公开(公告)号：US09430384B2

公开(公告)日：2016-08-30

申请号：US13854107

申请日：2013-03-31

申请人： Carlos V Rozas ,  Ilya Alexandrovich ,  Ittai Anati ,  Alex Berenzon ,  Michael A Goldsmith ,  Barry E Huntley ,  Anton Ivanov ,  Simon P Johnson ,  Rebekah M. Leslie-Hurd ,  Francis X. McKeen ,  Gilbert Neiger ,  Rinat Rappoport ,  Scott Dion Rodgers ,  Uday R. Savagaonkar ,  Vincent R. Scarlata ,  Vedvyas Shanbhogue ,  Wesley H Smith ,  William Colin Wood

发明人： Carlos V Rozas ,  Ilya Alexandrovich ,  Ittai Anati ,  Alex Berenzon ,  Michael A Goldsmith ,  Barry E Huntley ,  Anton Ivanov ,  Simon P Johnson ,  Rebekah M. Leslie-Hurd ,  Francis X. McKeen ,  Gilbert Neiger ,  Rinat Rappoport ,  Scott Dion Rodgers ,  Uday R. Savagaonkar ,  Vincent R. Scarlata ,  Vedvyas Shanbhogue ,  Wesley H Smith ,  William Colin Wood

IPC分类号： G06F12/08 ,  G06F12/10

CPC分类号： G06F12/0875 ,  G06F12/0808 ,  G06F12/1027 ,  G06F2212/1016 ,  G06F2212/402

摘要： Instructions and logic provide advanced paging capabilities for secure enclave page caches. Embodiments include multiple hardware threads or processing cores, a cache to store secure data for a shared page address allocated to a secure enclave accessible by the hardware threads. A decode stage decodes a first instruction specifying said shared page address as an operand, and execution units mark an entry corresponding to an enclave page cache mapping for the shared page address to block creation of a new translation for either of said first or second hardware threads to access the shared page. A second instruction is decoded for execution, the second instruction specifying said secure enclave as an operand, and execution units record hardware threads currently accessing secure data in the enclave page cache corresponding to the secure enclave, and decrement the recorded number of hardware threads when any of the hardware threads exits the secure enclave.

摘要翻译： 说明和逻辑为安全的飞地页面缓存提供了高级分页功能。 实施例包括多个硬件线程或处理核心，用于存储分配给由硬件线程可访问的安全空间的共享页面地址的安全数据的高速缓存。 解码级将指定所述共享页地址的第一指令解码为操作数，并且执行单元标记对应于共享页地址的飞地页高速缓存映射的条目，以阻止所述第一或第二硬件线程中的任一个的新转换的创建 访问共享页面。 第二指令被解码以执行，第二指令指定所述安全飞地作为操作数，并且执行单元记录当前访问与安全飞地相对应的飞地页面缓存中的安全数据的硬件线程，并且当任何 的硬件线程退出安全飞地。

公开(公告)号：US20140189326A1

公开(公告)日：2014-07-03

申请号：US13729371

申请日：2012-12-28

申请人： Rebekah Leslie ,  Carlos V. Rozas ,  Vincent R. Scarlata ,  Simon P. Johnson ,  Uday R. Savagaonkar ,  Barry E. Huntley ,  Vedvyas Shanbhogue ,  Ittai Anati ,  Francis X. Mckeen ,  Michael A. Goldsmith ,  Ilya Alexandrovich ,  Alex Berenzon ,  Wesley H. Smith

发明人： Rebekah Leslie ,  Carlos V. Rozas ,  Vincent R. Scarlata ,  Simon P. Johnson ,  Uday R. Savagaonkar ,  Barry E. Huntley ,  Vedvyas Shanbhogue ,  Ittai Anati ,  Francis X. Mckeen ,  Michael A. Goldsmith ,  Ilya Alexandrovich ,  Alex Berenzon ,  Wesley H. Smith

IPC分类号： G06F9/30

CPC分类号： G06F9/3004 ,  G06F9/30047 ,  G06F9/30076 ,  G06F9/44 ,  G06F12/084 ,  G06F12/0875 ,  G06F12/1483 ,  G06F2212/452

摘要： Embodiments of an invention for memory management in secure enclaves are disclosed. In one embodiment, a processor includes an instruction unit and an execution unit. The instruction unit is to receive a first instruction and a second instruction. The execution unit is to execute the first instruction, wherein execution of the first instruction includes allocating a page in an enclave page cache to a secure enclave. The execution unit is also to execute the second instruction, wherein execution of the second instruction includes confirming the allocation of the page.

摘要翻译： 公开了用于安全飞行器中的存储器管理的发明的实施例。 在一个实施例中，处理器包括指令单元和执行单元。 指令单元接收第一指令和第二指令。 执行单元执行第一指令，其中第一指令的执行包括将飞地页面缓存中的页面分配到安全飞地。 执行单元还执行第二指令，其中第二指令的执行包括确认页的分配。

公开(公告)号：US20140189325A1

公开(公告)日：2014-07-03

申请号：US13729277

申请日：2012-12-28

申请人： Francis X. Mckeen ,  Michael A. Goldsmith ,  Barry E. Huntley ,  Simon P. Johnson ,  Rebekah Leslie ,  Carlos V. Rozas ,  Uday R. Savagaonkar ,  Vincent R. Scarlata ,  Vedvyas Shanbhogue ,  Wesley H. Smith ,  Ittai Anati ,  Ilya Alexandrovich ,  Alex Berenzon

发明人： Francis X. Mckeen ,  Michael A. Goldsmith ,  Barry E. Huntley ,  Simon P. Johnson ,  Rebekah Leslie ,  Carlos V. Rozas ,  Uday R. Savagaonkar ,  Vincent R. Scarlata ,  Vedvyas Shanbhogue ,  Wesley H. Smith ,  Ittai Anati ,  Ilya Alexandrovich ,  Alex Berenzon

IPC分类号： G06F9/30

CPC分类号： G06F12/0804 ,  G06F9/30047 ,  G06F12/0875 ,  G06F12/1408 ,  G06F2212/1052 ,  G06F2212/402

摘要： Embodiments of an invention for paging in secure enclaves are disclosed. In one embodiment, a processor includes an instruction unit and an execution unit. The instruction unit is to receive a first instruction. The execution unit is to execute the first instruction, wherein execution of the first instruction includes evicting a first page from an enclave page cache.

摘要翻译： 公开了用于在安全飞行器中寻呼的发明的实施例。 在一个实施例中，处理器包括指令单元和执行单元。 指令单元接收第一条指令。 执行单元执行第一指令，其中第一指令的执行包括从飞地页面缓存中逐出第一页。

公开(公告)号：US20190132295A1

公开(公告)日：2019-05-02

申请号：US16229964

申请日：2018-12-21

申请人： Oron Lenz ,  Alex Nayshtut ,  Alex Berenzon ,  Ishai Nadler ,  Yoni Wolf

发明人： Oron Lenz ,  Alex Nayshtut ,  Alex Berenzon ,  Ishai Nadler ,  Yoni Wolf

IPC分类号： H04L29/06 ,  G06F21/60 ,  G06F21/64 ,  G06F21/57 ,  H04L9/08 ,  H04L29/08 ,  G06F16/182 ,  H04L9/06

摘要： A system and apparatus for data confidentiality in a distributed ledger are disclosed. The system and apparatus preserve qualities of distributed ledgers, such as transparency, integrity, and redundancy, while also providing confidentiality, scalability, and security not previously available in distributed ledgers. The system includes a data confidentiality module that exploits a trusted execution environment for both transaction processing and key synchronization. The apparatus accessing the distributed ledger provides for new nodes joining the network, sending transactions to the ledger by existing nodes, securely processing the transaction using the trusted execution environment, securing transmission to the logic layer for application of business logic, reading and writing data to local storage, and reading encrypted transactions.

公开(公告)号：US09465946B2

公开(公告)日：2016-10-11

申请号：US13997899

申请日：2012-06-01

申请人： Sergei Goffman ,  Alex Berenzon ,  Oron Lenz ,  Tevi Devor ,  Bo Zhang ,  Yoram Zahavi ,  Moshe Maor

发明人： Sergei Goffman ,  Alex Berenzon ,  Oron Lenz ,  Tevi Devor ,  Bo Zhang ,  Yoram Zahavi ,  Moshe Maor

IPC分类号： G06F11/30 ,  G06F21/60 ,  G06F21/12 ,  G06F21/53 ,  G06F21/54

CPC分类号： G06F21/602 ,  G06F21/125 ,  G06F21/53 ,  G06F21/54

摘要： Embodiments of apparatus, computer-implemented methods, systems, devices, and computer-readable media are described herein for identifying and encrypting a subset of a plurality of instructions, for execution in a more secure execution environment. In various embodiments, the subset may include a single entry point and a single exit point. In various embodiments, one or more instructions of the plurality of instructions that precede or follow the subset may be executed in a first execution environment with a first security level. In various embodiments, the subset may be executed in a second execution environment with a second security level that is more secure than the first security level.

摘要翻译： 本文描述了装置，计算机实现的方法，系统，设备和计算机可读介质的实施例，用于识别和加密多个指令的子集，以在更安全的执行环境中执行。 在各种实施例中，子集可以包括单个入口点和单个出口点。 在各种实施例中，可以在具有第一安全级别的第一执行环境中执行在子集之前或之后的多个指令中的一个或多个指令。 在各种实施例中，子集可以在具有比第一安全级别更安全的第二安全级别的第二执行环境中执行。

公开(公告)号：US20140047245A1

公开(公告)日：2014-02-13

申请号：US13997899

申请日：2012-06-01

申请人： Sergei Goffman ,  Alex Berenzon ,  Oron Lenz ,  Tevi Devor ,  Bo Zhang ,  Yoram Zahavi ,  Moshe Maor

发明人： Sergei Goffman ,  Alex Berenzon ,  Oron Lenz ,  Tevi Devor ,  Bo Zhang ,  Yoram Zahavi ,  Moshe Maor

IPC分类号： G06F21/60

CPC分类号： G06F21/602 ,  G06F21/125 ,  G06F21/53 ,  G06F21/54

摘要： Embodiments of apparatus, computer-implemented methods, systems, devices, and computer-readable media are described herein for identifying and encrypting a subset of a plurality of instructions, for execution in a more secure execution environment. In various embodiments, the subset may include a single entry point and a single exit point. In various embodiments, one or more instructions of the plurality of instructions that precede or follow the subset may be executed in a first execution environment with a first security level. In various embodiments, the subset may be executed in a second execution environment with a second security level that is more secure than the first security level.

摘要翻译： 本文描述了装置，计算机实现的方法，系统，设备和计算机可读介质的实施例，用于识别和加密多个指令的子集，以在更安全的执行环境中执行。 在各种实施例中，子集可以包括单个入口点和单个出口点。 在各种实施例中，可以在具有第一安全级别的第一执行环境中执行在子集之前或之后的多个指令中的一个或多个指令。 在各种实施例中，子集可以在具有比第一安全级别更安全的第二安全级别的第二执行环境中执行。