Intel Corporation

Mcafee, Inc.

Microsoft Technology Licensing, LLC

Maxlinear, Inc.

Prashant Dewan

Siddhartha Chhabra

David M Durham

Uday R Savagaonkar

Baiju V Patel

Uttam K Sengupta

Xiaozhu Kang

Men Long

Hong C Li

Karanvir S Grewal

Michael A Goldsmith

Balaji Vembu

Ravi L Sahita

Carlos V Rozas

Francis X Mckeen

John B Vicente

John Douglas Teddy

Howard C Herbert

Alpa T Narendra Trivedi

Vincent R Scarlata

Jason Martin

Karunakara Kotary

Gilbert A Neiger

Rajesh Poornachandran

Vedvyas Shanbhogue

John I Garney

Abhishek Basak

Ned M Smith

Vincent J Zimmer

Reshma Lal

Hormuzd M Khosravi

Kapil Sood

Jesse R Walker

Paritosh Saxena

Nicholas D Triantafillou

Michael S Hughes

Jason M Surprise

Aditya Katragada

Debra Cablao

Adrian M M T Dunbar

Nivedita Aggarwal

Ernie F Brickell

Simon P Johnson

Gary L Graunke

Dion Rodgers

Stephen R Van Doren

Stalinselvaraj Jeyasingh

Joseph Frank Cihula

Kumar Narasimhan Dwarakanath

Stephen J Tolopka

Bernard Lint

Asher M Altman

Divya Naidu Kolar Sunder

Don Alan Van Dyke

Mohamed Haniffa

Jiang Tao Li

Scott R Janus

Ittai Anati

Shlomo Raikin

Gideon Gerzon

Ulhas S Warrier

Gur Hildesheim

Sudeep Divakaran

Divyashree-Shivakumar Sreepathihalli

Paul S Schmitz

Vinupama Godavarthi

Kenji Chen

Geoffrey S Strongin

Alex Nayshtut

Pradeep M Pappachan

Ioannis T Schoinas

Omer Ben-Shalom

William A Stevens, Jr

Chao B Zhang

Xiaoning Li

Alpa Narendra Trivedi

Manohar Ruben Castelino

Purushottam Goel

Tolga Acar

Ranjit S Narjala

Subrata Banik

Ranjit Sivaram Narjala

Pannerkumar Rajagopal

Reouven Elbaz

Chao Zhang

Junhai Qiu

Ke Sun

Elad Eyal

Andres Felipe Borja Jaramillo

Krishnakumar Narasimhan

Gaurav Kumar

Steven D Williams

Andrzej Mialkowski

Jeremy Corley

Dan Dahle

Divya Naidu Kolar Sundar

Ofir Shwartz

Avishay Snir

Arun Hodigere

Mark Andrew Cawston

Methods and apparatus relating to a Converged Cryptographic Engine (CCE) for storage encryption are described. In an embodiment, decode circuitry decodes an instruction to determine whether Converged Cryptographic Engine (CCE) circuitry is enabled. Execution circuitry executes the instruction to program a plurality of keys in response to the CCE circuitry being enabled. The CCE circuitry performs all encryption and all decryption of data to be transferred between a memory and a storage device based at least in part on at least one of the plurality of keys. Other embodiments are also disclosed and claimed.

Storage encryption using converged cryptographic engine

Apparatus and method for secure instruction set execution, emulation, monitoring, and prevention. A processor embodiment includes registers, evaluator, and execution unit. The registers are to store rules which specify actions to be taken with respect to one or more instructions. The evaluator is to detect a request to execute a first instruction and to evaluate the first instruction based on the rules stored in the one or more registers. The evaluator is further to block execution of the first instruction when a first rule corresponding to the first instruction specifies that execution of the first instruction is prohibited, and to allow execution of the first instruction when there is no rule in the one or more registers specifying that the execution of the first instruction is prohibited. The execution unit is to execute the first instruction when the evaluator allows execution of the first instruction.

Apparatus and method for secure instruction set execution, emulation, monitoring, and prevention

Techniques for memory assisted inline encryption/decryption are described. An example includes an encryption data structure engine to provide a key, data, and a tweak to the encryption/decryption engine, wherein the encryption data structure engine is to: read an index value from an encryption data structure lookup data structure entry using an address, the entry to include the index value and a guest page physical address (GPPA), retrieve, based on the index value, an entry from the encryption data structure, the entry to include a logical block address (LBA) base, a key identifier, and at least one GPPA in a sequence of GPPAs, generate a LBA using a position of the GPPA from the encryption data structure lookup data structure entry in the sequence of GPPAs, and retrieve a key based on the key identifier, wherein the encryption engine to encrypt data using the retrieved key, and the generated LBA.

Memory assisted incline encryption/decryption

Systems and methods are provided for implementing a cluster-wide root secret ('CWRS') key for distributed node clusters. In a multi-node cluster, a leader node has a leader node security system that generates the CWRS key, which is a common secret key for all workloads (e.g., containers or VMs) in the multi-node cluster. The leader node security system encrypts the generated CWRS key using a public key and/or a bootstrap key received from a non-leader node that requests the CWRS key. In examples, the leader node security system signs the encrypted CWRS key using its private key for subsequent verification, by the requesting non-leader node, that the CWRS key was generated by the leader node security system. The CWRS thus encrypted can be securely sent to the requesting non-leader node for subsequent encryption or decryption of secret data by the security system of the non-leader node.

Cluster-wide root secret key for distributed node clusters

Methods, apparatuses and system provide for technology that interleaves a plurality of verification commands with a plurality of copy commands in a command buffer, wherein each copy command includes a message authentication code (MAC) derived from a master session key, wherein one or more of the plurality of verification commands corresponds to a copy command in the plurality of copy commands, and wherein a verification command at an end of the command buffer corresponds to contents of the command buffer. The technology may also add a MAC generation command to the command buffer, wherein the MAC generation command references an address of a compute result.

Graphics security with synergistic encryption, content-based and resource management technology

Systems and methods may provide for receiving web content and determining a trust level associated with the web content. Additionally, the web content may be mapped to an execution environment based at least in part on the trust level. In one example, the web content is stored to a trust level specific data container.

Differentiated containerization and execution of web content based on trust level and other attributes

An apparatus to facilitate permissions at a computing system platform is disclosed. The apparatus includes a plurality of agents, each including a non-volatile memory storing firmware executed to perform a function associated with the agent and attestation hardware to detect an update at the computing system platform, generate a cryptographic key associated with each of the plurality of agents, perform an attestation with a relying party using the generated cryptographic keys and receive a tuple associated with each of the plurality of agents, wherein a tuple includes one or more permissions indicating platform resources an agent is permitted to access.

Mechanism to update attested firmware on a platform

Validating proof of possession (POP) of a private key by a device. A computer system generates a provisioning package for a device catalog. The provisioning package including a POP challenge. After generating the provisioning package, the computer system receives a device activation request for a device. The device activation request includes a public key, a device identifier, and a signature. The computer system validates POP of a private key corresponding to the public key, including using the public key, the device identifier, and the POP challenge to cryptographically verify the signature. The computer system establishes a trust relationship with the device, including registering the public key and the device identifier into the device catalog.

Proof of possession of private keys for remote devices

Systems, methods, and apparatuses for providing chiplet binding to a disaggregated architecture for a system on a chip are described. In one embodiment, system includes a plurality of physically separate dies, an interconnect to electrically couple the plurality of physically separate dies together, a first die-to-die communication circuit, of a first die of the plurality of physically separate dies, comprising a transmitter circuit and an encryption circuit having a link key to encrypt data to be sent from the transmitter circuit into encrypted data, and a second die-to-die communication circuit, of a second die of the plurality of physically separate dies, comprising a receiver circuit and a decryption circuit having the link key to decrypt the encrypted data sent from the transmitter circuit to the receiver circuit.

Methods and apparatuses to provide chiplet binding to a system on a chip platform having a disaggregated architecture

The disclosed embodiments are generally directed to inline encryption of data at line speed at a chip interposed between two memory components. The inline encryption may be implemented at a System-on-Chip ('SOC' or “SOC”). The memory components may comprise Non-Volatile Memory express (NVMe) and a dynamic random access memory (DRAM). An exemplary device includes an SOC to communicate with a Non-Volatile Memory NVMe circuitry to provide direct memory access (DMA) to an external memory component. The SOC may include: a cryptographic controller circuitry; a cryptographic memory circuitry in communication with the cryptographic controller, the cryptographic memory circuitry configured to store instructions to encrypt or decrypt data transmitted through the SOC; and an encryption engine in communication with the crypto controller circuitry, the encryption engine configured to encrypt or decrypt data according to instructions stored at the crypto memory circuitry. Other embodiments are also disclosed and claimed.

System, method and apparatus for total storage encryption

Techniques for encrypting data using a key generated by a physical unclonable function (PUF) are described. An apparatus according to the present disclosure may include decoder circuitry to decode an instruction and generate a decoded instruction. The decoded instruction includes operands and an opcode. The opcode indicates that execution circuitry is to encrypt data using a key generated by a PUF. The apparatus may further include execution circuitry to execute the decoded instruction according to the opcode to encrypt the data to generate encrypted data using the key generated by the PUF.

ISA accessible physical unclonable function

An apparatus to verify firmware in a computing system, comprising a non-volatile memory, including firmware memory to store agent firmware associated with each of a plurality of interconnect protocol (IP) agents and version memory to store security version numbers (SVNs) included in the agent firmware, a security controller comprising verifier logic to verify an integrity of the version memory by applying a hash algorithm to contents of the version memory to generate a SVN hash, and a trusted platform module (TPM) to store the SVN hash.

Firmware verification mechanism

The present disclosure includes systems and methods for securing data direct I/O (DDIO) for a secure accelerator interface, in accordance with various embodiments. Historically, DDIO has enabled performance advantages that have outweighed its security risks. DDIO circuitry may be configured to secure DDIO data by using encryption circuitry that is manufactured for use in communications with main memory along the direct memory access (DMA) path. DDIO circuitry may be configured to secure DDIO data by using DDIO encryption circuitry manufactured for use by or manufactured within the DDIO circuitry. Enabling encryption and decryption in the DDIO path by the DDIO circuitry has the potential to close a security gap in modern data central processor units (CPUs).

Securing data direct I/O for a secure accelerator interface

An apparatus to collect firmware measurement data at a computing system is disclosed. The apparatus includes a plurality of agents, each including a non-volatile memory storing firmware executed to perform a function associated with the agent, verification logic to generate measurement data by verifying the integrity of the firmware and a register to store the measurement data, and a processor to execute an instruction to collect firmware measurement data from each of the plurality of agents.

Platform measurement collection mechanism

Methods and apparatus relating to cryptographic protection of memory attached over interconnects are described. In an embodiment, memory stores data and a processor having execution circuitry executes an instruction to program an inline memory expansion logic and a host memory encryption logic with one or more cryptographic keys. The inline memory expansion logic encrypts the data to be written to the memory and decrypts encrypted data to be read from the memory. The memory is coupled to the processor via an interconnect endpoint of a system fabric. Other embodiments are also disclosed and claimed.

Cryptographic protection of memory attached over interconnects

Growing community of inventors

Hillsboro, OR, United States of America

Prashant Dewan