Intel Corporation

Simon P Johnson

Carlos V Rozas

Vincent R Scarlata

Francis X Mckeen

Uday R Savagaonkar

Ilya Alexandrovich

Ittai Anati

Vedvyas Shanbhogue

Rebekah M Leslie-Hurd

Gilbert A Neiger

Michael A Goldsmith

Wesley Hamilton Smith

Krystof C Zmudzinski

Raghunandan Makaram

Amy L Santoni

Barry E Huntley

Mona Vij

Somnath Chakrabarti

Alex Berenzon

Siddhartha Chhabra

Abhishek Das

Robert G Blankenship

Debendra Das Sharma

Venkatraman Iyer

Arvind A Kumar

Raj K Ramanujan

Yen-Cheng Liu

Robert J Safranek

Herbert H Hum

Darren S Jue

Ashish Gupta

Vedaraman Geetha

Bahaa Fahim

Aaron T Spink

Jeffrey Charles Swanson

Fulvio Spagna

Rahul R Shah

Robert H Beers

Jeff Willey

Sitaraman V Iyer

William Harry Nale

Yuvraj S Dhillon

Robert A Maddox

Willard M Wiseman

Bo A Zhang

Francis McKeen

James D Beaney, Jr

Asher M Altman

Piotr Zmijewski

Eduardo Cabre

David M Durham

Prashant Dewan

John I Garney

Ernie F Brickell

Howard C Herbert

Gary L Graunke

Dion Rodgers

Stephen R Van Doren

Stalinselvaraj Jeyasingh

George Zacharias Chrysos

Binata Bhattacharyya

Joseph Frank Cihula

Stephen J Tolopka

Bernard Lint

Don Alan Van Dyke

Rebekah Leslie

William Colin Wood

Jiang Tao Li

Ned M Smith

Shay Gueron

Scott Dion Rodgers

Bin Xing

Brian S Morris

Nikhil M Deshpande

Rinat Rappoport

Anand Rajan

Mark Shanahan

Vinay Phegade

Steve Orrin

Brandon Baker

Anton Ivanov

Barrey E Huntley

Jesse R Walker

Daniel Nemiroff

Jiangtao Li

Ernest F Brickell

Kiran A Padwekar

Meltem Ozsoy

Vladimir Beker

A processor includes a decode unit to decode an instruction that is to indicate a page of a protected container memory, and a storage location outside of the protected container memory. An execution unit, in response to the instruction, is to ensure that there are no writable references to the page of the protected container memory while it has a write protected state. The execution unit is to encrypt a copy of the page of the protected container memory. The execution unit is to store the encrypted copy of the page to the storage location outside of the protected container memory, after it has been ensured that there are no writable references. The execution unit is to leave the page of the protected container memory in the write protected state, which is also valid and readable, after the encrypted copy has been stored to the storage location.

Processors, methods, systems, and instructions to support live migration of protected containers

A physical layer (PHY) is coupled to a serial, differential link that is to include a number of lanes. The PHY includes a transmitter and a receiver to be coupled to each lane of the number of lanes. The transmitter coupled to each lane is configured to embed a clock with data to be transmitted over the lane, and the PHY periodically issues a blocking link state (BLS) request to cause an agent to enter a BLS to hold off link layer flit transmission for a duration. The PHY utilizes the serial, differential link during the duration for a PHY associated task selected from a group including an in-band reset, an entry into low power state, and an entry into partial width state.

High performance interconnect

A processor for supporting secure memory intent is disclosed. The processor of the disclosure includes a memory execution unit to access memory and a processor core coupled to the memory execution unit. The processor core is to receive a request to access a convertible page of the memory. In response to the request, the processor core to determine an intent for the convertible page in view of a page table entry (PTE) corresponding to the convertible page. The intent indicates whether the convertible page is to be accessed as at least one of a secure page or a non-secure page.

Supporting secure memory intent

Embodiments include systems, methods, computer readable media, and devices configured to, for a first processor of a platform, generate a platform root key; create a data structure to encapsulate the platform root key, the data structure comprising a platform provisioning key and an identification of a registration service; and transmit, on a secure connection, the data structure to the registration service to register the platform root key for the first processor of the platform. Embodiments include systems, methods, computer readable media, and devices configured to store a device certificate received from a key generation facility; receive a manifest from a platform, the manifest comprising an identification of a processor associated with the platform; and validate the processor using a stored device certificate.

Platform attestation and registration for servers

A processor includes a cryptographic engine to control access, using an secure region key identifier (ID), to one or more memory range of memory allocable for flexible conversion to secure pages of architecturally-protected memory regions, and a processor core. The processor core is to, responsive to receipt of a request to access the memory, perform a walk of page tables and extended page tables to translate a linear address of the request to a physical address of the memory. The processor core is further to determine that the physical address corresponds to an secure page within the one or more memory range of the memory, that a first key ID located within the physical address does not match the secure region key ID, and issue a page fault and deny access to the secure page in the memory.

Host-convertible secure enclaves in memory that leverage multi-key total memory encryption with integrity

A technique to enable secure application and data integrity within a computer system. In one embodiment, one or more secure enclaves are established in which an application and data may be stored and executed.

Method and apparatus to provide secure application execution

A computing platform implements one or more secure enclaves including a first provisioning enclave to interface with a first provisioning service to obtain a first attestation key from the first provisioning service, a second provisioning enclave to interface with a different, second provisioning service to obtain a second attestation key from the second provisioning service, and a provisioning certification enclave to sign first data from the first provisioning enclave and second data from the second provisioning enclave using a hardware-based provisioning attestation key. The signed first data is used by the first provisioning enclave to authenticate to the first provisioning service to obtain the first attestation key and the signed second data is used by the second provisioning enclave to authenticate to the second provisioning service to obtain the second attestation key.

Flexible provisioning of attestation keys in secure enclaves

Growing community of inventors

Beaverton, OR, United States of America

Simon P Johnson