for storage on a device separate from the memory module.

Aggregate GHASH-based message authentication code (MAC) over multiple cachelines with incremental updates

In one example an apparatus comprises a memory and a processor to create, from a first deep neural network (DNN) model, a first plurality of DNN models, generate a first set of adversarial examples that are misclassified by the first plurality of deep neural network (DNN) models, determine a first set of activation path differentials between the first plurality of adversarial examples, generate, from the first set of activation path differentials, at least one composite adversarial example which incorporates at least one intersecting critical path that is shared between at least two adversarial examples in the first set of adversarial examples, and use the at least one composite adversarial example to generate a set of inputs for a subsequent training iteration of the DNN model. Other examples may be described.

Adversarial training of neural networks using information about activation path differentials

In one embodiment, a processor includes a memory hierarchy and a core coupled to the memory hierarchy. The memory hierarchy stores encrypted data, and the core includes circuitry to access the encrypted data stored in the memory hierarchy, decrypt the encrypted data to yield decrypted data, perform an entropy test on the decrypted data, and update a processor state based on a result of the entropy test. The entropy test may include determining a number of data entities in the decrypted data whose values are equal to one another, determining a number of adjacent data entities in the decrypted data whose values are equal to one another, determining a number of data entities in the decrypted data whose values are equal to at least one special value from a set of special values, or determining a sum of n highest data entity value frequencies.

Implicit integrity for cryptographic computing

A processor comprises a first register to store an encoded pointer to a memory location. First context information is stored in first bits of the encoded pointer and a slice of a linear address of the memory location is stored in second bits of the encoded pointer. The processor also includes circuitry to execute a memory access instruction to obtain a physical address of the memory location, access encrypted data at the memory location, derive a first tweak based at least in part on the encoded pointer, and generate a keystream based on the first tweak and a key. The circuitry is to further execute the memory access instruction to store state information associated with memory access instruction in a first buffer, and to decrypt the encrypted data based on the keystream. The keystream is to be generated at least partly in parallel with accessing the encrypted data.

Cryptographic computing engine for memory load and store units of a microarchitecture pipeline

Growing community of inventors

Portland, OR, United States of America

Michael E Kounavis