公开(公告)号：US09483662B2

公开(公告)日：2016-11-01

申请号：US14723925

申请日：2015-05-28

Applicant: INTEL CORPORATION

Inventor： Vincent R. Scarlata

IPC: G06F21/72 ,  G06F21/57 ,  H04L29/06 ,  G06F9/455 ,  G06F21/00 ,  H04L9/08 ,  G06F21/60 ,  H04L29/08

CPC classification number: G06F21/72 ,  G06F9/45533 ,  G06F9/45558 ,  G06F21/00 ,  G06F21/57 ,  G06F21/602 ,  G06F2009/4557 ,  G06F2009/45583 ,  G06F2009/45595 ,  H04L9/08 ,  H04L9/0825 ,  H04L9/0897 ,  H04L63/0428 ,  H04L67/10

Abstract: A virtual security coprocessor is created in a first processing system. The virtual security coprocessor is then transferred to a second processing system, for use by the second processing system. For instance, the second processing system may use the virtual security coprocessor to provide attestation for the second processing system. In an alternative embodiment, a virtual security coprocessor from a first processing system is received at a second processing system. After receiving the virtual security coprocessor from the first processing system, the second processing system uses the virtual security coprocessor. Other embodiments are described and claimed.

公开(公告)号：US20160202976A1

公开(公告)日：2016-07-14

申请号：US15074573

申请日：2016-03-18

Applicant: Intel Corporation

Inventor： Rebekah Leslie-Hurd ,  Carlos V. Rozas ,  Vincent R. Scarlata ,  Simon P. Johnson ,  Uday R. Savagaonkar ,  Barry E. Huntley ,  Vedvyas Shanbhogue ,  Ittai Anati ,  Francis X. Mckeen ,  Michael A. Goldsmith ,  Ilya Alexandrovich ,  Alex Berenzon ,  Wesley H. Smith ,  Gilbert Neiger

IPC: G06F9/30 ,  G06F12/08

CPC classification number: G06F9/3004 ,  G06F9/30047 ,  G06F9/30076 ,  G06F9/44 ,  G06F12/084 ,  G06F12/0875 ,  G06F12/1483 ,  G06F2212/452

Abstract: Embodiments of an invention for memory management in secure enclaves are disclosed. In one embodiment, a processor includes an instruction unit and an execution unit. The instruction unit is to receive a first instruction and a second instruction. The execution unit is to execute the first instruction, wherein execution of the first instruction includes allocating a page in an enclave page cache to a secure enclave. The execution unit is also to execute the second instruction, wherein execution of the second instruction includes confirming the allocation of the page.

Abstract translation: 公开了用于安全飞行器中的存储器管理的发明的实施例。 在一个实施例中，处理器包括指令单元和执行单元。 指令单元接收第一指令和第二指令。 执行单元执行第一指令，其中第一指令的执行包括将飞地页面缓存中的页面分配到安全飞地。 执行单元还执行第二指令，其中第二指令的执行包括确认页的分配。

公开(公告)号：US09298948B2

公开(公告)日：2016-03-29

申请号：US14600182

申请日：2015-01-20

Applicant: INTEL CORPORATION

Inventor： Vincent R. Scarlata

IPC: G06F21/72 ,  G06F21/57 ,  H04L29/06 ,  G06F9/455 ,  G06F21/00 ,  H04L9/08 ,  G06F21/60 ,  H04L29/08

CPC classification number: G06F21/72 ,  G06F9/45533 ,  G06F9/45558 ,  G06F21/00 ,  G06F21/57 ,  G06F21/602 ,  G06F2009/4557 ,  G06F2009/45583 ,  G06F2009/45595 ,  H04L9/08 ,  H04L9/0825 ,  H04L9/0897 ,  H04L63/0428 ,  H04L67/10

Abstract: A virtual security coprocessor is created in a first processing system. The virtual security coprocessor is then transferred to a second processing system, for use by the second processing system. For instance, the second processing system may use the virtual security coprocessor to provide attestation for the second processing system. In an alternative embodiment, a virtual security coprocessor from a first processing system is received at a second processing system. After receiving the virtual security coprocessor from the first processing system, the second processing system uses the virtual security coprocessor. Other embodiments are described and claimed.

公开(公告)号：US20150261978A1

公开(公告)日：2015-09-17

申请号：US14723937

申请日：2015-05-28

Applicant: INTEL CORPORATION

Inventor： Vincent R. Scarlata

IPC: G06F21/72 ,  H04L9/08 ,  G06F9/455

CPC classification number: G06F21/72 ,  G06F9/45533 ,  G06F9/45558 ,  G06F21/00 ,  G06F21/57 ,  G06F21/602 ,  G06F2009/4557 ,  G06F2009/45583 ,  G06F2009/45595 ,  H04L9/08 ,  H04L9/0825 ,  H04L9/0897 ,  H04L63/0428 ,  H04L67/10

Abstract: A virtual security coprocessor is created in a first processing system. The virtual security coprocessor is then transferred to a second processing system, for use by the second processing system. For instance, the second processing system may use the virtual security coprocessor to provide attestation for the second processing system. In an alternative embodiment, a virtual security coprocessor from a first processing system is received at a second processing system. After receiving the virtual security coprocessor from the first processing system, the second processing system uses the virtual security coprocessor. Other embodiments are described and claimed.

公开(公告)号：US09059855B2

公开(公告)日：2015-06-16

申请号：US13843954

申请日：2013-03-15

Applicant: Intel Corporation

Inventor： Simon P. Johnson ,  Vincent R. Scarlata ,  Willard M. Wiseman

IPC: G06F21/00 ,  H04L9/32 ,  G06F21/10 ,  G06F21/57

CPC classification number: G06F21/71 ,  G06F21/10 ,  G06F21/57 ,  G06F2221/0748 ,  G06F2221/0797 ,  H04L9/3234

Abstract: An apparatus and method are described for implementing a trusted dynamic launch and trusted platform module (TPM) using a secure enclave. For example, a computer-implemented method according to one embodiment of the invention comprises: initializing a secure enclave in response to a first command, the secure enclave comprising a trusted software execution environment which prevents software executing outside the enclave from having access to software and data inside the enclave; and executing a trusted platform module (TPM) from within the secure enclave, the trusted platform module securely reading data from a set of platform control registers (PCR) in a processor or chipset component into a memory region allocated to the secure enclave.

Abstract translation: 描述了使用安全飞地实现可信的动态发射和可信平台模块（TPM）的装置和方法。 例如，根据本发明的一个实施例的计算机实现的方法包括：响应于第一命令初始化安全飞地，所述安全飞地包括可信软件执行环境，其防止在飞地之外执行的软件访问软件，以及 飞地内的数据; 以及从所述安全飞地内执行可信平台模块（TPM），所述可信平台模块将处理器或芯片组组件中的一组平台控制寄存器（PCR）中的数据安全地读取到分配给所述安全飞地的存储器区域中。