Intel Corporation

Sdg Logic Inc.

Mcafee, Inc.

Sergiu D Ghetie

Neeraj S Upasani

Wojciech S Powiertowski

Vincent J Zimmer

Gilbert A Neiger

Rajesh Poornachandran

Mohan J Kumar

Sagar V Dalvi

Shahrokh Shahidzadeh

Michael Neve De Mevergnies

Jeanne Guillory

Adil Karrar

Murugasamy K Nachimuthu

Sarathy Jayakumar

David P Turley

Allen R Wishman

Ashok Raj

Hisham Shafi

Scott P Bobholz

Chukwunenye S Nnebe

Jason W Brandt

Ron Gabor

Joseph Nuzman

Lihu Rappoport

Robert S Chappell

Kirk D Brannock

Theodros Yigzaw

Deepak K Gupta

Adrian R Pearson

Jared Warner Stark, Iv

Alberto J Munoz

Rodrigo Branco

Douglas Raymond Moran

Faraz A Siddiqi

Ulhas S Warrier

Jason Sandri

Gamil A Cain

Thomas R Bowen

Jason R Cox

Ariel Sabba

Scott J Cape

Mark D Chubb

Zhangping Chen

Yair Berger

Gilad Holzstein

Won Lee

Rajesh M Sankaran

Richard A Uhlig

Knut Stener Grimsrud

Gideon Gerzon

David Alan Brown

Narayan Ranganathan

John G Holm

Daniel G Borkowski

Samie B Samaan

Arkadiusz Berent

David T Mayo

Vasuki Chilukuri

Vinila Rose

Ronald N Story

Prasun Ratn

Vijaya K Boddu

Yogesh Bijlani

Kenneth Young

Srihari Narayanan

Francisco Orlando C Arbildo

Shaila R Murty

Shahrok Shahidzadeh

Neeraj Upasani

Techniques are described herein for security hardened processing devices. For example, a method can include performing a secure boot of a processing device of a computer system. The processing device is configured as a root of trust for a secure boot process. The computer system can include the processing device and a non-volatile memory storing a basic input/output system (BIOS) for the secure boot process. The method can include identifying a set of programmable fuses of the processing device, deriving an encryption key using a value encoded by the set of programmable fuses in the processing device, and authenticating the BIOS to perform the secure boot process using a key derivation algorithm based on the encryption key.

Security hardened processing device

Aspects of the present disclosure involve systems, methods, apparatus, and computer-readable media for mitigating laser-based fault injection attacks against one or more processing devices. Techniques may include generating a corresponding representation of at least one of data or a component of a processing device, locating the corresponding representation on a die of the processing device adjacent to a location on the die of at least one of the data or the component, and executing, based on a determination that the corresponding representation is different than at least one of the data or the component of the processing device, a mitigation procedure. One example may include hashing, using a secure hashing function, security data to generate integrity data corresponding to the security data and storing the security data and the integrity data in adjacent memory locations in a memory device.

System and methods for fault injection attack protection

Systems, apparatuses, methods, and computer-readable media for implementing confidential computing of one or more computing systems and/or devices using component authentication and data encryption with integrity and anti-replay mechanisms are disclosed. In some examples, the systems, apparatuses, methods, and computer-readable media described herein can perform various techniques, including one or more secure boot processes, component and data authentication, and data encryption with integrity and anti-replay, among other secure techniques. One implementation may include executing secure boot process based on authentication of a device identifier stored in a secure physical object of a processing device. Another implementation may include encrypting and storing a counter value corresponding to a cache line and generating an integrity tag value replacing error correction code bits associated with the cache line with the generated cache line tag value.

System and methods for confidential computing

Methods and apparatuses relating to mitigations for speculative execution side channels are described. Speculative execution hardware and environments that utilize the mitigations are also described. For example, three indirect branch control mechanisms and their associated hardware are discussed herein: (i) indirect branch restricted speculation (IBRS) to restrict speculation of indirect branches, (ii) single thread indirect branch predictors (STIBP) to prevent indirect branch predictions from being controlled by a sibling thread, and (iii) indirect branch predictor barrier (IBPB) to prevent indirect branch predictions after the barrier from being controlled by software executed before the barrier.

Apparatuses and methods for speculative execution side channel mitigation

Embodiments are generally directed apparatuses, methods, techniques and so forth to receive a sled manifest comprising identifiers for physical resources of a sled, receive results of an authentication and validation operations performed to authenticate and validate the physical resources of the sled, determine whether the results of the authentication and validation operations indicate the physical resources are authenticate or not authenticate. Further and in response to the determination that the results indicate the physical resources are authenticated, permit the physical resources to process a workload, and in response to the determination that the results indicate the physical resources are not authenticated, prevent the physical resources from processing the workload.

Techniques to verify and authenticate resources in a data center computer environment

Embodiments may be generally directed to techniques to encrypt and decrypt data in a first fuse block array using an encryption key of a second fuse block array, the second fuse block array having the encryption key comprising a plurality of segments of bits, an inverse encryption key comprising a second plurality of segments of bits, each segment of the inverse encryption key to correspond with a particular segment of the encryption key, and a random pattern having equally distributed bit values, the random pattern to enable detection of voltage attacks on the second fuse block array.

Techniques to protect fuses against non-destructive attacks

Hardware processors and methods for extended microcode patching through on-die and off-die secure storage are described. In one embodiment, the additional storage resources used for storing micro-operations are section(s) of a cache that are unused at runtime and/or unused by a configuration of a processor. For example, the additional storage resources may be a section of a cache that is used to store context information from a core when the core is transitioned to a power state that shuts off voltage to the core. Non-limiting examples of such sections are one or more sections for storage of context information for a transition of a thread to idle or off, storage of context information for a transition of a core for a multiple core processor to idle or off, or storage of coherency information for a transition of a cache coherency circuit (e.g., cache box (CBo)) to idle or off.

Hardware processor and method for loading a microcode patch from cache into patch memory and reloading an overwritten micro-operation

A processor can be configured to access boot firmware from a remote location independent from use of a chipset. After a processor powers-on or reboots, the processor can execute microcode. The microcode will cause the processor to train a link with a remote device. The remote device can provide the processor with access to boot firmware. The processor can copy the boot firmware to the processor's cache or memory. The processor will attempt to authenticate the boot firmware. If the boot firmware is authenticated, the processor executes the copy of the boot firmware.

Techniques for processor boot-up

Hardware processors and methods for extended microcode patching through on-die and off-die secure storage are described. In one embodiment, the additional storage resources used for storing micro-operations are section(s) of a cache that are unused at runtime and/or unused by a configuration of a processor. For example, the additional storage resources may be a section of a cache that is used to store context information from a core when the core is transitioned to a power state that shuts off voltage to the core. Non-limiting examples of such sections are one or more sections for: storage of context information for a transition of a thread to idle or off, storage of context information for a transition of a core for a multiple core processor to idle or off, or storage of coherency information for a transition of a cache coherency circuit (e.g., cache box (CBo)) to idle or off.

Hardware processors and methods for extended microcode patching and reloading

Embodiments detailed herein include, but are not limited to, a hardware processor to execute instructions and security circuitry to perform pre-boot operations including signature verification of a portion of firmware in a firmware storage hardware and initiating recovery upon a signature verification failure. The hardware processor comprises a plurality of cores in some embodiments. The hardware processor a multicore processor in some embodiments.

Systems, apparatuses, and methods for platform security

Techniques and apparatuses for issuance of license upgrades for hardware components in the field, as well as the hardware components, are described. In one embodiment, for example an apparatus may include processor circuitry and memory in communication with the processor circuitry, wherein the memory contains a configuration data block and license data block, the configuration data block being read from the memory via a licensing apparatus and the licensing data block being written to the memory by the licensing apparatus. The processor may include executable code to process the licensing data block to facilitate an upgrade of the capabilities of the processor circuitry.

System and method for reconfiguring and deploying soft stock-keeping units

There is disclosed in one example a processor, including: a protected runtime mode (PRM) module to receive a PRM interrupt and to: suspend operation of a software task executing on the processor; save processor state information; place the microprocessor into PRM; access a PRM handler in a designated PRM memory region, wherein the PRM handler comprises a platform specific task; restore the processor state; and resume operation of the software task.

Protected runtime mode

A processor of an aspect includes a decode unit to decode a read from memory instruction. The read from memory instruction is to indicate a source memory operand and a destination storage location. The processor also includes an execution unit coupled with the decode unit. The execution unit, in response to the read from memory instruction, is to read data from the source memory operand, store an indication of defective data in an architecturally visible storage location, when the data is defective, and complete execution of the read from memory instruction without causing an exceptional condition, when the data is defective. Other processors, methods, systems, and instructions are disclosed.

Read from memory instructions, processors, methods, and systems, that do not take exception on defective data

Growing community of inventors

Hillsboro, OR, United States of America

Sergiu D Ghetie