中科微点-全球专利检索

  1. Login
  2. Sign Up

Search Results

25 records (took 0.018 seconds)

    ISOLATION OF MEMORY REGIONS IN TRUSTED DOMAIN
    13.
    发明公开
    ISOLATION OF MEMORY REGIONS IN TRUSTED DOMAIN 审中-公开

    公开(公告)号：US20240070091A1

    公开(公告)日：2024-02-29

    申请号：US17822847

    申请日：2022-08-29

    Applicant: Intel Corporation

    Inventor： Pradeep Pappachan ,  Krystof Zmudzinski ,  Reshma Lal

    IPC: G06F12/14

    CPC classification number: G06F12/1441 ,  G06F12/1408 ,  G06F12/1458

    Abstract: An apparatus comprises a hardware processor to program a memory table for a trusted domain with a first device identifier associated with a device, a guest physical address (GPA) range associated with the device, and a guest physical address offset, receive a memory access request from the device, the memory access request comprising a second device identifier and a guest physical address, and validate the memory access request using the memory table.

    TECHNOLOGIES FOR FILTERING MEMORY ACCESS TRANSACTIONS RECEIVED FROM ONE OR MORE I/O DEVICES
    14.
    发明公开
    TECHNOLOGIES FOR FILTERING MEMORY ACCESS TRANSACTIONS RECEIVED FROM ONE OR MORE I/O DEVICES 审中-公开

    公开(公告)号：US20230297725A1

    公开(公告)日：2023-09-21

    申请号：US18200543

    申请日：2023-05-22

    Applicant: Intel Corporation

    Inventor： Luis Kida ,  Krystof Zmudzinski ,  Reshma Lal ,  Pradeep Pappachan ,  Abhishek Basak ,  Anna Trikalinou

    IPC: G06F21/78 ,  G06F21/44 ,  G06F21/85

    CPC classification number: G06F21/78 ,  G06F21/44 ,  G06F21/85

    Abstract: Technologies for secure I/O include a compute device having a processor, a memory, an input/output (I/O) device, and a filter logic. The filter logic is configured to receive a first key identifier from the processor, wherein the first key identifier is indicative of a shared memory range includes a shared key identifier range to be used for untrusted I/O devices and receive a transaction from the I/O device, wherein the transaction includes a second key identifier and a trust device ID indicator associated with the I/O device. The filter logic is further configured to determine whether the transaction is asserted with the trust device ID indicator indicative of whether the I/O device is assigned to a trust domain and determine, in response to a determination that the transaction is not asserted with the trust device ID indicator, whether the second key identifier matches the first key identifier.

    Mechanism to prevent software side channels
    15.
    发明授权
    Mechanism to prevent software side channels 有权

    公开(公告)号：US10970390B2

    公开(公告)日：2021-04-06

    申请号：US15897406

    申请日：2018-02-15

    Applicant: Intel Corporation

    Inventor： Francis McKeen ,  Bin Xing ,  Krystof Zmudzinski ,  Carlos Rozas ,  Mona Vij

    IPC: G06F21/55 ,  G06F21/53 ,  G06F12/14 ,  G06F21/74

    Abstract: A processor includes a processing core to identify a code comprising a plurality of instructions to be executed in the architecturally-protected environment, determine that a first physical memory page stored in the architecturally-protected memory matches a first virtual memory page referenced by a first instruction of the plurality of instructions, generate a first address mapping between a first address of the first virtual memory page and a second address of the first physical memory page, store, in the cache memory, the address translation data structure comprising the first address mapping, and execute the code by retrieving the first address mapping in the address translation data structures to be executed in the architecturally-protected environment, determine that a first physical memory page stored in the architecturally-protected memory matches a first virtual memory page referenced by a first instruction of the plurality of instructions, generate a first address mapping between a first address of the first virtual memory page and a second address of the first physical memory page, store, in the cache memory, an address translation data structure comprising the first address mapping, and execute the code by retrieving the first address mapping stored in the address translation data structure.

    EMPLOYING INTERMEDIARY STRUCTURES FOR FACILITATING ACCESS TO SECURE MEMORY
    17.
    发明申请
    EMPLOYING INTERMEDIARY STRUCTURES FOR FACILITATING ACCESS TO SECURE MEMORY 审中-公开
    采用中间结构，促进访问安全存储

    公开(公告)号：US20150370628A1

    公开(公告)日：2015-12-24

    申请号：US14312112

    申请日：2014-06-23

    Applicant: Intel Corporation

    Inventor： Krystof Zmudzinski

    IPC: G06F11/10 ,  G06F12/14 ,  G06F12/08 ,  G06F12/10 ,  G06F12/12

    Abstract: The present application is directed to employing intermediary structures for facilitating access to secure memory. A secure driver (SD) may be loaded into the device to reserve a least a section of memory in the device as a secure page cache (SPC). The SPC may protect application data from being accessed by other active applications in the device. Potential race conditions may be avoided through the use of a linear address manager (LAM) that maps linear addresses (LAs) in an application page table (PT) to page slots in the SPC. The SD may also facilitate error handling in the device by reconfiguring VEs that would otherwise be ignored by the OS.

    Abstract translation: 本申请涉及采用中间结构以便于访问安全存储器。 可以将安全驱动程序（SD）加载到设备中以将设备中的至少一部分存储器保留为安全页面缓存（SPC）。 SPC可以保护应用程序数据免受设备中其他活动应用程序的访问。 可以通过使用将应用页表（PT）中的线性地址（LAs）映射到SPC中的页时隙的线性地址管理器（LAM）来避免潜在竞争条件。 SD还可以通过重新配置否则将被OS忽略的VE来促进设备中的错误处理。

    HIGH PERFORMANCE SECURE IO
    18.
    发明公开
    HIGH PERFORMANCE SECURE IO 审中-公开

    公开(公告)号：US20240073013A1

    公开(公告)日：2024-02-29

    申请号：US17823220

    申请日：2022-08-30

    Applicant: Intel Corporation

    Inventor： Reshma Lal ,  Krystof Zmudzinski

    IPC: H04L9/08 ,  G06F12/14

    CPC classification number: H04L9/0866 ,  G06F12/1408 ,  G06F12/1441 ,  H04L9/0825

    Abstract: An apparatus comprises a hardware processor to perform an attestation procedure to attest a remote device, establish a session key for a communication session with the remote device, define a linear address (LA) region outside an established address range for a secure enclave, generate, for the linear address (LA) region, a unique encryption key accessible only to the enclave, assign a key identifier to the unique encryption key, store the linear address (LA) region and the unique encryption key in an enclave control structure, set a pending bit in the enclave control structure to a value to indicate that contents of the linear address region cannot be changed without approval from the secure enclave, clear the pending bit to indicate that the linear address range is available for use by the enclave, wrap the key identifier and the unique encryption key with the session key, and send the key identifier and the unique encryption key to the remote device.

    TECHNOLOGIES FOR FILTERING MEMORY ACCESS TRANSACTIONS RECEIVED FROM ONE OR MORE I/O DEVICES
    20.
    发明申请
    TECHNOLOGIES FOR FILTERING MEMORY ACCESS TRANSACTIONS RECEIVED FROM ONE OR MORE I/O DEVICES 有权

    公开(公告)号：US20220092223A1

    公开(公告)日：2022-03-24

    申请号：US17515092

    申请日：2021-10-29

    Applicant: Intel Corporation

    Inventor： Luis Kida ,  Krystof Zmudzinski ,  Reshma Lal ,  Pradeep Pappachan ,  Abhishek Basak ,  Anna Trikalinou

    IPC: G06F21/78 ,  G06F21/44 ,  G06F21/85

    Abstract: Technologies for secure I/O include a compute device having a processor, a memory, an input/output (I/O) device, and a filter logic. The filter logic is configured to receive a first key identifier from the processor, wherein the first key identifier is indicative of a shared memory range includes a shared key identifier range to be used for untrusted I/O devices and receive a transaction from the I/O device, wherein the transaction includes a second key identifier and a trust device ID indicator associated with the I/O device. The filter logic is further configured to determine whether the transaction is asserted with the trust device ID indicator indicative of whether the I/O device is assigned to a trust domain and determine, in response to a determination that the transaction is not asserted with the trust device ID indicator, whether the second key identifier matches the first key identifier.

Patent Agency Ranking