International Business Machines Corporation

Kabushiki Kaisha Toshiba

Nicolas Maeding

Tobias Gemmeke

Jens Leenstra

Angel Nunez Mencias

Markus Kaltenbach

Christian Zoellin

Wilhelm Ernst Haller

Ulrich Krauch

Dirk Herrendoerfer

Peter Morjan

Christopher Michael Abernathy

Jonathan D Bradbury

Dung Q Nguyen

Jason Raymond Baumgartner

Viresh Paruthi

Hari Mony

Reinhard Theodor Buendgen

Seiji Maeda

Harry S Barowski

Brian King Flachs

Brad William Michael

Hans-Werner Tast

William Elton Burky

Kerstin Claudia Schelm

Anbazhagan Mani

Stefan Liesche

Kai Oliver Weber

Jochen Preiss

Eli Arbel

Cynthia Rae Eisner

Hiroo Hayashi

Shigeaki Iwasa

James Robert Magowan

Alexander Itskovich

Brian Walter Stocker

J Adam Butts

Amaury Neve De Mevergnies

A computer-implemented method for providing a system-specific secret to a computing system having a plurality of computing components is disclosed. The method includes storing permanently a component-specific import key as part of a computing component and storing the component-specific import key in a manufacturing-side storage system. Upon a request for the system-specific secret for a computing system, the method includes identifying the computing component comprised in the computing system, retrieving a record relating to the identified computing component, determining the system-specific secret protected by a hardware security module and determining a system-specific auxiliary key. Furthermore, the method includes encrypting the system-specific auxiliary key with the retrieved component-specific import key, thereby creating a auxiliary key bundle, encrypting the system-specific secret and storing the auxiliary key bundle and a system record in a storage medium of the computing system.

Deploying a system-specific secret in a highly resilient computer system

A computer-implemented method for managing a life-cycle of at least in parts interdependent cryptographic keys is disclosed. Each of the cryptographic keys is signed and relates to a different one of artifacts. The method comprises creating a key manifest, wherein the key manifest comprises data about determined dependencies of the cryptographic keys at a point in time when one of the artifacts is built encrypting the key manifest with a manifest key, and upon a life-cycle change happening to one out of the group comprising one of the artifacts and one of the interdependent cryptographic keys in the key manifest of the one of the artifacts, the method comprises decrypting the key manifest and invoking an action to a related one out of the group comprising the one of the artifacts and at least one of the interdependent cryptographic keys in accordance with the key manifest.

Chained manifest for key management and attestation

Aspects of the invention include loading an image of a virtual server onto a boot partition of a trusted execution environment (TEE), wherein a first key is embedded in the image. A second key is received from an end customer of an application. Data is received from an independent software vendor (ISV) of the application, wherein the data includes a third key. The second key and the third key are combined inside the TEE to create a fourth key. An available memory space in an independent memory device is encrypted using the fourth key to create a secure data volume. Encrypted data is stored in the secure data volume.

Storage encryption for a trusted execution environment

The present disclosure relates to a computer implemented method for executing an application. The method comprises: executing a bootloader in a trusted execution environment, wherein the executing comprises: decrypting received encrypted secrets using decryption keys of the boot loader, storing the decrypted secrets in a storage accessible by the application, creating a proof record indicating the application, the secrets and the trusted execution environment, storing the proof record in the storage, and deleting the decryption keys. The application may be executed in the trusted execution environment using the decrypted secrets. The proof record may be provided by the application for proving authenticity.

Trusted workload execution

The present disclosure relates to a method for deploying an application in an execution environment using a first and second sets of key pairs. The method comprises: creating a sequence of tasks comprising build tasks followed by a deploy task. The tasks are configured to receive a task input for performing the tasks. The task input comprises a contribution input and an output of a task preceding at least one of the build tasks. The contribution input comprises secrets. The output of the build tasks is encrypted with a respective encryption key of the first set of key pairs, wherein the contribution input of a task subsequent to the first task is encrypted with a respective encryption key of the second set of keys. The tasks may be executed in the execution environment using unencrypted content of the task inputs.

Building and deploying an application

An integrated circuit chip includes at least two integrated circuits, at least three scan chains, and a multiplexor circuitry. Each integrated circuit includes an integrated circuit input port and an integrated circuit output port. The scan chains and the integrated circuits are coupled by default with a series chain having integrated circuits and scan chains alternating each other. The series chain starts with an initial scan chain and ends with the end scan chain. Each scan chain except the initial one includes a first scan chain input port coupled by default with the integrated circuit output port of the respective adjacent integrated circuit. Each scan chain except the end one includes a first scan chain output port coupled by default with the integrated circuit input port of the respective adjacent integrated circuit.

Integrated circuit chip and a method for testing the same

A method for operand width reduction is described, wherein two N-bit input operands (A, B) of a bit width of N are processed and two M-bit output operands (A', B&#x2032;) of a reduced bit width of M are generated in a way, that a post-processing comprising an M-bit adder function followed by saturation to M bits performed on said two M-bit output operands (A&#x2032;, B&#x2032;) provides an M-bit result equal to an M-bit result of an N-bit modulo adder function of the two N-bit input operands (A, B), followed by a saturation to M bits. Further an electronic computing circuit () is described performing said method. Additionally a computer system comprising such an electronic computing circuit is described.

Electronic computing circuit for operand width reduction for a modulo adder followed by saturation concurrent message processing

Instead of having a processor with an instruction set architecture (ISA) that includes fixed architected operands, an improved processor supports additional characteristic bits for computing instructions (e.g., a multiply-add, load/store instructions). Such additional bits for the certain instructions influence the processing of these instructions by the processor. Also, a new instruction is introduced for further usage of the proposed method. Typically these additional characteristic bits as well as the instruction can be automatically generated by compilers to provide relatively well-suited instruction sequences for the processor.

Instruction set architecture with instruction characteristic bit indicating a result is not of architectural importance

A bi-endian multiprocessor system having multiple processing elements, each of which includes a processor core, a local memory and a memory flow controller. The memory flow controller transfers data between the local memory and data sources external to the processing element. If the processing element and the data source implement data representations having the same endian-ness, each multi-word line of data is stored in the local memory in the same word order as in the data source. If the processing element and the data source implement data representations having different endian-ness, the words of each multi-word line of data are transposed when data is transferred between local memory and the data source. The processing element may incorporate circuitry to add doublewords, wherein the circuitry can alternately carry bits from a first word to a second word or vice versa, depending upon whether the words in lines of data are transposed.

Systems and methods for transferring data to maintain preferred slot positions in a bi-endian processor

A method for reducing the power consumption of a register file of a microprocessor supporting simultaneous multithreading (SMT) is disclosed. Mapping logic and associated table entries monitor a total number of processing threads currently executing in the processor and signal control logic to disable specific register file entries not required for currently executing or pending instruction threads or register file entries not meeting a minimum access threshold using a least recently used algorithm (LRU). The register file utilization is controlled such that a register file address range selected for deactivation is not assigned for pending or future instruction threads. One or more power saving techniques are then applied to disabled register files to reduce overall power dissipation in the system.

Method to reduce power consumption of a register file with multi SMT support

An electronic computing circuit for implementing a method for reducing the bit width of two operands from a bit length N to a reduced bit length M, thus, M&#x3c;N. To enable a wider re-usage of existing designs or building blocks being all specialized to the usual bit length of a power of 2 (8, 16, 32, 64 etc.), the chip structure of which is already highly optimized in regard of speed and space savings, a circuit is implemented as an addend width reduction circuit to perform the steps of: receiving said two N-bit operands as an input, adding the (N&#x2212;M+1) most significant bits of said two N-bit operands separately in an auxiliary adder logic, calculating at least the two most significant bits of reduced-bit-length output operands in a decision logic processing the add result of said auxiliary adder logic, such that a predetermined post-processing can be correctly performed with said output operands.

Method of operand width reduction to enable usage of narrower saturation adder

The automatic verification of designs of digital circuits for their equivalence, wherein logic designs implemented in different hardware description languages (HDLs) and different design methodologies are compared. The designs (Code A, Code B) are modified by adding special wrappers (Wrapper A, Wrapper B), and used to equalize the timing of pairs of selected input signals and selected output signals of the logic designs. The wrappers drive certain signals of the designs that are not relevant for actual comparison, such signals including clock signals, clock control signals, scan-path signals, scan-path control signals, and reset signals. In a preferred embodiment, HDL descriptions of logic designs are analyzed. Based on this analysis, the wrappers are implemented as changes to the HDL descriptions. In another embodiment, RTL and/or gate-level netlists are analyzed and modified.

Method and system for verifying the equivalence of digital circuits

The present invention provides a fully automatic method for obtaining a circuit having minimized power consumption due to clock-gating. A circuit design to be optimized is modified to a reduced power modified design and associated with a clock gating scheme. Verification tools compare the modified design with the original design to a predetermined trigger-events to determine if the modified design can be used. Further modifications may be made iteratively until an optimal design is achieved.

Formally deriving a minimal clock-gating scheme

Growing community of inventors

Holzgerlingen, Germany

Nicolas Maeding