Intel Corporation

Teleputers, LLC

Yu-Yuan Chen

David J Harriman

Kapil Sood

Ioannis T Schoinas

Raghunandan Makaram

Reshma Lal

Ruby B Lee

Vedvyas Shanbhogue

Siddhartha Chhabra

Baiju V Patel

Ronald Perez

Matthew Eldon Hoekstra

Reouven Elbaz

Pramod Jamkhedkar

Wojciech S Powiertowski

Srikanth Varadarajan

In one embodiment, an apparatus comprises a processor to: receive a request to configure a secure execution environment for a first workload; configure a first set of secure execution enclaves for execution of the first workload, wherein the first set of secure execution enclaves is configured on a first set of processing resources, wherein the first set of processing resources comprises one or more central processing units and one or more accelerators; configure a first set of secure datapaths for communication among the first set of secure execution enclaves during execution of the first workload, wherein the first set of secure datapaths is configured over a first set of interconnect resources; configure the secure execution environment for the first workload, wherein the secure execution environment comprises the first set of secure execution enclaves and the first set of secure datapaths.

Composable trusted execution environments

First data is stored. A request for the first data is received from a communication device over a link established with a communication device. An access control engine comprising circuitry is to control access to the first data to the communication device based on an authentication state of the communication device and a protection state of the link.

Data release control based on authentication and link protection

A device includes a microcontroller, memory including secure memory to store a private key, a set of registers, and an authentication engine. The set of registers includes a write mailbox register and a read mailbox register, and message data is to be written to the write mailbox register by a host system. The message data includes at least a portion of a challenge request, and the challenge request includes a challenge by the host system to authenticity of the device. The authentication engine generates a response to the challenge, where the response includes data to identify attributes of the device and a signature generated using the private key. The authentication engine causes at least a portion of the response to be written to the read mailbox register to be read by the host system.

Device authentication

A protected link between a first computing device and a second computing device is set up, wherein communication over the protected link is to comply with a communication protocol that allows packets to be reordered during transit. A plurality of packets are generated according to a packet format that ensures the plurality of packets will not be reordered during transmission over the protected link, the plurality of packets comprising a first packet and a second packet. Data of the plurality of packets are encrypted for transmission over the protected link, wherein data of the first packet is encrypted based on the cryptographic key and a first value of a counter and data of the second packet is encrypted based on the cryptographic key and a second value of the counter.

Securing platform link with encryption

Composable trustworthy execution environments

Disclosed is a system comprising a physical memory, a processor and a software component. The software component includes a policy/domain handler for receiving data and a policy associated with the data; a hypervisor; and a file management module. The file management module receives a request from a third-party application to interact with a data file containing the data; sends an authorization and tag request to the policy/domain handler to check if the user and application are permitted to access the data, and if permitted, to generate hardware tags for the data file; and sends a secure data request to the hypervisor to create a secure data compartment for the data file and the hardware tags. Based on the authorization and tag request, and the security policy associated with the data, the policy/domain handler generates the hardware tags for the data file. Based on the secure data request, the hypervisor creates in the physical memory a secure data compartment containing the data file and the hardware tags, the hypervisor associating the hardware tags with the data in the secure data compartment. As the data is operated upon and moved to other memory areas, the hardware tags are propagated with the data according to tag propagation rules, and checked before performing operations that may lead to security breaches.

System and method for self-protecting data

A functional unit is provided which allows for fast, parallel data read, write, and manipulation operations. The functional unit includes first and second source registers for receiving first and second data items to be processed by the functional unit, a plurality of memory tables, a combinational logic circuit, and a decoder. Each of the tables is indexed by an index comprising a portion of the first data item received by the first source register. The combinational logic circuit receives lookup results, and processes the lookup results and the second data item in the second source register to produce a result data item. The decoder circuit extracts an operational code from an instruction supplied to the functional unit, decodes the operational code, and controls the combinational logic circuit in accordance with the operational code.

Parallel read functional unit for microprocessors

A functional unit for a microprocessor is provided, which allows for fast, parallel data read, write, and manipulation operations in the microprocessor that are useful for a number of software applications, such as cryptography. The functional unit includes first and second source registers for receiving first and second data items to be processed by the functional unit, first and second banks of memory tables, a combinational logic circuit, and a decoder. The first and second banks of memory tables are in communication with the first source register, and each of the tables is indexed by an index comprising a portion of the first data item received by the first source register. Each index points to a lookup result in a respective one of the memory tables. The combinational logic circuit is in communication with the first and second banks of memory tables and the second source register, receives the lookup results, and processes the lookup results and the second data item in the second source register to produce a result data item. The decoder circuit is in communication with the combinational logic circuit, and extracts an operational code from an instruction supplied to the functional unit, decodes the operational code, and controls the combinational logic circuit in accordance with the operational code.

Growing community of inventors

Chandler, AZ, United States of America

Yu-Yuan Chen