Intel Corporation

Mcafee, Inc.

Purushottam Goel

Ned M Smith

Sven Schrecker

Vincent Edward Von Bokern

Vedvyas Shanbhogue

Arvind A Kumar

Victoria C Moore

Prashant Dewan

Mahesh S Natu

Ernie F Brickell

Howard C Herbert

Daniel Nemiroff

Avigdor Dori Eldar

William A Stevens, Jr

Karunakara Kotary

Paritosh Saxena

Nicholas D Triantafillou

Bharat S Pillilli

Andrew H Gafken

Michael Berger

Paul J Thadikaran

Alberto J Martinez

Carey W Smith

Uri Blumenthal

Kumar Narasimhan Dwarakanath

Xiaoyu Ruan

Mukesh Kataria

Aditya Katragada

Debra Cablao

David Hines

Vinupama Godavarthi

Tim Abels

Alex Izbinsky

Ned McArthur Smith

Jr William A Stevens

An apparatus comprising a computer platform, including a central processing unit (CPU) comprising a first security engine to perform security operations at the CPU and a chipset comprising a second security engine to perform security operations at the chipset, wherein the first security engine and the second security engine establish a secure channel session between the CPU and the chipset to secure data transmitted between the CPU and the chipset.

Platform security mechanism

There is disclosed in one example, a system-on-a-chip (SoC), including: a processor core; a fabric; an intellectual property (IP) block communicatively coupled to the processor core via the fabric, the IP block having a microcontroller configured to provide a microcontroller architecture; a firmware load interface configured to provide a standardized hardware interface to the microcontroller architecture, wherein the standardized hardware interface provides an architecture-agnostic mechanism to securely load a firmware to the intellectual property block; and logic to provide a loader to load a firmware to the IP block via the firmware load interface.

Standardized interface for intellectual property blocks

An opportunity for a computing device to participate in a secure session with a particular domain is identified. A secured microcontroller of the computing device is used to identify a secured, persistent seed corresponding to the particular domain and stored in secured memory of the computing device. A secure identifier is derived based on the seed and sent for use by the particular domain in authenticating the computing device to the particular domain for the secure session. The particular domain can further apply security policies to transactions involving the computing device and particular domain based at least in part on the secure identifier.

Hardware-based device authentication

A secure identifier is derived, using a secured microcontroller of a computing device, that is unique to a pairing of the computing device and a particular domain. Secure posture data corresponding to attributes of the computing device is identified in secured memory of the computing device. The secure identifier and security posture is sent in a secured container to a management device of the particular domain. The particular domain can utilize the information in the secured container to authenticate the computing device and determine a security task to be performed relating to interactions of the computing device with the particular domain.

Trusted container

A manageability engine (ME) receives an authentication response from a user during pre-boot authentication and registers the user with a key distribution center (KDC), indicating that the user has successfully authenticated to the PC. The KDC supplies the ME with single-sign-on credentials in the form of a Key Encryption Key (KEK). The KEK may later be used by the PC to obtain a credential used to establish secure access to Enterprise servers.

Method and system for enterprise network single-sign-on by a manageability engine

A domain identifier of a first domain of a plurality of domains is identified, the domain identifier included in a domain certificate received from the first domain. A first permanent hardware identifier set as a fuse key value embedded in hardware of the device during fabrication is identified. A plurality of unique second private hardware identifiers stored in the secured memory are identified. A plurality of hardware-based root identifiers are derived from the plurality of unique second private hardware identifiers respectively. A plurality of secure identifiers for the respective plurality of unique second private hardware identifiers are derived for a pairing of the device and the first domain based on the plurality of root identifiers respectively and the domain identifier. A secure identifier of the plurality of secure identifiers is caused to be sent over a secured channel to a domain computing device associated with the first domain.

Systems and methods may provide implementing one or more device locking procedures to block access to a device. In one example, the method may include receiving an indication that a user is no longer present, initiating a timing mechanism to set a period to issue a first device lock instruction to lock a peripheral device, relaying timing information from the timing mechanism to a controller module associated with the peripheral device; and locking the peripheral device upon expiration of the period.

Secure access management of devices

An opportunity for a computing device to participate in a secure session with a particular domain is identified. A domain identifier of the particular domain is received and a secured microcontroller of the computing device is used to identify a secured, persistent hardware identifier of the computing device stored in secured memory of the computing device. A secure identifier is derived for a pairing of the computing device and the particular domain based on the hardware identifier and domain identifier of the particular domain and the secure identifier is transmitted over a secured channel to the particular domain. The particular domain can verify identity of the computing device from the secure identifier and apply security policies to transactions involving the computing device and the particular domain based at least in part on the secure identifier.

Methods and apparatus relating to processor extensions for execution of secure embedded containers are described. In an embodiment, a scalable solution for manageability function is provided, e.g., for UMPC environments or otherwise where utilizing a dedicated processor or microcontroller for manageability is inappropriate or impractical. For example, in an embodiment, an OS (Operating System) or VMM (Virtual Machine Manager) Independent (generally referred to herein as 'OI') architecture involves creating one or more containers on a processor by dynamically partitioning resources (such as processor cycles, memory, devices) between the HOST OS/VMM and the OI container. Other embodiments are also described and claimed.

Processor extensions for execution of secure embedded containers

Embodiments of techniques and systems for out-of-band verification of host OS components are described. In embodiments, a out-of-band host OS boot sequence verification system ('BSVS') may access system memory without detection by a host OS process, or 'out of band.' The BSVS may access host OS components in the system memory and may generate signatures from memory footprints of the host OS components. These signatures may then be compared to trusted signatures to verify integrity of the host OS components. In embodiments, this verification may be performed during a boot of a host OS or on demand. In embodiments, the trusted signatures may be pre-stored by the BSVS before a boot; in some embodiments, the trusted signatures may be previously-computed and then stored by the BSVS. Other embodiments may be described and claimed.

Out-of-band host OS boot sequence verification

Growing community of inventors

Beaverton, OR, United States of America

Purushottam Goel