公开(公告)号：US08850098B2

公开(公告)日：2014-09-30

申请号：US12653989

申请日：2009-12-22

Applicant: Rajesh Madukkarumukumana ,  James A. Sutton, II ,  Ioannis Schoinas ,  Richard Uhlig

Inventor： Rajesh Madukkarumukumana ,  James A. Sutton, II ,  Ioannis Schoinas ,  Richard Uhlig

IPC: G06F13/36 ,  G06F13/28

CPC classification number: G06F13/28

Abstract: A method and apparatus is described herein for supporting direct memory accesses between peer I/O devices. It is determined whether a guest physical address (GPA) referenced by an access generated from an I/O device, is within a range of GPAs associated with local I/O devices based at least in part on a GPA base and a GPA window size. If the GPA is within the window, then the GPA is translated to an HPA based at least in part on a base HPA associated with a local device and then forwarded to that local device. However, if the GPA is not within the window, then the access is forwarded upstream.

Abstract translation: 这里描述了一种用于支持对等I / O设备之间的直接存储器访问的方法和装置。 确定由I / O设备产生的访问所引用的访客物理地址（GPA）是否至少部分地基于GPA基础和GPA窗口大小在与本地I / O设备相关联的GPA的范围内 。 如果GPA在窗口内，则GPA至少部分基于与本地设备关联的基本HPA转换为HPA，然后转发到该本地设备。 但是，如果GPA不在窗口内，那么访问将在上游转发。

公开(公告)号：US20130254905A1

公开(公告)日：2013-09-26

申请号：US13897906

申请日：2013-05-20

Applicant: John H. Wilson ,  Ioannis T. Schoinas ,  Mazin S. Yousif ,  Linda J. Rankin ,  David W. Grawrock ,  Robert J. Greiner ,  James A. Sutton ,  Kushagra Vaid ,  Williard M. Wiseman

Inventor： John H. Wilson ,  Ioannis T. Schoinas ,  Mazin S. Yousif ,  Linda J. Rankin ,  David W. Grawrock ,  Robert J. Greiner ,  James A. Sutton ,  Kushagra Vaid ,  Williard M. Wiseman

IPC: G06F21/64

CPC classification number: G06F21/575 ,  G06F21/44 ,  G06F21/445 ,  G06F21/50 ,  G06F21/606 ,  G06F21/64 ,  G06F21/71 ,  G06F2221/034

Abstract: In one embodiment of the present invention, a method includes verifying a master processor of a system; validating a trusted agent with the master processor if the master processor is verified; and launching the trusted agent on a plurality of processors of the system if the trusted agent is validated. After execution of such a trusted agent, a secure kernel may then be launched, in certain embodiments. The system may be a multiprocessor server system having a partially or fully connected topology with arbitrary point-to-point interconnects, for example.

公开(公告)号：US08145816B2

公开(公告)日：2012-03-27

申请号：US10942351

申请日：2004-09-15

Applicant: Stephen A. Fischer ,  Douglas Raymond Moran ,  James A. Sutton, II

Inventor： Stephen A. Fischer ,  Douglas Raymond Moran ,  James A. Sutton, II

IPC: G06F12/00 ,  G06F12/14 ,  G06F7/04

CPC classification number: G06F13/26 ,  G06F21/74

Abstract: A method and system of deadlock free bus protection of memory and I/O resources during secure execution. A bus cycle initiates entry of a bus agent into a secure execution mode. The chipset records an identifier of the secure mode processor. Thereafter, the chipset intercedes if another bus agent attempts a security sensitive bus cycle before the secure mode processor exits the secure mode.

Abstract translation: 在安全执行期间，存储器和I / O资源的无死锁总线保护方法和系统。 总线周期启动总线代理进入安全执行模式。 芯片组记录安全模式处理器的标识符。 此后，如果另一个总线代理在安全模式处理器退出安全模式之前尝试安全敏感的总线周期，则芯片组进行中介。

公开(公告)号：US07774600B2

公开(公告)日：2010-08-10

申请号：US12005570

申请日：2007-12-27

Applicant: John H. Wilson ,  Ioannis T. Schoinas ,  Mazin S. Yousif ,  Linda J. Rankin ,  David W. Grawrock ,  Robert J. Greiner ,  James A. Sutton ,  Kushagra Vaid ,  Willard M. Wiseman

Inventor： John H. Wilson ,  Ioannis T. Schoinas ,  Mazin S. Yousif ,  Linda J. Rankin ,  David W. Grawrock ,  Robert J. Greiner ,  James A. Sutton ,  Kushagra Vaid ,  Willard M. Wiseman

IPC: G06F9/30 ,  H04L29/06

CPC classification number: G06F21/575 ,  G06F21/44 ,  G06F21/445 ,  G06F21/50 ,  G06F21/606 ,  G06F21/64 ,  G06F21/71 ,  G06F2221/034

Abstract: In one embodiment of the present invention, a method includes verifying an initiating logical processor of a system; validating a trusted agent with the initiating logical processor if the initiating logical processor is verified; and launching the trusted agent on a plurality of processors of the system if the trusted agent is validated. After execution of such a trusted agent, a secure kernel may then be launched, in certain embodiments. The system may be a multiprocessor server system having a partially or fully connected topology with arbitrary point-to-point interconnects, for example.

公开(公告)号：US07697691B2

公开(公告)日：2010-04-13

申请号：US10892256

申请日：2004-07-14

Applicant: James A. Sutton, II ,  Ernie F. Brickell ,  Clifford D. Hall ,  David W. Grawrock

Inventor： James A. Sutton, II ,  Ernie F. Brickell ,  Clifford D. Hall ,  David W. Grawrock

IPC: H04L9/00 ,  H04L9/08 ,  G06F11/30 ,  G06F12/14 ,  G08B29/00

CPC classification number: H04L9/0844 ,  H04L2209/127

Abstract: Delivering a Direct Proof private key to a device installed in a client computer system in the field may be accomplished in a secure manner without requiring significant non-volatile storage in the device. A unique pseudo-random value is generated and stored in the device at manufacturing time. The pseudo-random value is used to generate a symmetric key for encrypting a data structure holding a Direct Proof private key and a private key digest associated with the device. The resulting encrypted data structure is stored on a protected on-liner server accessible by the client computer system. When the device is initialized on the client computer system, the system checks if a localized encrypted data structure is present in the system. If not, the system obtains the associated encrypted data structure from the protected on-line server using a secure protocol. The device decrypts the encrypted data structure using a symmetric key regenerated from its stored pseudo-random value to obtain the Direct Proof private key. If the private key is valid, it may be used for subsequent authentication processing by the device in the client computer system.

Abstract translation: 将直接证明私钥提供给安装在该领域中的客户端计算机系统中的设备可以以安全的方式来实现，而不需要设备中的显着的非易失性存储。 在制造时产生并存储在设备中的唯一伪随机值。 伪随机值用于生成用于加密持有Direct Proof私钥和与该设备相关联的私钥摘要的数据结构的对称密钥。 所得到的加密数据结构存储在由客户端计算机系统可访问的受保护的在线服务器上。 当在客户端计算机系统上初始化设备时，系统会检查系统中是否存在本地化的加密数据结构。 如果没有，系统将使用安全协议从受保护的在线服务器获取相关联的加密数据结构。 设备使用从其存储的伪随机值重新生成的对称密钥来解密加密数据结构，以获得直接证明私钥。 如果私钥有效，则其可以用于客户端计算机系统中的设备的后续认证处理。

公开(公告)号：US20100058075A1

公开(公告)日：2010-03-04

申请号：US12615475

申请日：2009-11-10

Applicant: Michael A. Kozuch ,  James A. Sutton ,  David Grawrock

Inventor： Michael A. Kozuch ,  James A. Sutton ,  David Grawrock

IPC: G06F12/14 ,  G06F11/30

CPC classification number: G06F9/45533 ,  G06F9/445 ,  G06F21/57 ,  G06F21/575 ,  G06F2009/45583 ,  G06F2009/45587

Abstract: A method and apparatus is provided for securing a region in a memory of a computer. According to one embodiment, the method comprises halting of all but one of a plurality of processors in a computer. The halted processors entering into a special halted state. Content is loaded into the region only after the halting of all but the one of the plurality of processors and the region is protected from access by the halted processors. The method further comprises placing the non-halted processor into a known privileged state, and causing the halted processors to exit the halted state after the non-halted processor has been placed into the known privileged state.

Abstract translation: 提供了一种用于将区域固定在计算机的存储器中的方法和装置。 根据一个实施例，该方法包括在计算机中停止多个处理器中的所有处理器中的所有处理器。 停止的处理器进入特殊的停止状态。 只有在除了多个处理器中的一个处理器之外的所有处理器停止之后，内容被加载到该区域中，并且该区域被保护以免被暂停的处理器访问。 该方法还包括将非暂停处理器置于已知特权状态，并且在非停止处理器已经被置于已知特权状态之后使得暂停的处理器退出停止状态。

公开(公告)号：US07380278B2

公开(公告)日：2008-05-27

申请号：US11386269

申请日：2006-03-21

Applicant: Carl M. Ellison ,  Roger A. Golliver ,  Howard C. Herbert ,  Derrick C. Lin ,  Francis X. McKeen ,  Gilbert Neiger ,  Ken Reneris ,  James A. Sutton ,  Shreekant S. Thakkar ,  Millind Mittal

Inventor： Carl M. Ellison ,  Roger A. Golliver ,  Howard C. Herbert ,  Derrick C. Lin ,  Francis X. McKeen ,  Gilbert Neiger ,  Ken Reneris ,  James A. Sutton ,  Shreekant S. Thakkar ,  Millind Mittal

IPC: G06F7/04 ,  G06F9/00 ,  G06F12/00 ,  H04L9/00 ,  H04L9/32

CPC classification number: G06F21/53 ,  G06F9/468 ,  G06F21/562 ,  G06F21/57 ,  G06F21/74 ,  G06F2221/2105

Abstract: A processing system has a processor that can operate in a normal ring 0 operating mode and one or more higher ring operating modes above the normal ring 0 operating mode. In addition, the processor can operate in an isolated execution mode. A memory in the processing system may include an ordinary memory area that can be accessed from the normal ring 0 operating mode, as well as an isolated memory area that can be accessed from the isolated execution mode but not from the normal ring 0 operating mode. The processing system may also include an operating system (OS) nub, as well as a key generator. The key generator may generate an OS nub key (OSNK) based at least in part on an identification of the OS nub and a master binding key (BK0) of the platform. Other embodiments are described and claimed.

Abstract translation: 处理系统具有处理器，该处理器可以在正常环0操作模式和高于正常环0操作模式的一个或多个较高环操作模式下操作。 此外，处理器可以在隔离的执行模式下操作。 处理系统中的存储器可以包括可以从正常环0操作模式访问的普通存储器区域以及可以从隔离执行模式而不是从正常环0操作模式访问的隔离存储器区域。 处理系统还可以包括操作系统（OS）nub以及密钥生成器。 密钥生成器可以至少部分地基于OS nub的标识和平台的主绑定密钥（BK 0）来生成OS nub密钥（OSNK）。 描述和要求保护其他实施例。

公开(公告)号：US07089418B1

公开(公告)日：2006-08-08

申请号：US09540611

申请日：2000-03-31

Applicant: Carl M. Ellison ,  Roger A. Golliver ,  Howard C. Herbert ,  Derrick C. Lin ,  Francis X. McKeen ,  Gilbert Neiger ,  Ken Reneris ,  James A. Sutton ,  Shreekant S. Thakkar ,  Millind Mittal

Inventor： Carl M. Ellison ,  Roger A. Golliver ,  Howard C. Herbert ,  Derrick C. Lin ,  Francis X. McKeen ,  Gilbert Neiger ,  Ken Reneris ,  James A. Sutton ,  Shreekant S. Thakkar ,  Millind Mittal

IPC: G06F13/16

CPC classification number: G06F12/0831 ,  G06F12/1491

Abstract: In one embodiment, a method comprises configuring an access transaction generated by a processor by a configuration storage containing configuration parameters. The processor has a normal execution mode and an isolated execution mode. The access transaction has access information. In a further embodiment, a method comprises checking the access transaction by an access checking circuit using at least one of the configuration parameters and the access information.

Abstract translation: 在一个实施例中，一种方法包括通过包含配置参数的配置存储器配置由处理器生成的访问事务。 处理器具有正常执行模式和隔离执行模式。 访问事务具有访问信息。 在另一实施例中，一种方法包括使用至少一个配置参数和访问信息来检查访问检查电路的访问事务。

公开(公告)号：US06990579B1

公开(公告)日：2006-01-24

申请号：US09541108

申请日：2000-03-31

Applicant: Howard C. Herbert ,  David W. Grawrock ,  Carl M. Ellison ,  Roger A. Golliver ,  Derrick C. Lin ,  Francis X. McKeen ,  Gilbert Neiger ,  Ken Reneris ,  James A. Sutton ,  Shreekant S. Thakkar ,  Millind Mittal

Inventor： Howard C. Herbert ,  David W. Grawrock ,  Carl M. Ellison ,  Roger A. Golliver ,  Derrick C. Lin ,  Francis X. McKeen ,  Gilbert Neiger ,  Ken Reneris ,  James A. Sutton ,  Shreekant S. Thakkar ,  Millind Mittal

IPC: H04L9/00

CPC classification number: G06F21/305 ,  G06F9/30189 ,  G06F12/1491 ,  G06F21/35 ,  G06F21/53 ,  G06F21/57 ,  G06F21/575 ,  G06F21/64 ,  G06F21/74 ,  G06F2221/2101 ,  G06F2221/2103 ,  G06F2221/2105 ,  G06F2221/2149

Abstract: In one embodiment, a method of remote attestation for a special mode of operation. The method comprises storing an audit log within protected memory of a platform. The audit log is a listing of data representing each of a plurality of IsoX software modules loaded into the platform. The audit log is retrieved from the protected memory in response to receiving a remote attestation request from a remotely located platform. Then, the retrieved audit log is digitally signed to produce a digital signature for transfer to the remotely located platform.

Abstract translation: 在一个实施例中，用于特殊操作模式的远程认证的方法。 该方法包括将审核日志存储在平台的受保护的存储器内。 审计日志是表示加载到平台中的多个IsoX软件模块中的每一个的数据的列表。 响应于从远程位置的平台接收远程认证请求，从受保护的内存中检索审核日志。 然后，检索的审核日志进行数字签名，以产生数字签名，以转移到位于远程的平台。

公开(公告)号：US06871842B2

公开(公告)日：2005-03-29

申请号：US10321736

申请日：2002-12-17

Applicant: James A. Sutton

Inventor： James A. Sutton

IPC: A01K1/00 ,  B66D1/00 ,  B66D1/06 ,  G03B23/02

CPC classification number: A01K1/007 ,  B66D1/06

Abstract: A hand winch that includes a drum for carrying a strand wound thereon and including gear teeth, a drive gear having teeth thereon mounted in a driving relation to the gear teeth of the drum, and a handle assembly mounted on the drive gear for rotating the drive gear as the handle assembly is rotated. An engagement assembly 8 is positioned intermediate the drive gear and the handle assembly for winding the strand onto or off of the drum by the handle assembly when the strand is under tension and disengaging the handle assembly from the drive gear when tension on the strand is released to allow the drum to rotate while the handle assembly is stationary.

Abstract translation: 一种手摇绞盘，其包括用于承载卷绕在其上并包括齿轮齿的绞合线的滚筒，其上具有齿的驱动齿轮以与滚筒的齿轮的驱动关系安装在驱动齿轮上，以及安装在驱动齿轮上用于旋转驱动器的手柄组件 齿轮当手柄组件旋转时。 接合组件8定位在驱动齿轮和手柄组件的中间，用于当线束处于张紧状态时将线束缠绕在滚筒上或从滚筒上脱离，并且当线束上的张力被释放时将手柄组件与驱动齿轮分离 以允许滚筒在手柄组件静止时旋转。