摘要:
In an embodiment of the present invention, a technique is provided for remote attestation. An interface maps a device via a bus to an address space of a chipset in a secure environment for an isolated execution mode. The secure environment is associated with an isolated memory area accessible by at least one processor. The at least one processor operates in one of a normal execution mode and the isolated execution mode. A communication storage corresponding to the address space allows the device to exchange security information with the at least one processor in the isolated execution mode in a remote attestation.
摘要:
A processor executive (PE) handles an operating system executive (OSE) in a secure environment. The secure environment has a fused key (FK) and is associated with an isolated memory area in the platform. The OSE manages a subset of an operating system (OS) running on the platform. The platform has a processor operating in one of a normal execution mode and an isolated execution mode. The isolated memory area is accessible to the processor in the isolated execution mode. A PE supplement supplements the PE with a PE manifest representing the PE and a PE identifier to identify the PE. A PE handler handles the PE using the FK and the PE supplement.
摘要:
A processor executive (PE) handles an operating system executive (OSE) in a secure environment. The secure environment has a platform key (PK) and is associated with an isolated memory area in the platform. The OSE manages a subset of an operating system (OS) running on the platform. The platform has a processor operating in one of a normal execution mode and an isolated execution mode. The isolated memory area is accessible to the processor in the isolated execution mode. A PE supplement supplements the PE with a PE manifest representing the PE and a PE identifier to identify the PE. A PE handler handles the PE using the PK and the PE supplement.
摘要:
The present invention provides a method, apparatus, and system for invoking a reset process in response to a processor being individually reset. The reset processor operates within a platform in an isolated execution mode and is associated with an isolated area of memory. An initialization process is invoked for an initializing processor. The initialization process determines whether or not a cleanup flag is set. If the cleanup flag is set, the isolated area of memory is scrubbed. In one embodiment, when a last processor operating in the platform is reset, it is reset without clearing the cleanup flag. Subsequently, an initializing processor invokes the initialization process. The initialization process determines that the cleanup flag is set. The initialization process invokes the execution of a processor nub loader. If the cleanup flag is set, the processor nub loader scrubs the isolated area of memory and invokes a controlled close for the initializing processor. The controlled close clears the cleanup flag. The initializing processor then re-performs the initialization process. Upon the second iteration of the initialization process, with the cleanup flag not set, a new isolated area of memory is created for the initializing processor.
摘要:
A hierarchical cache memory includes a high-speed primary cache memory and a lower speed secondary cache memory of greater storage capacity than the primary cache memory. To manage a huge number of data lines interconnecting the primary and secondary cache memories, the hierarchical cache memory is integrated on a plurality of integrated circuits which include all of the interconnecting data lines. Each integrated circuit includes a primary memory and a secondary memory for storing and retrieving data transferred over a first data input line and a first data output line that link the primary memory to a central processing unit. At any given time, a multi-bit word is addressed in the secondary memory, and a corresponding multi-bit word is addressed in the primary memory. The primary and secondary memories are interconnected by a first multi-line bus for transferring a multi-bit word read from the secondary memory to the primary memory, and by a second multi-line bus for transferring a multi-bit word read from the primary memory to the secondary memory. The secondary memory is linked to a main memory by a second data output line and a second data input line for sequential transmission of bits to exchange multi-bit words during a writeback and refill operation. In a preferred embodiment, data inputs of the primary memory and the secondary memory are wired in parallel to a serial-parallel shift register that is used as a common write buffer.
摘要:
To execute variable-length instructions independently of instruction preprocessing, a central processing unit is provided with a set of queues in the data and control paths between an instruction unit and an execution unit. The queues include a "fork" queue, a source queue, a destination queue, and a program counter queue. The fork queue contains an entry of control information for each instruction processed by the instruction unit. This control information corresponds to the opcode for the instruction, and preferably it is a microcode "fork" address at which a microcode execution unit begins execution to execute the instruction. The source queue specifies the source operands for the instruction. Preferably the source queue stores source pointers and the operands themselves are included in a separate "source list" in the case of operands fetched from memory or immediate data from the instruction stream, or are the contents of a set of general purpose registers in the execution unit. The destination queue specifies the destination for the instruction, for example, either memory or general purpose registers. The program counter queue contains the starting value of the program counter for each of the instructions passed from the instruction unit to the execution unit. Preferably the queues are large enough to hold control information and data for up to six instructions. The queues therefore shield the execution unit and the instruction unit from each others complexities and provide a buffer to allow for an uneven processing rate in either of them.
摘要:
A processor implementing techniques for supporting configurable security levels for memory address ranges is disclosed. In one embodiment, the processor includes a processing core a memory controller, operatively coupled to the processing core, to access data in an off-chip memory and a memory encryption engine (MEE) operatively coupled to the memory controller. The MEE is to responsive to detecting a memory access operation with respect to a memory location identified by a memory address within a memory address range associated with the off-chip memory, identify a security level indicator associated with the memory location based on a value stored on a security range register. The MEE is further to access at least a portion of a data item associated with the memory address range of the off-chip memory in view of the security level indicator.
摘要:
Instructions and logic provide advanced paging capabilities for secure enclave page caches. Embodiments include multiple hardware threads or processing cores, a cache to store secure data for a shared page address allocated to a secure enclave accessible by the hardware threads. A decode stage decodes a first instruction specifying said shared page address as an operand, and execution units mark an entry corresponding to an enclave page cache mapping for the shared page address to block creation of a new translation for either of said first or second hardware threads to access the shared page. A second instruction is decoded for execution, the second instruction specifying said secure enclave as an operand, and execution units record hardware threads currently accessing secure data in the enclave page cache corresponding to the secure enclave, and decrement the recorded number of hardware threads when any of the hardware threads exits the secure enclave.
摘要:
A method and apparatus to provide cryptographic integrity checks and replay protection to protect against hardware attacks on system memory is provided. A mode of operation for block ciphers enhances the standard XTS-AES mode of operation to perform memory encryption by extending a tweak to include a “time stamp” indicator. A tree-based replay protection scheme uses standard XTS-AES to encrypt contents of a cache line in the system memory. A Message-Authentication Code (MAC) for the cache line is encrypted using enhanced XTS-AES and a “time stamp” indicator associated with the cache line. The “time stamp indicator” is stored in a processor.
摘要:
A technique to enable secure application and data integrity within a computer system. In one embodiment, one or more secure enclaves are established in which an application and data may be stored and executed.