Intel Corporation

Semiconductor Manufacturing International (shanghai) Corporation

Pwc Product Sales LLC

Weigang Li

Changzheng Wei

Ned M Smith

Vinodh Gopal

Kapil Sood

Baiju V Patel

Junyuan Wang

Ziye Yang

Songwu Shen

Kaijie Guo

Ping Yu

Wenqian Yu

Zijuan Fan

Yao Huo

John Joseph Browne

Xin Zeng

Cunming Liang

Liang J Ma

Maksim Lukoshkov

Michael E Kounavis

Jun Li

Timothy Verrall

Chen Wang

Ashok Raj

Chris MacNamara

Xiaodong Liu

Tomasz Kantecki

Chao Zheng

Rashmin N Patel

Maryam Tahhan

Hari K Tadepalli

Danny Yigang Zhou

Eoin Walsh

Niall Power

Hongjun Ni

Junhua Hou

Brian Will

Baoqian Li

Madhusudana Raghupatruni

Marcel Cornu

Laurent Coquerel

Qihua Dai

Xuekun Hu

Yizhuo Zhang

Changzhen Wei

Qianjun Xie

Yuan Wang

Shawni Chen

Lihui Zhang

Junyan Wang

An embodiment of an integrated circuit may comprise memory to store respective resource control descriptors in correspondence with respective identifiers, and an input/output (IO) memory management unit (IOMMU) communicatively coupled to the memory, the IOMMU including circuitry to determine resource control information for an IO transaction based on a resource control descriptor stored in the memory that corresponds to an identifier associated with the IO transaction, and control utilization of one or more resources of the IOMMU based on the determined resource control information. Other embodiments are disclosed and claimed.

PASID granularity resource control for IOMMU

Various examples of device and system implementations and methods for performing attestation delegation operations are disclosed. In an example, attestation operations are performed by a verifier, including: obtaining endorsement information for attestation of an entity; obtaining an appraisal policy for evaluation of attestation evidence for the attestation of the entity; determining, based on the endorsement information and the appraisal policy, that delegation to a delegate verifier entity is permitted to perform the attestation of the entity; and providing, to the delegate verifier entity, a delegation command to perform the attestation of the entity, wherein the delegation command authorizes the delegate verifier entity to perform attestation operations (e.g., verifier operations) for a domain of entities including the entity.

Attestation verifier role delegation

Techniques and mechanisms for determining an operation to be performed with a direct memory access (DMA) request. An inspection unit () is coupled between an input-output memory management unit (IOMMU) () and an endpoint device (). The inspection unit () stores a registry () comprising entries () which each correspond to a respective address, and a respective one or more resources of the endpoint device (). A given entry () of the registry () is created based on a message from the IOM MU () which indicates the successful completion of an address translation to facilitate a DMA request. The endpoint device () performs a search, based on a DMA request, to determine if any registry () entry () indicates a combination of an address and an endpoint resource, where said combination matches a corresponding combination indicated by the DMA request. Communication of the DMA request to the IOMMU () is contingent on a result of the search.

Device, system, and method for inspecting direct memory access requests

A system for generating digital flowcharts is provided. The system receives sketch image data comprising a plurality of shapes and text, and processes the sketch image data to generate flowchart data by applying a first model configured to generate shape data, applying a second model configured to generate text data, and generating linking data that associates shape data and text data. The system may generate and display a visualization of the flowchart data. The system may map the flowchart data to a region of a presentation slide and display a visualization of the flowchart data on the presentation slide.

Automated flow chart generation and visualization system

Technologies for securing a virtualization network function (VNF) image includes a security server to generate a wrapping cryptographic key to wrap a private key of the VNF image and replace the private key with the wrapped private key to secure the private key. During operation, the VNF image may be authenticated by a network function virtualization (NFV) server as needed. Additionally, the signature of the VNF image may be updated each time the VNF image is shutdown to ensure the continued authenticity of the VNF image.

Technologies for securing network function virtualization images

Technologies for key management of internet-of-things (IoT) devices include an IoT device, an authority center server, and a group management server. The IoT device is configured to authenticate with an authority center server via an offline communication channel, receive a group member private key as a function of the authentication with the authority center server, and authenticate with a group management server via a secure online communication channel using the group member private key. The IoT device is further configured to receive a group shared key as a function of the authentication with the group management server, encrypt secret data with the group shared key, and transmit the encrypted secret data to the group management server. Other embodiments are described herein.

Technologies for internet of things key management

Examples described herein provide for a first core to map a measurement of packet processing activity and operating parameters so that a second core can access the measurement of packet processing activity and potentially modify an operating parameter of the first core. The second core can modify operating parameters of the first core based on the measurement of packet processing activity. The first and second cores can be provisioned on start-up with a common key. The first and second cores can use the common key to encrypt or decrypt measurement of packet processing activity and operating parameters that are shared between the first and second cores. Accordingly, operating parameters of the first core can be modified by a different core while providing for secure modification of operating parameters.

Remote register updates

Technologies for hybrid field-programmable gate array (FPGA) application-specific integrated circuit (ASIC) code acceleration are described. In one example, the computing device includes a FPGA comprising: algorithm circuitry to: perform one or more algorithm tasks of an algorithm, wherein the algorithm to perform a service request that is offloaded to the FPGA; and determine a primitive task associated with an algorithm task of the one or more algorithm tasks; primitive offload circuitry to encapsulate the primitive task in a buffer of the FPGA, wherein the buffer is accessible by an ASIC of the computing device; and result circuitry to return one or more results of the service request responsive to performance of the primitive task by the ASIC.

Technologies for hybrid field-programmable gate array application-specific integrated circuit code acceleration

Embodiments include apparatuses, methods, and systems including one or more servers and one or more storage devices, coupled with each other, to provide virtual storage service to store a file and meta data of the file for a client computing device. The file and the meta data of the file may be encrypted by the client computing device before providing to the virtual storage service. The file may be encrypted with a secret key of the client computing device, and the meta data of the file may be encrypted with a shared session key between the client computing device and the virtual storage service. The encrypted file may be stored in the one or more storage devices, and the encrypted meta data of the file may be stored in one or more secured areas of the one or more servers. Other embodiments may also be described and claimed.

Virtual storage services for client computing devices

An embodiment of an electronic processing system may include a processor, persistent storage media communicatively coupled to the processor, a reconfigurable device communicatively coupled to the processor over a physically isolated trusted communication channel, a secure provisioner communicatively coupled to the processor and the reconfigurable device to provision a secure storage area and to securely store a remotely generated bitstream security key in the provisioned secure storage area, and a device configurer to configure the reconfigurable device with a remotely generated bitstream and the remotely generated bitstream security key. Other embodiments are disclosed and claimed.

Reconfigurable device bitstream key authentication

Examples herein relate to a system that includes a first memory device; a second memory device; and an input-output memory management unit (IOMMU). The IOMMU can search for a virtual-to-physical address translation entry in a first table for a received virtual address and based on a virtual-to-physical address translation entry for the received virtual address not being present in the first table, search a second table for a virtual-to-physical address translation entry for the received virtual address, wherein the first table is stored in the first memory device and the second table is stored in the second memory device. In some examples, based on a virtual-to-physical address translation entry for the received virtual address not being present in the second table, a page table walk is performed to determine a virtual-to-physical address translation for the received virtual address. In some examples, the first table includes an IO translation lookaside buffer (IOTLB).

Address translation technologies

Technologies for hybrid acceleration of code include a computing device () having a processor (), a field-programmable gate array (FPGA) (), and an application-specific integrated circuit (ASIC) (). The computing device () offloads a service request, such as a cryptographic request or a packet processing request, to the FPGA (). The FPGA () performs one or more algorithmic tasks of an algorithm to perform the service request. The FPGA () determines one or more primitive tasks associated with an algorithm task and encapsulates each primitive task in a buffer that is accessible by the ASIC (). The ASIC () performs the primitive tasks in response to encapsulation in the buffer, and the FPGA () returns results of the algorithm. The primitive operations may include cryptographic primitives such as modular exponentiation, modular multiplicative inverse, and modular multiplication. The results may be returned to the processor () or a network interface controller of the computing device ().

Various systems and methods of scalable and secure resource isolation and sharing for Internet of Things (IoT) networks, are described. Techniques for requesting inter-domain resource access and enabling resource sharing with use of an inter domain token are also described. In an example, communications in an IoT network to establish connectivity between a first device in a first domain and a second device in a second domain may include: receiving, from the first device at a collaboration cloud service, a request to access a resource of the second device; requesting and receiving, from an authorization provider, an inter-domain authorization token; and requesting, from the second device, access to the resource using the inter-domain authorization token; communications from the first device to access the second device are then performed between the first device and the second device based on a session key obtained with the inter-domain authorization token.

Scalable and secure resource isolation and sharing for IoT networks

Growing community of inventors

Shanghai, China

Weigang Li