Intel Corporation

Ramya Jayaram Masti

David M Durham

Gilbert A Neiger

Jason W Brandt

Thomas Toll

Ravi L Sahita

Vedvyas Shanbhogue

Michael Lemay

Vincent Edward Von Bokern

Siddhartha Chhabra

Hormuzd M Khosravi

Barry E Huntley

Geoffrey S Strongin

Utkarsh Y Kakaiya

David A Koufaty

Gideon Gerzon

Adrian C Moga

Annie Foong

Anna Trikalinou

Georgia Sandoval

Methods, apparatus, systems, and articles of manufacture for controlling access to user data are disclosed herein. One such apparatus to control access to user data includes memory, instructions, and at least one processor to execute the instructions to attempt to verify an identity bid associated with a request for access to user data to be processed. The identity bid includes a cryptographic signature based on a secret embedded in a data compute agent that generated the identity bid. The processor is also to determine whether agent attributes included in the identity bid satisfy user data attributes associated with the user data, and to permit the data compute agent to access the user data when the identity bid is verified, and when the agent attributes satisfy the user data attributes.

Methods and apparatus to control access to user data based on user-specified attributes

An example method comprises storing, in a register, an encoded pointer to a memory location, where first context information is stored in first bits of the encoded pointer and a slice of a memory address of the memory location is encrypted and stored in second bits of the encoded pointer. The method further includes decoding the encoded pointer to obtain the memory address of the memory location, using the memory address obtained by decoding the encoded pointer to access encrypted data at the memory location, and decrypting the encrypted data based on a first key and a first tweak value. The first tweak value includes one or more bits derived, at least in part, from the encoded pointer.

Pointer based data encryption

In one embodiment, an apparatus includes a memory and a scheduler. The scheduler is coupled to the memory and a memory controller. The memory stores a plurality of metadata requests. Each of the plurality of metadata requests is associated with one of a plurality of metadata priority levels. The scheduler schedules transmission of a first metadata request of the plurality of metadata requests to the memory controller based at least in part on a first metadata priority level associated with the first metadata request and a first bandwidth portion of a metadata request bandwidth. The first bandwidth portion is associated with the first metadata priority level. Other embodiments are described and claimed.

System, apparatus, and method for scheduling metadata requests

Technologies disclosed herein provide cryptographic computing with cryptographically encoded pointers in multi-tenant environments. An example method comprises executing, by a trusted runtime, first instructions to generate a first address key for a private memory region in the memory and generate a first cryptographically encoded pointer to the private memory region in the memory. Generating the first cryptographically encoded pointer includes storing first context information associated with the private memory region in first bits of the first cryptographically encoded pointer and performing a cryptographic algorithm on a slice of a first linear address of the private memory region based, at least in part, on the first address key and a first tweak, the first tweak including the first context information. The method further includes permitting a first tenant in the multi-tenant environment to access the first address key and the first cryptographically encoded pointer to the private memory region.

Cryptographic computing using encrypted base addresses and used in multi-tenant environments

Embodiments of apparatuses, methods, and systems for scalable multi-key memory encryption are disclosed. In an embodiment, an apparatus includes a core, an encryption unit, and key identification hardware. The core is to write data to and read data from memory regions, each to be identified by a corresponding address. The encryption unit to encrypt data to be written and decrypt data to be read. The key identification hardware is to use a portion of the corresponding address to look up a corresponding key identifier in a key information data structure. The corresponding key identifier is one multiple key identifiers. The corresponding key identifier is to identify which one of multiple encryption keys is to be used to encrypt and decrypt the data.

Scalable multi-key memory encryption

An example method comprises storing, in a register, an encoded pointer to a memory location, where first context information is stored in first bits of the encoded pointer and a slice of a memory address of the memory location is encrypted and stored in second bits of the encoded pointer. The method further includes decoding the encoded pointer to obtain the memory address of the memory location, using the memory address obtained by decoding the encoded pointer to access encrypted data at the memory location, and decrypting the encrypted data based on a first key and a first tweak value. The first tweak value includes one or more bits and is derived, at least in part, from the encoded pointer.

A method comprising responsive to a first instruction requesting a memory heap operation, identifying a data block of a memory heap; accessing a tag history for the data block, the tag history comprising a plurality of tags previously assigned to the data block; assigning a tag to the data block, wherein assigning the tag comprises verification that the tag does not match any of the plurality of tags of the tag history; and providing the assigned tag and a reference to a location of the data block.

Low memory overhead heap management for memory tagging

Embodiments are directed to providing a secure address translation service. An embodiment of a system includes a memory device to store memory data in a plurality of physical pages shared by a plurality of devices, a first table to map each page of memory to an associated bundle identifier (ID) that identifies one or more devices having access to a page of memory, a second table to map each bundle ID to page access permissions that define access to one or more pages associated with a bundle ID and a translation agent to receive requests from the plurality of devices to perform memory operations on the memory and determine page access permissions for requests received from the plurality of devices using the first table and the second table.

Secure address translation services using bundle access control

A method includes receiving, by a processor from a virtual machine (VM) executed by the processor, an indication that a proper subset of a plurality of virtual memory pages of the VM are secure memory pages. The method further includes, responsive to determining the VM is attempting to access a first memory page, determining whether the proper subset comprises the first memory page. The method further includes, responsive to determining the proper subset comprises the first memory page: using first attributes specified by the VM for the first memory page; and ignoring second attributes specified by a virtual machine monitor (VMM) for the first memory page. The VMM is executed by the processor to manage the VM.

Growing community of inventors

Hillsboro, OR, United States of America

Ramya Jayaram Masti