Intel Corporation

Mcafee, Inc.

Neeraj S Upasani

Sergiu D Ghetie

Mohan J Kumar

Jeanne Guillory

Wojciech S Powiertowski

Sagar V Dalvi

Murugasamy K Nachimuthu

David P Turley

Sarathy Jayakumar

Shahrokh Shahidzadeh

Chukwunenye S Nnebe

Ron Gabor

Ashok Raj

Theodros Yigzaw

Adrian R Pearson

Alberto J Munoz

Faraz A Siddiqi

Hisham Shafi

Jason Sandri

Gamil A Cain

Thomas R Bowen

Jason R Cox

Allen R Wishman

Mark D Chubb

Zhangping Chen

Won Lee

Sanu K Mathew

Sudhir K Satpathy

Vikram B Suresh

Scott P Bobholz

Daniel G Borkowski

Samie B Samaan

Arkadiusz Berent

David T Mayo

Vasuki Chilukuri

Vinila Rose

Ronald N Story

Vijaya K Boddu

Kenneth Young

Srihari Narayanan

Francisco Orlando C Arbildo

Shaila R Murty

Embodiments are generally directed apparatuses, methods, techniques and so forth to receive a sled manifest comprising identifiers for physical resources of a sled, receive results of an authentication and validation operations performed to authenticate and validate the physical resources of the sled, determine whether the results of the authentication and validation operations indicate the physical resources are authenticate or not authenticate. Further and in response to the determination that the results indicate the physical resources are authenticated, permit the physical resources to process a workload, and in response to the determination that the results indicate the physical resources are not authenticated, prevent the physical resources from processing the workload.

Techniques to verify and authenticate resources in a data center computer environment

Embodiments may be generally directed to techniques to encrypt and decrypt data in a first fuse block array using an encryption key of a second fuse block array, the second fuse block array having the encryption key comprising a plurality of segments of bits, an inverse encryption key comprising a second plurality of segments of bits, each segment of the inverse encryption key to correspond with a particular segment of the encryption key, and a random pattern having equally distributed bit values, the random pattern to enable detection of voltage attacks on the second fuse block array.

Techniques to protect fuses against non-destructive attacks

A processor can be configured to access boot firmware from a remote location independent from use of a chipset. After a processor powers-on or reboots, the processor can execute microcode. The microcode will cause the processor to train a link with a remote device. The remote device can provide the processor with access to boot firmware. The processor can copy the boot firmware to the processor's cache or memory. The processor will attempt to authenticate the boot firmware. If the boot firmware is authenticated, the processor executes the copy of the boot firmware.

Techniques for processor boot-up

Embodiments detailed herein include, but are not limited to, a hardware processor to execute instructions and security circuitry to perform pre-boot operations including signature verification of a portion of firmware in a firmware storage hardware and initiating recovery upon a signature verification failure. The hardware processor comprises a plurality of cores in some embodiments. The hardware processor a multicore processor in some embodiments.

Systems, apparatuses, and methods for platform security

Techniques and apparatuses for issuance of license upgrades for hardware components in the field, as well as the hardware components, are described. In one embodiment, for example an apparatus may include processor circuitry and memory in communication with the processor circuitry, wherein the memory contains a configuration data block and license data block, the configuration data block being read from the memory via a licensing apparatus and the licensing data block being written to the memory by the licensing apparatus. The processor may include executable code to process the licensing data block to facilitate an upgrade of the capabilities of the processor circuitry.

System and method for reconfiguring and deploying soft stock-keeping units

There is disclosed in one example a processor, including: a protected runtime mode (PRM) module to receive a PRM interrupt and to: suspend operation of a software task executing on the processor; save processor state information; place the microprocessor into PRM; access a PRM handler in a designated PRM memory region, wherein the PRM handler comprises a platform specific task; restore the processor state; and resume operation of the software task.

Protected runtime mode

A processor of an aspect includes a decode unit to decode a read from memory instruction. The read from memory instruction is to indicate a source memory operand and a destination storage location. The processor also includes an execution unit coupled with the decode unit. The execution unit, in response to the read from memory instruction, is to read data from the source memory operand, store an indication of defective data in an architecturally visible storage location, when the data is defective, and complete execution of the read from memory instruction without causing an exceptional condition, when the data is defective. Other processors, methods, systems, and instructions are disclosed.

Read from memory instructions, processors, methods, and systems, that do not take exception on defective data

Dynamically configurable server platforms and associated apparatus and methods. A server platform including a plurality of CPUs installed in respective sockets may be dynamically configured as multiple single-socket servers and as a multi-socket server. The CPUs are connected to a platform manager component comprising an SoC including one or more processors and an embedded FPGA. Following a platform reset, an FPGA image is loaded, dynamically configuring functional blocks and interfaces on the platform manager. The platform manager also includes pre-defined functional blocks and interfaces. During platform initialization the dynamically-configured functional blocks and interfaces are used to initialize the server platform, while both the pre-defined and dynamically-configured functional blocks and interfaces are used to support run-time operations. The server platform may be used in conventional rack architectures or implemented in a disaggregated rack architecture under which the single-socket and/or multi-socket servers are dynamically composed to employ disaggregated resources, such as memory, storage, and accelerators.

Self-morphing server platforms

A system for securing electronic devices includes a storage device including a storage device controller processor, at least one non-transitory machine readable storage medium in firmware of the storage device communicatively coupled to the storage device controller processor, and a monitor application comprising computer-executable instructions on the medium. The instructions are readable by the storage device controller processor. The monitor application is configured to provision one or more read-only areas of the storage device, provision a candidate copy area of the storage device, reduce a maximum capacity available for user data on the storage device by a size of the read-only areas and the candidate copy area, and secure access to the read-only areas of the storage device.

Remote provisioning and authenticated writes to secure storage devices

Encryption of a BIOS using a programmable logic device (PLD) is described. A PLD may include a static random-access memory area including programmable logic in a Lookup Table to receive a request to authenticate a basic input/output system (BIOS) executing on a processor coupled to the PLD. The PLD may calculate a hash value of a message associated with the BIOS using a Secure Hash Algorithm (SHA). The PLD may also include a random-access memory area including a first embedded random access memory block (EBR) to store a first portion of a 256-bit message digest associated with the message, a fifth portion of the 256-bit message digest, and second, third, fourth, sixth, seventh, and eighth EBRs to store second, third, fourth, sixth, seventh, and eighth portions of the 256-bit message digest, respectively.

Hardware accelerator for platform firmware integrity check

Growing community of inventors

Portland, OR, United States of America

Neeraj S Upasani