CONCURRENT VOLUME AND FILE BASED INLINE ENCRYPTION ON COMMODITY OPERATING SYSTEMS

    公开(公告)号:US20210319121A1

    公开(公告)日:2021-10-14

    申请号:US17358526

    申请日:2021-06-25

    Abstract: The disclosure generally relates to method, system and apparatus for concurrent volume and file based inline encryption on commodity operating systems (OS). More particularly, some embodiments of the disclosure relate to a Converged Cryptographic Engine (CCE) for storage encryption. An exemplary method for implementing non-disruptive inline encryption of a read/write transaction on a non-volatile memory (NVM) circuitry includes the steps of: generating one or more encryption keys for the read/write transaction on a storage volume of the NVM circuitry at a Setup logic; identifying a plurality of Logical Block Addresses (LBAs) corresponding to the storage volume for the read/write transaction at an NTFS logic; and, at a Storage encryption system logic: (1) receiving the plurality of LBAs and their corresponding storage volume from the NTFS, (2) identifying the storage volume on the NVM storage circuitry for the read/write transaction, (3) identifying the one or more encryption keys for the identified storage volume, (4) assigning a keyId to the identified encryption key, and (5) programming the KeyId on to the NVM circuitry.

    Enforcing secure display view for trusted transactions

    公开(公告)号:US10810327B2

    公开(公告)日:2020-10-20

    申请号:US15863593

    申请日:2018-01-05

    Abstract: In embodiments, an apparatus to enforce secure display view for trusted transactions may include a first input interface to receive from an application, via a trusted execution environment (TEE), viewport size data and an identifier of a display associated with a secure display of a trusted transaction; and a second input interface to receive from the application, via an untrusted execution environment, an encrypted transaction bitmap associated with the trusted transaction, to be securely displayed on the display; and an enforcement engine coupled to the first input interface and the second input interface, to verify that the size and location of the transaction bitmap are within the viewport to ensure the secure display of the transaction bitmap. In embodiments, after verification of the size and location of the transaction bitmap being within the viewport, the transaction bitmap may be displayed.

    FIRMWARE VERIFICATION MECHANISM
    14.
    发明申请

    公开(公告)号:US20200226261A1

    公开(公告)日:2020-07-16

    申请号:US16832152

    申请日:2020-03-27

    Abstract: An apparatus to verify firmware in a computing system, comprising a non-volatile memory, including firmware memory to store agent firmware associated with each of a plurality of interconnect protocol (IP) agents and version memory to store security version numbers (SVNs) included in the agent firmware, a security controller comprising verifier logic to verify an integrity of the version memory by applying a hash algorithm to contents of the version memory to generate a SVN hash, and a trusted platform module (TPM) to store the SVN hash.

    Technologies for a memory encryption engine for multiple processor usages

    公开(公告)号:US10565130B2

    公开(公告)日:2020-02-18

    申请号:US15714323

    申请日:2017-09-25

    Abstract: Technologies for secure memory usage include a computing device having a processor that includes a memory encryption engine and a memory device coupled to the processor. The processor supports multiple processor usages, such as secure enclaves, system management firmware, and a virtual machine monitor. The memory encryption engine is configured to protect a memory region stored in the memory device for a processor usage. The memory encryption engine restricts access to one or more configuration registers to a trusted code base of the processor usage. The processor executes the processor usage and the memory encryption engine protects contents of the memory region during execution. The memory encryption engine may access integrity metadata based on the address of the protected memory region. The memory encryption engine may prepare top-level counter metadata for entering a low-power state. Other embodiments are described and claimed.

Patent Agency Ranking