公开(公告)号：US20190042369A1

公开(公告)日：2019-02-07

申请号：US16133574

申请日：2018-09-17

Applicant: Intel Corporation

Inventor： Sergej Deutsch ,  Wei Wu ,  David M. Durham ,  Karanvir S. Grewal

IPC: G06F11/14 ,  G06F11/10 ,  G06F3/06

Abstract: In one embodiment, an apparatus comprises a controller comprising circuitry, the controller to generate an error correction code for a memory line, the memory line comprising a plurality of first data blocks, wherein the error correction code comprises parity bits generated based on first portions of a plurality of second data blocks, wherein the plurality of second data blocks are the first data blocks or diffused data blocks generated from the plurality of first data blocks; generate a metadata block corresponding to the memory line, wherein the metadata block comprises the error correction code for the memory line and at least one metadata bit; encode the first data blocks and the metadata block; and provide the encoded data blocks and the encoded metadata block for storage on a memory module.

公开(公告)号：US10152430B2

公开(公告)日：2018-12-11

申请号：US15727810

申请日：2017-10-09

Applicant: Intel Corporation

Inventor： David M. Durham ,  Baiju Patel

IPC: G06F12/14 ,  G06F21/72 ,  G06F21/55 ,  H04L29/06

Abstract: A computing device includes technologies for securing indirect addresses (e.g., pointers) that are used by a processor to perform memory access (e.g., read/write/execute) operations. The computing device encodes the indirect address using metadata and a cryptographic algorithm. The metadata may be stored in an unused portion of the indirect address.

公开(公告)号：US10025956B2

公开(公告)日：2018-07-17

申请号：US14975588

申请日：2015-12-18

Applicant: Intel Corporation

Inventor： Abhishek Basak ,  Siddhartha Chhabra ,  Jungju Oh ,  David M. Durham

IPC: G06F21/79 ,  G06F3/06 ,  G06F12/0891 ,  G06F12/123 ,  G06F12/14 ,  H04L9/06

Abstract: Examples include techniques for compressing counter values included in cryptographic metadata. In some examples, a cache line to fill a cache included in on-die processor memory may be received. The cache arranged to store cryptographic metadata. The cache line includes a counter value generated by a counter. The counter value to serve as version information for a memory encryption scheme to write a data cache line to a memory location of an off-die memory. In some examples, the counter value is compressed based on whether the counter value includes a pattern that matches a given pattern and is then stored to the cache. In some examples, a compression aware and last recently used (LRU) scheme is used to determine whether to evict cryptographic metadata from the cache.

公开(公告)号：US20180082057A1

公开(公告)日：2018-03-22

申请号：US15273286

申请日：2016-09-22

Applicant: Intel Corporation

Inventor： Michael LeMay ,  David M. Durham ,  Ravi L. Sahita

IPC: G06F21/54

CPC classification number: G06F21/54 ,  G06F21/53 ,  G06F2221/033

Abstract: Technologies are provided in embodiments to provide access control for applications in a computing environment. Particular embodiments are configured to identify a code region of a code segment in an application, determine a resource to be allocated to the code region, and prior to the application execution, authorize the code region to access the resource during an execution of the code region. In specific embodiments, authorizing the code region includes embedding at least one token in the code region. In other specific embodiments, authorizing the code region includes associating an identity of the code region with the resource. In further embodiments, when the compiled application is executed, a segment load instruction associated with the resource is to attempt to verify the code region is authorized to access the resource, and allow execution of the code region based, at least in part, on the verification.

公开(公告)号：US20180018288A1

公开(公告)日：2018-01-18

申请号：US15209955

申请日：2016-07-14

Applicant: Intel Corporation

Inventor： Prashant Dewan ,  Siddhartha Chhabra ,  David M. Durham ,  Karanvir S. Grewal ,  Alpa T. Narendra Trivedi

IPC: G06F12/14 ,  G06F3/06 ,  G06F21/60 ,  G06F21/10 ,  G06F21/62

CPC classification number: G06F12/1416 ,  G06F3/0622 ,  G06F3/0637 ,  G06F3/0673 ,  G06F21/10 ,  G06F21/602 ,  G06F21/6218 ,  G06F21/74 ,  G06F2212/1052 ,  G06F2221/2107

Abstract: In one embodiment, an apparatus includes: at least one core to execute instructions, the at least one core formed on a semiconductor die; a first memory formed on the semiconductor die, the first memory comprising a non-volatile random access memory, the first memory to store a first entry to be a monotonic counter, the first entry including a value field and a status field; and a control circuit, wherein the control circuit is to enable access to the first entry if the apparatus is in a secure mode and otherwise prevent the access to the first entry. Other embodiments are described and claimed.

公开(公告)号：US09792229B2

公开(公告)日：2017-10-17

申请号：US14669226

申请日：2015-03-27

Applicant: Intel Corporation

Inventor： Eugene M. Kishinevsky ,  Siddhartha Chhabra ,  Men Long ,  Jungju Oh ,  David M. Durham

IPC: H04L29/06 ,  G06F12/14 ,  G06F21/00

CPC classification number: G06F12/1408 ,  G06F21/00 ,  G06F2212/1052

Abstract: In an embodiment, a processor includes: at least one core to execute instructions; and a memory protection logic to encrypt data to be stored to a memory coupled to the processor, generate a message authentication code (MAC) based on the encrypted data, the MAC to have a first value according to a first key, obtain the encrypted data from the memory and validate the encrypted data using the MAC, where the MAC is to be re-keyed to have a second value according to a second key and without the encrypted data. Other embodiments are described and claimed.

公开(公告)号：US09753863B2

公开(公告)日：2017-09-05

申请号：US14583681

申请日：2014-12-27

Applicant: Intel Corporation

Inventor： Rekha N. Bachwani ,  Ravi L. Sahita ,  David M. Durham

IPC: G06F12/10 ,  G06F12/14

CPC classification number: G06F12/14 ,  G06F12/10 ,  G06F12/1408 ,  G06F12/1441 ,  G06F2212/1052 ,  G06F2212/657

Abstract: A method includes, in various implementations, regulating a memory region for execute-only access, storing a set of instructions in the memory region, executing an early instruction among the set of instructions, and executing a set of subsequent instructions among the instructions. The early instruction loads a secret value into a volatile register. A correct execution of the subsequent instructions depends on the secret value being loaded into the volatile register.A system includes, in various implementations, a memory and a processor with one or more volatile registers. The processor regulates access to portions of the memory. The processor can load a secret value into the volatile register in response to executing a program stored in an execute-only portion of the memory. The processor is configured to lose, in response to an asynchronous event, information loaded in the volatile registers.

公开(公告)号：US09712527B2

公开(公告)日：2017-07-18

申请号：US15154399

申请日：2016-05-13

Applicant: Intel Corporation

Inventor： Michelle H. Chuaprasert ,  David M. Durham ,  Mark D. Boucher ,  Sanjay Bakshi

IPC: G06F21/00 ,  H04L29/06 ,  G06Q30/02 ,  G06Q10/10 ,  G06F21/35 ,  H04L29/08

CPC classification number: H04L63/0876 ,  G06F21/35 ,  G06Q10/10 ,  G06Q30/02 ,  H04L67/306

Abstract: An embodiment includes a main compute node that detects the physical presence of a first user and subsequently loads a profile for the first user. The main compute node may detect the first user's presence based on detecting a first compute node corresponding to the first user. For example, the main compute node may be a desktop computer that detects the presence of the first user's Smart phone, which is nearby the first user. The main compute node may unload the first user's profile when the main compute node no longer detects the first user's presence. Upon detecting a second user's presence, the main computer may load a profile for the second user. The profile may include cookies and/or other identifiers for the second user. The profile may facilitate the second user's navigation of a computing environment (e.g. web pages). Other embodiments are addressed herein.

公开(公告)号：US09710393B2

公开(公告)日：2017-07-18

申请号：US14750982

申请日：2015-06-25

Applicant: Intel Corporation

Inventor： Michael Lemay ,  David M. Durham ,  Andrew V. Anderson ,  Gilbert Neiger ,  Ravi L. Sahita

IPC: G06F12/00 ,  G06F12/1009 ,  G06F12/1027 ,  G06F12/14 ,  G06F9/455 ,  G06F21/00

CPC classification number: G06F12/1009 ,  G06F9/45533 ,  G06F9/45558 ,  G06F12/1027 ,  G06F12/1483 ,  G06F21/00 ,  G06F21/53 ,  G06F2009/45583 ,  G06F2009/45587 ,  G06F2212/1024 ,  G06F2212/1052 ,  G06F2212/151 ,  G06F2212/651 ,  G06F2212/657 ,  G06F2212/68 ,  G06F2221/2141

Abstract: Generally, this disclosure provides systems, methods and computer readable media for a page table edit controller configured to control access to guest page tables by virtual machine (VM) guest software through the manipulation of extended page tables. The system may include a translation look-aside buffer (TLB) to maintain a policy to lock one or more guest linear addresses (GLAs) to one or more allowable guest physical addresses (GPAs); a page walk processor to update the TLB based on the guest page tables; and a page table edit control (PTEC) module to: identify entries of the guest page tables that map GLAs associated with the policy to a first GPA; verify that the mapping conforms to the policy; and place the guest page table into one of a plurality of restricted accessibility states based on the verification, the restricted accessibility applied to the VM guests and to the page walk processor.

公开(公告)号：US20170171194A1

公开(公告)日：2017-06-15

申请号：US14968447

申请日：2015-12-14

Applicant: Intel Corporation

Inventor： David M. Durham ,  Siddhartha Chhabra

IPC: H04L29/06 ,  G06F12/14 ,  H04L9/32 ,  G06F13/28

CPC classification number: H04L63/0853 ,  G06F12/1408 ,  G06F13/28 ,  G06F21/85 ,  G06F2212/1052 ,  H04L9/0637 ,  H04L9/3234 ,  H04L63/123

Abstract: Various configurations and techniques for enabling bidirectional cryptographic input output (IO) operations with an IO device of a computing system are disclosed herein. In an example, electronic operations of a computing system to enable a secure direct memory access (DMA) transaction including writing information to enable the secure DMA transaction to memory, reading and verifying the information from memory, performing encryption of data from the IO device using the information from memory, and writing encrypted secure data for the secure DMA transaction to the memory. In a further example, the information to enable the secure DMA transaction may include a counter value written by authorized software, and encrypting the secure data using the counter value, to prevent replay of the secure encrypted data by software other than the authorized software.