Amazon Technologies, Inc.

Ori Cohen

Barak Wasserstrom

Andrew Robert Sinton

Moshe Raz

Erez Tsidon

Asaf Modelevsky

Uri Leder

Benzi Denkberg

Max Chvalevsky

Technologies are disclosed for using hardware-embedded monitors to monitor pages of local memory and detect attribute violations or other unauthorized operations relating to the memory. The attribute violations may include determining that a measurement of an executable page to be loaded into memory does not match any entry in a list of allowed pages for the memory. Responsive to detecting a violation, an alert or other mitigation protocol, which may include an audit of activities surrounding the violation, may be performed.

Secure monitors for memory page protection

A modified measured boot approach is utilized for establishing a secure communication link between two devices. Each device may execute a respective boot process until the device reaches the stage responsible for establishing the communication link with the other device. Each device may exchange its respective self-signed certificate and extend its certificate chain with the self-signed certificate received from the other device. A secure link can be established using the public key of the other device as a based key for a key exchange protocol.

Extending measured boot for secure link establishment

A boot process for a computing device, such as integrated circuit, includes security features that are inaccessible during certain operation modes. An image including permission to access those security features is received during the boot process and may be verified using one or more keys. In operation, access to the security features is permitted during the operation modes after the image is verified. Such an approach enables a boot process to permit access to certain features after receipt and verification of different images.

Combination boot for an integrated circuit

Technologies are disclosed for using hardware-embedded monitors to monitor pages of local memory and detect attribute violations or other unauthorized operations relating to the memory. The attribute violations may include mismatches of attributes (e.g., designating a page as writeable versus executable or vice versa) in entries in a translation buffer that point to a same physical address or other mismatches between designations of attributes for a page in physical and virtual space. Responsive to detecting a violation, an alert or other mitigation protocol, which may include an audit of activities surrounding the violation, may be performed.

An operational mode can be designated for a computing device, such as an integrated circuit. In particular, an input signal may be used to determine an operational mode, which may lead to bypassing or otherwise restricting one or more boot operations to permit use of the computing device. Such an approach provides improved flexibility to permit use of the computing device for testing or debugging while maintaining security features used during other operational modes.

Designating an operational mode for an integrated circuit

A modified measured boot approach is utilized for establishing a secure communication link between two devices. Each device may execute a respective boot process until the device reaches the stage responsible for establishing the communication link with the other device. Each device may exchange its respective self-signed certificate and extend its certificate chain with the self-signed certificate received from the other device. Each device can then generate a new pair of keys based on its extended certificate chain that includes the identity of the other device, and exchange the public key of the new key pair with the other device. A secure link can be established using the public key of the other device as a based key for a key exchange protocol. A central management entity can attest the measurements of the boot stages for each device using the corresponding public key.

Hardware-software interaction testing is performed using formal verification for language-specified hardware designs. A description of valid access using an interface for a configuration space of a language specified hardware design and a description of a valid output of the language-specified hardware design is received. Formal verification is performed on the language-specified hardware design using the interface for the configuration space according to the description of valid access using the interface. A sequence of access to the configuration space using the interface that causes a failure to produce the valid output of the language-specified hardware design according to the description of valid output to identify as an error for the language-specified hardware design.

Growing community of inventors

Atlit, Israel

Ori Cohen