International Business Machines Corporation

Santosh Balasubramanian

Pradeep N Chatnahalli

Cedric Lichtenau

Sachin Gupta

Andreas Koenig

Mitesh A Agrawal

Sandeep Korrapati

Raja Das

Prasad Shivaram

Janani Swaminathan

Srinivas Bangalore Purushotham

Trinadhachari Kosuru

Shakeeb Pasha Bk

Rajeev Potharlanka

Anand Haridass

Providing a method and a corresponding system for encrypting customer workload data through a trusted entity such as a self-boot engine (SBE). More specifically, there is a method and a corresponding system for securely extracting out customer centric data in a manner that requires the customer payloads and/or workloads to register with the SBE and share the encryption key.

Securing customer data and internal register data during hardware checkstops in a multi-tenant environment

Authenticating a host computer and NVDIMM pair using lookup tables for a challenge/response exchange between the pair of devices. The NVDIMM is challenged by the host computer for which a response associated with the physically unclonable function of a NVDIMM component is provided. The NVDIMM challenges the host computer for which a response associated with the physically unclonable function of a host computer component is provided. Additional security stores a modified response associated with run-time physically unclonable functions associated with the host computer and NVDIMM pair for use in future challenge/response exchanges.

NVDIMM security with physically unclonable functions

A method for managing memory within a computing system. The method includes one or more computer processors identifying a range of physical memory addresses that store a first data. The method further includes determining whether a second data is stored within the range of physical memory addresses that stores the first data. The method further includes responding to determining that the second data is stored within the range of physical memory addresses that store the first data, by determining whether a process accessing the second data is identified as associated with a side-channel attack. The method further includes responding to determining that the process accessing the second data is associated with the side-channel attack, by initiating a response associated with the process accessing the second data.

Identifying and responding to a side-channel security threat

Embodiments provide a mutable CRTM schema for ensuring the integrity of a client workload on a single system as updates are made to the firmware used to initialize and run that system by booting a computing system in a secure mode; when successfully validating a boot image for the computing system via a secure verification code that is blocked from write access when the system is booted in a unsecure mode, allowing write access to the secure verification code; and continuing to boot the computing system in the secure mode according to the boot image. When booting the system and unseccessfully validating the boot image at the third time, the system boot is failed.

Unsecure to secure transition of mutable core root of trust

A protection circuit can be used with a computer system having a master device and at least one slave device that are connected by an inter-integrated circuit (I2C) bus. A first access request is received that includes an address that identifies a first slave device. In response to a permissible mode, the first access request is communicated to the first slave device using the I2C bus. A sticky protection bit can be set. In response to the sticky protection bit being set, the protection circuit can be placed in a protected mode. A second access request is received. The second access request can be determined to be a protected access to the first slave device. In response to the determining and the protected mode, the second access request to the first slave device can be denied.

Data access protection for computer systems

A processor determines a timestamp for a signal based on a number of consecutive cycles that the signal is present on a trace bus. The processor writes a first part of the timestamp to a memory that is allocated for a timestamp of a trace entry. The processor overwrites one or more identified free bits with a second part of the timestamp of the trace entry.

Dynamic allocation of trace array timestamp data

Methods for allocating spare latch circuits to logic blocks in an integrated circuit design are provided. A method includes determining logic blocks in the design and determining and determining an allocation of spare latch circuits among the logic blocks based on respective attributes of the logic blocks. The method further include placing the spare latch circuits in the design in accordance with the determined allocation based on local clock buffers corresponding with the logic blocks.

Growing community of inventors

Bengaluru, India

Santosh Balasubramanian