公开(公告)号：US20170337145A1

公开(公告)日：2017-11-23

申请号：US15612845

申请日：2017-06-02

Applicant: INTEL CORPORATION

Inventor： Carlos V. Rozas ,  Ilya Alexandrovich ,  Gilbert Neiger ,  Francis X. McKeen ,  Ittai Anati ,  Vedvyas Shanbhogue ,  Shay Gueron

IPC: G06F13/24 ,  G06F12/0806 ,  G06F21/00 ,  G06F21/85 ,  G06F12/08 ,  G06F21/71 ,  G06F12/0875

CPC classification number: G06F13/24 ,  G06F12/08 ,  G06F12/0806 ,  G06F12/0875 ,  G06F21/00 ,  G06F21/71 ,  G06F21/85 ,  G06F2212/1024 ,  G06F2212/1052 ,  G06F2212/62

Abstract: Instructions and logic interrupt and resume paging in secure enclaves. Embodiments include instructions, specify page addresses allocated to a secure enclave, the instructions are decoded for execution by a processor. The processor includes an enclave page cache to store secure data in a first cache line and in a last cache line for a page corresponding to the page address. A page state is read from the first or last cache line for the page when an entry in an enclave page cache mapping for the page indicates only a partial page is stored in the enclave page cache. The entry for a partial page may be set, and a new page state may be recorded in the first cache line when writing-back, or in the last cache line when loading the page when the instruction's execution is being interrupted. Thus the writing-back, or loading can be resumed.

公开(公告)号：US09747102B2

公开(公告)日：2017-08-29

申请号：US13729371

申请日：2012-12-28

Applicant: Intel Corporation

Inventor： Rebekah Leslie ,  Carlos V. Rozas ,  Vincent R. Scarlata ,  Simon P. Johnson ,  Uday R. Savagaonkar ,  Barry E. Huntley ,  Vedvyas Shanbhogue ,  Ittai Anati ,  Francis X. Mckeen ,  Michael A. Goldsmith ,  Ilya Alexandrovich ,  Alex Berenzon ,  Wesley H. Smith ,  Gilbert G. Neiger

IPC: G06F12/00 ,  G06F9/30 ,  G06F9/44 ,  G06F12/084 ,  G06F12/14

CPC classification number: G06F9/3004 ,  G06F9/30047 ,  G06F9/30076 ,  G06F9/44 ,  G06F12/084 ,  G06F12/0875 ,  G06F12/1483 ,  G06F2212/452

Abstract: Embodiments of an invention for memory management in secure enclaves are disclosed. In one embodiment, a processor includes an instruction unit and an execution unit. The instruction unit is to receive a first instruction and a second instruction. The execution unit is to execute the first instruction, wherein execution of the first instruction includes allocating a page in an enclave page cache to a secure enclave. The execution unit is also to execute the second instruction, wherein execution of the second instruction includes confirming the allocation of the page.

公开(公告)号：US09703733B2

公开(公告)日：2017-07-11

申请号：US14318508

申请日：2014-06-27

Applicant: Intel Corporation

Inventor： Carlos V. Rozas ,  Ilya Alexandrovich ,  Gilbert Neiger ,  Francis X. McKeen ,  Ittai Anati ,  Vedvyas Shanbhogue ,  Shay Gueron

IPC: G06F12/00 ,  G06F13/24 ,  G06F12/0806 ,  G06F12/08 ,  G06F12/0875 ,  G06F21/00 ,  G06F21/71 ,  G06F21/85

CPC classification number: G06F13/24 ,  G06F12/08 ,  G06F12/0806 ,  G06F12/0875 ,  G06F21/00 ,  G06F21/71 ,  G06F21/85 ,  G06F2212/1024 ,  G06F2212/1052 ,  G06F2212/62

Abstract: Instructions and logic interrupt and resume paging in secure enclaves. Embodiments include instructions, specify page addresses allocated to a secure enclave, the instructions are decoded for execution by a processor. The processor includes an enclave page cache to store secure data in a first cache line and in a last cache line for a page corresponding to the page address. A page state is read from the first or last cache line for the page when an entry in an enclave page cache mapping for the page indicates only a partial page is stored in the enclave page cache. The entry for a partial page may be set, and a new page state may be recorded in the first cache line when writing-back, or in the last cache line when loading the page when the instruction's execution is being interrupted. Thus the writing-back, or loading can be resumed.

公开(公告)号：US09698989B2

公开(公告)日：2017-07-04

申请号：US13949213

申请日：2013-07-23

Applicant: Intel Corporation

Inventor： Vincent Scarlata ,  Carlos Rozas ,  Simon Johnson ,  Uday Savagaonkar ,  Ittai Anati ,  Francis McKeen ,  Michael Goldsmith

IPC: H04L9/32 ,  G06F21/12 ,  G06F21/53

CPC classification number: H04L9/3213 ,  G06F21/12 ,  G06F21/53 ,  H04L9/3263

Abstract: Embodiments of an invention for feature licensing in a secure processing environment are disclosed. In one embodiment, a processor includes an instruction unit and an execution unit. The instruction unit is to receive an instruction to initialize a secure enclave. The execution unit is to execute the instruction. Execution of the instruction includes determining whether a requested feature is licensed for use in the secure enclave.

公开(公告)号：US09183161B2

公开(公告)日：2015-11-10

申请号：US13730563

申请日：2012-12-28

Applicant: Intel Corporation

Inventor： Gur Hildesheim ,  Ittai Anati ,  Hisham Shafi ,  Shlomo Raikin ,  Gideon Gerzon ,  Uday R Savagaonkar ,  Carlos V Rozas ,  Francis X McKeen ,  Michael A Goldsmith ,  Dewan Prashant

IPC: G06F12/14 ,  G06F21/53 ,  G06F12/08 ,  G06F12/10

CPC classification number: G06F12/145 ,  G06F12/084 ,  G06F12/1027 ,  G06F12/1483 ,  G06F21/53

Abstract: An apparatus and method for managing a protection table by a processor. For example, a processor according to one embodiment of the invention comprises: protection table management logic to manage a protection table, the protection table having an entry for each protected page or each group of protected pages in memory; wherein the protection table management logic prevents direct access to the protection table by user application program code and operating system program code but permits direct access by the processor.

Abstract translation: 一种用于由处理器管理保护表的装置和方法。 例如，根据本发明的一个实施例的处理器包括：保护表管理逻辑以管理保护表，所述保护表具有用于每个受保护页面的条目或存储器中每组受保护页面; 其中保护表管理逻辑防止用户应用程序代码和操作系统程序代码直接访问保护表，但允许处理器直接访问。

公开(公告)号：US12242391B2

公开(公告)日：2025-03-04

申请号：US18378124

申请日：2023-10-09

Applicant: Intel Corporation

Inventor： Carlos V. Rozas ,  Mona Vij ,  Rebekah M. Leslie-Hurd ,  Krystof C. Zmudzinski ,  Somnath Chakrabarti ,  Francis X. McKeen ,  Vincent R. Scarlata ,  Simon P. Johnson ,  Ilya Alexandrovich ,  Gilbert Neiger ,  Vedvyas Shanbhogue ,  Ittai Anati

IPC: G06F12/14 ,  G06F8/41 ,  G06F9/30 ,  G06F9/455 ,  G06F21/53 ,  G06F21/60

Abstract: A processor includes a decode unit to decode an instruction that is to indicate a page of a protected container memory, and a storage location outside of the protected container memory. An execution unit, in response to the instruction, is to ensure that there are no writable references to the page of the protected container memory while it has a write protected state. The execution unit is to encrypt a copy of the page of the protected container memory. The execution unit is to store the encrypted copy of the page to the storage location outside of the protected container memory, after it has been ensured that there are no writable references. The execution unit is to leave the page of the protected container memory in the write protected state, which is also valid and readable, after the encrypted copy has been stored to the storage location.

公开(公告)号：US20210406201A1

公开(公告)日：2021-12-30

申请号：US17367349

申请日：2021-07-03

Applicant: Intel Corporation

Inventor： Carlos V. Rozas ,  Mona Vij ,  Rebekah M. Leslie-Hurd ,  Krystof C. Zmudzinski ,  Somnath Chakrabarti ,  Francis X. Mckeen ,  Vincent R. Scarlata ,  Simon P. Johnson ,  Ilya Alexandrovich ,  Gilbert Neiger ,  Vedvyas Shanbhogue ,  Ittai Anati

IPC: G06F12/14 ,  G06F21/60 ,  G06F9/30 ,  G06F21/53 ,  G06F8/41 ,  G06F9/455

Abstract: A processor includes a decode unit to decode an instruction that is to indicate a page of a protected container memory, and a storage location outside of the protected container memory. An execution unit, in response to the instruction, is to ensure that there are no writable references to the page of the protected container memory while it has a write protected state. The execution unit is to encrypt a copy of the page of the protected container memory. The execution unit is to store the encrypted copy of the page to the storage location outside of the protected container memory, after it has been ensured that there are no writable references. The execution unit is to leave the page of the protected container memory in the write protected state, which is also valid and readable, after the encrypted copy has been stored to the storage location.

公开(公告)号：US20210049013A1

公开(公告)日：2021-02-18

申请号：US17087536

申请日：2020-11-02

Applicant: Intel Corporation

Inventor： Regev Shemy ,  Zeev Sperber ,  Wajdi Feghali ,  Vinodh Gopal ,  Amit Gradstein ,  Simon Rubanovich ,  Sean Gulley ,  Ilya Albrekht ,  Jacob Doweck ,  Jose Yallouz ,  Ittai Anati

IPC: G06F9/30 ,  G06F9/38 ,  H04L9/06

Abstract: Systems, methods, and apparatuses relating to performing hashing operations on packed data elements are described. In one embodiment, a processor includes a decode circuit to decode a single instruction into a decoded single instruction, the single instruction including at least one first field that identifies eight 32-bit state elements A, B, C, D, E, F, G, and H for a round according to a SM3 hashing standard and at least one second field that identifies an input message; and an execution circuit to execute the decoded single instruction to: rotate state element C left by 9 bits to form a rotated state element C, rotate state element D left by 9 bits to form a rotated state element D, rotate state element G left by 19 bits to form a rotated state element G, rotate state element H left by 19 bits to form a rotated state element H, perform two rounds according to the SM3 hashing standard on the input message and state element A, state element B, rotated state element C, rotated state element D, state element E, state element F, rotated state element G, and rotated state element H to generate an updated state element A, an updated state element B, an updated state element E, and an updated state element F, and store the updated state element A, the updated state element B, the updated state element E, and the updated state element F into a location specified by the single instruction.

公开(公告)号：US20200210583A1

公开(公告)日：2020-07-02

申请号：US16236177

申请日：2018-12-28

Applicant: Intel Corporation

Inventor： Ittai Anati ,  Stanley Gambarin

IPC: G06F21/57 ,  G06F21/62

Abstract: Processors in computerized systems can be targeted by hostile actors seeking to bypass security policies and may employ published or otherwise known vulnerabilities. Embodiments may include security subsystems and methods of operation that identify known vulnerabilities during execution and implement countermeasures or enforce security policies.

公开(公告)号：US20190324918A1

公开(公告)日：2019-10-24

申请号：US16402442

申请日：2019-05-03

Applicant: INTEL CORPORATION

Inventor： Krystof C. Zmudzinski ,  Siddhartha Chhabra ,  Uday R. Savagaonkar ,  Simon P. Johnson ,  Rebekah M. Leslie-Hurd ,  Francis X. McKeen ,  Gilbert Neiger ,  Raghunandan Makaram ,  Carlos V. Rozas ,  Amy L. Santoni ,  Vincent R. Scarlata ,  Vedvyas Shanbhogue ,  Ilya Alexandrovich ,  Ittai Anati ,  Wesley H. Smith ,  Michael Goldsmith

IPC: G06F12/1009 ,  G06F12/1036 ,  G06F12/1027 ,  G06F12/109 ,  G06F12/14 ,  G06F9/455

Abstract: A processor for supporting secure memory intent is disclosed. The processor of the disclosure includes a memory execution unit to access memory and a processor core coupled to the memory execution unit. The processor core is to receive a request to access a convertible page of the memory. In response to the request, the processor core to determine an intent for the convertible page in view of a page table entry (PTE) corresponding to the convertible page. The intent indicates whether the convertible page is to be accessed as at least one of a secure page or a non-secure page.