Intel Corporation

Ulhas S Warrier

Ravi L Sahita

John I Garney

Prakash N Iyer

Prashant Dewan

Karanvir S Grewal

Nitin V Sarangdhar

David A Koufaty

Kirk D Brannock

Scott H Robinson

Sergiu D Ghetie

Douglas Raymond Moran

Yasser Rasheed

Saul Lewites

Ansuya Negi

Michael Neve De Mevergnies

Matthew Eldon Hoekstra

Stephen J Tolopka

Adil Karrar

Allen R Wishman

Ramkumar Venkatachary

Ned M Smith

Siddhartha Chhabra

Reshma Lal

Hormuzd M Khosravi

Omesh Tickoo

Rameshkumar G Illikkal

Rajesh Sankaran Madukkarumukumana

Ranjit S Narjala

Abhilasha Bhargav-Spantzel

Kiran Singh Panesar

Hani Elgebaly

Ajay Garg

Ram V Chary

Mark L Skarpness

Ramanan V Ganesan

Holland J Wood

Jeffrey W Einarson

David A Konfaty

Ryan R Manepally

Technologies for end-to-end biometric-based authentication and locality assertion include a computing device with one or more biometric devices. The computing device may securely exchange a key between a driver and a secure enclave. The driver may receive biometric data from the biometric sensor in a virtualization-protected memory buffer and encrypt the biometric data with the shared key. The secure enclave may decrypt the biometric data and perform a biometric authentication operation. The computing device may measure a virtual machine monitor (VMM) to generate attestation information for the VMM. A secure enclave may execute a virtualization report instruction to request the attestation information. The processor may copy the attestation information into the secure enclave memory. The secure enclave may verify the attestation information with a remote attestation server. If verified, the secure enclave may provide a shared secret to the VMM. Other embodiments are described and claimed.

Technologies for end-to-end biometric-based authentication and platform locality assertion

According to an embodiment provided herein, there is provided a system that binds a trusted output session to a trusted input session. The system includes a processor to execute an enclave application in an architecturally protected memory. The system includes at least one logic unit forming a trusted entity to, responsive to a request to set up a trusted I/O session, generate a unique session identifier logically associated with the trusted I/O session and set a trusted I/O session indicator to a first state. The system includes at least one logic unit forming a cryptographic module to, responsive to the request to set up the trusted I/O session, receive an encrypted encryption key and the unique session identifier from the enclave application; verify the unique session identifier; and responsive a successful verification, decrypt and save the decrypted encryption key in an encryption key register.

Binding a trusted input session to a trusted output session

In an embodiment, a system includes at least one core and a trusted execution environment (TEE) to conduct an identity authentication that includes a comparison of streamed video data with previously recorded image data. Responsive to establishment of a match of the streamed video data to the previously recorded image data via the comparison, the TEE is to generate an identity attestation that indicates the match. Other embodiments are described and claimed.

Face based secure messaging

Embodiments of apparatuses, methods for partitioning systems, and partitionable and partitioned systems are disclosed. In one embodiment, a system includes processors and a partition manager. The partition manager is to allocate a subset of the processors to a first partition and another subset of the processors to a second partition. The first partition is to execute first operating system level software and the second partition is to execute second operating system level software.

System partitioning to present software as platform level functionality via inter-partition bridge including reversible mode logic to switch between initialization, configuration, and execution mode

A method, apparatus, machine-readable medium, and system are disclosed. In one embodiment the method includes a processor. The processor includes switching a platform firmware update mechanism located in a computer platform to a platform firmware armoring technology (PFAT) mode on a boot of the computer platform. The computer platform includes a platform firmware storage location that stores a platform firmware. The method then persistently locks the platform firmware storage location in response to the platform firmware update mechanism switching to the PFAT mode. When persistently locked, writes are only allowed to the platform firmware storage location by an Authenticated Code Module in the running platform and only after a platform firmware update mechanism unlocking procedure.

Platform firmware armoring technology

A system for executing trusted applications with a reduced trusted computing base. In one embodiment, the system includes a processor to dynamically instantiate an application protection module in response to a request by a program to be executed under a trusted mode. The system further includes memory to store the program which is capable of interacting with a remote service for security verification. In one embodiment, the application protection module includes a processor-measured application protection service (P-MAPS) operable to measure and to provide protection to the application.

Executing trusted applications with reduced trusted computing base

A method, apparatus, method, machine-readable medium, and system are disclosed. In one embodiment the method includes is a processor. The processor includes switching a platform firmware update mechanism located in a computer platform to a platform firmware armoring technology (PFAT) mode on a boot of the computer platform. The computer platform includes a platform firmware storage location that stores a platform firmware. The method then persistently locks the platform firmware storage location in response to the platform firmware update mechanism switching to the PFAT mode. When persistently locked, writes are only allowed to the platform firmware storage location by an Authenticated Code Module in the running platform and only after a platform firmware update mechanism unlocking procedure.

Embodiments of apparatuses, methods for partitioning systems, and partitionable and partitioned systems are disclosed. In one embodiment, a system includes processors and a partition manager. The partition manager is to allocate a subset of the processors to a first partition and another subset of the processors to a second partition. The first partition is to execute first operating system level software and the second partition is to execute second operating system level software. The first operating system level software is to manage the processors in the first partition as resources individually accessible to the first operating system level software, and the second operating system level software is to manage the processors in the second partition as resources individually accessible to the second operating system level software. The partition manager is also to present the second partition, including the second operating system level software, to the first operating system level software as platform level functionality embedded in the system.

System partitioning to present software as platform level functionality including mode logic to maintain and enforce partitioning in first and configure partitioning in second mode

Embodiments of apparatuses, methods, and systems for partitioning memory mapped device configuration space are disclosed. In one embodiment, an apparatus includes a configuration space address storage location, an access map storage location, and addressing logic. The configuration space address storage location is to store a pointer to a memory region to which transactions to configure devices in a partition of a partitioned system are addressed. The access map storage location is to store an access map or a pointer to an access map. The addressing logic is to use the access map to determine whether a configuration transaction from a processor to one of the devices is to be allowed.

Partitioning memory mapped device configuration space

Apparatuses, systems, and methods to monitor core performance and integrated circuit chip temperatures in order to alternatively partition cores and core resources are disclosed. Embodiments generally comprise integrated circuit processors in chips that contain multiple cores or processing elements. In many system and apparatus embodiments, a module monitors either the throughput or performance of one or more of the cores. In such embodiments, another module, a core allocation module, partitions or allocates cores in different arrangements of partitions to improve performance. Additionally, in some embodiments, a temperature monitoring module monitors one or more temperatures of the chip containing the cores, wherein the temperature measurements may affect the core allocations. In some embodiments, once an allocation for the cores is selected, the specifics of the cores to be placed in different partitions may be stored and later retrieved when triggered by events allowing for the reallocation of the cores.

Methods and apparatuses for core allocations

One embodiment includes a personal computer device comprising at least one machine to execute a primary user operating system, a first physical memory to be used by the primary user operating system, at least one appliance operating system that is independent from the primary user operating system, a second physical memory to be sequestered from the primary user operating system and an access violation monitor to restrict access from the at least one appliance operating system to the second physical memory, wherein the access violation monitor is to run only when the at least one appliance operating system is invoked and at least one appliance operating system is to be invoked only after the primary user operating system has been suspended to a standby state.

Method and apparatus for controlling a primary operating system and an appliance operating system on the same machine

Routing packets of information without proxies over a network having both private and public networks includes reviewing the destination address of a packet received a private network interface and rerouting the packet to a private client connected to the private network interface when the destination address of the packet is the public address of the private network.

Proxy-less packet routing between private and public address realms

An autonomic computing environment is provided by sequestering one of a plurality of processor resources, partitioning a memory, and hiding an input/output (I/O) device. One processor resource is sequestered such that the sequestered processor resource is not exposed to the remaining processor resources as a processor resource. A memory region is partitioned to provide a service processing portion such that the sequestered processor resource has access to all of the memory region and the remaining processor resources have access to at least a portion of the memory region but do not have access to the service processing portion. A first I/O device is hidden such that the sequestered processor resource has access to the first I/O device and the remaining processor resources do not have access to the first I/O device.

Autonomic computing utilizing a sequestered processing resource on a host CPU

A first machine communicates with a second machine, using a protocol that sends the first machine's network configuration data in application data sent to the second machine, through a translating access point which translates network traffic from the first machine so as to originate from the access point. A network configuration server provides to the first machine network configuration data not subject to translation by the access point, which is sent to the second machine in the application data. The second machine communicates with the provided network configuration, and this communication is in turn made available to the first machine.

Growing community of inventors

Beaverton, OR, United States of America

Ulhas S Warrier