Intel Corporation

Google Inc.

Uday R Savagaonkar

David M Durham

Carlos V Rozas

Ravi L Sahita

Francis X Mckeen

Vincent R Scarlata

Simon P Johnson

Michael A Goldsmith

Siddhartha Chhabra

Vedvyas Shanbhogue

Ittai Anati

Prashant Dewan

Wesley Hamilton Smith

Gilbert A Neiger

Men Long

Ilya Alexandrovich

Rebekah M Leslie-Hurd

Alpa T Narendra Trivedi

Hormuzd M Khosravi

Barry E Huntley

Alex Berenzon

Xiaozhu Kang

Raghunandan Makaram

Amy L Santoni

Jason Martin

Priya Rajagopal

Keith Moyer

Chong Cai

Matthew Gingell

Anna Sapek

Travis T Schluessler

Jason W Brandt

Krystof C Zmudzinski

Kirk S Yap

Baiju V Patel

Scott R Janus

Eugene M Kishinevsky

Subhash Gutti

Shay Gueron

John I Garney

Ernie F Brickell

Howard C Herbert

Gary L Graunke

Dion Rodgers

Shlomo Raikin

Stephen R Van Doren

Gideon Gerzon

Stalinselvaraj Jeyasingh

Brandon S Baker

Joseph Frank Cihula

Thomas Michael Roeder

Sergey Karamov

Francis McKeen

Stephen J Tolopka

Asher M Altman

Bernard Lint

Gur Hildesheim

Don Alan Van Dyke

Edgar Borrayo

Paul S Schmitz

Carlos Ornelas

Gayathri Nagabhushan

Jeffrey Thomas Andersen

Balaji Vembu

Scott Dion Rodgers

Uttam K Sengupta

Nelly L Porter

David Benson Cross

Ernest F Brickell

Rinat Rappoport

Eric Northup

Bo A Zhang

James D Beaney, Jr

Madhavan Parthasarathy

Piotr Zmijewski

Eduardo Cabre

Anton Ivanov

Sergey Simakov

Robert G Blankenship

Jesse R Walker

Geoffrey S Strongin

Karanvir S Grewal

Niranjan L Cooray

Daniel Nemiroff

Xiaoning Li

Zvika Greenfield

Alpa Narendra Trivedi

Jacob Doweck

Jiangtao Li

Moshe Maor

Hisham Shafi

Stanley Steve Kulick

Ramadass Nagarajan

Kiran A Padwekar

Uri Blumenthal

Michael A Halcrow

Ofir Mulla

Abhishek Das

Divya Naidu Kolar Sunder

Vladimir Beker

Aspects of the disclosure relate to providing a secure collaboration between one or more PCIe accelerators and an enclave. An example system may include a PCIe accelerator apparatus. The PCIs accelerator apparatus may include the one or more PCIe accelerators and a microcontroller configured to provide a cryptographic identity to the PCIe accelerator apparatus. The PCIe accelerator apparatus may be configured to use the cryptographic identity to establish communication between the PCIe accelerator apparatus the enclave.

Secure collaboration between processors and processing accelerators in enclaves

Encryption interface technologies are described. A processor can include a system agent, an encryption interface, and a memory controller. The system agent can communicate data with a hardware functional block. The encryption interface can be coupled between the system agent and a memory controller. The encryption interface can receive a plaintext request from the system agent, encrypt the plaintext request to obtain an encrypted request, and communicate the encrypted request to the memory controller. The memory controller can communicate the encrypted request to a main memory of the computing device.

Encryption interface

Aspects of the disclosure provide various methods relating to enclaves. For instance, a method of authentication for an enclave entity with a second entity may include receiving, by one or more processors of a host computing device of the enclave entity, a request and an assertion of identity for the second entity, the assertion including identity information for the second identity; using an assertion verifier of the enclave entity to determine whether the assertion is valid; when the assertion is valid, extracting the identity information; authenticating the second entity using an access control list for the enclave entity to determine whether the identity information meets expectations of the access control list; when the identity information meets the expectations of the access control list, completing the request.

Enclave interactions

A uniform enclave interface is provided for creating and operating enclaves across multiple different types of backends and system configurations. For instance, an enclave manager may be created in an untrusted environment of a host computing device. The enclave manager may include instructions for creating one or more enclaves. An enclave may be generated in memory of the host computing device using the enclave manager. One or more enclave clients of the enclave may be generated by the enclave manager such that the enclave clients configured to provide one or more entry points into the enclave. One or more trusted application instances may be created in the enclave.

Uniform enclave interface

A fork support is provided for duplicating an application running inside an enclave entity. In this regard, a request to duplicate an application running inside a first enclave may be received by one or more processors of a host computing device of the first enclave. A snapshot of the first enclave including the application may be generated. The snapshot may be encrypted with a snapshot key and copied to untrusted memory of the host. A second enclave may be generated. The snapshot key may be sent from the first enclave to the second enclave through a secure communication channel. The encrypted snapshot may be copied from the untrusted memory of the host into the second enclave. The encrypted snapshot may be decrypted inside the second enclave with the snapshot key.

Enclave fork support

A processor for supporting secure memory intent is disclosed. The processor of the disclosure includes a memory execution unit to access memory and a processor core coupled to the memory execution unit. The processor core is to receive a request to access a convertible page of the memory. In response to the request, the processor core to determine an intent for the convertible page in view of a page table entry (PTE) corresponding to the convertible page. The intent indicates whether the convertible page is to be accessed as at least one of a secure page or a non-secure page.

Supporting secure memory intent

In an embodiment, the present invention includes a processor having an execution logic to execute instructions and a control transfer termination (CTT) logic coupled to the execution logic. This logic is to cause a CTT fault to be raised if a target instruction of a control transfer instruction is not a CTT instruction. Other embodiments are described and claimed.

Control transfer termination instructions of an instruction set architecture (ISA)

Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for instantiating and managing systems that utilize hierarchal enclaves in a cloud environment.

System of enclaves

Embodiments include systems, methods, computer readable media, and devices configured to, for a first processor of a platform, generate a platform root key; create a data structure to encapsulate the platform root key, the data structure comprising a platform provisioning key and an identification of a registration service; and transmit, on a secure connection, the data structure to the registration service to register the platform root key for the first processor of the platform. Embodiments include systems, methods, computer readable media, and devices configured to store a device certificate received from a key generation facility; receive a manifest from a platform, the manifest comprising an identification of a processor associated with the platform; and validate the processor using a stored device certificate.

Platform attestation and registration for servers

Growing community of inventors

Portland, OR, United States of America

Uday R Savagaonkar