ENABLING STATELESS ACCELERATOR DESIGNS SHARED ACROSS MUTUALLY-DISTRUSTFUL TENANTS

    公开(公告)号:US20220222203A1

    公开(公告)日:2022-07-14

    申请号:US17712350

    申请日:2022-04-04

    申请人: Intel Corporation

    摘要: An apparatus to facilitate enabling stateless accelerator designs shared across mutually-distrustful tenants is disclosed. The apparatus includes a fully-homomorphic encryption (FHE)-capable circuitry to establish a secure session with a trusted environment executing on a host device communicably coupled to the apparatus; generate, as part of establishing the secure session, per-tenant FHE keys for each tenant utilizing the FHE-capable circuitry, the per-tenant FHE keys utilized to encrypt tenant data provided to an FHE-capable compute kernel of the FHE-capable circuitry; process tenant data that is in an FHE-encrypted format encrypted with a per-tenant FHE key of the per-tenant FHE keys; and store the tenant data that is in the FHE-encrypted format encrypted with the per-tenant FHE key of the per-tenant FHE keys.

    Method and apparatus for securely saving and restoring the state of a computing platform
    3.
    发明授权
    Method and apparatus for securely saving and restoring the state of a computing platform 有权
    安全地保存和恢复计算平台状态的方法和装置

    公开(公告)号:US09407636B2

    公开(公告)日:2016-08-02

    申请号:US14281651

    申请日:2014-05-19

    申请人: INTEL CORPORATION

    IPC分类号: G06F21/64 H04L29/06 G06F21/74

    摘要: An apparatus and method for securely suspending and resuming the state of a processor. For example, one embodiment of a method comprises: generating a data structure including at least the monotonic counter value; generating a message authentication code (MAC) over the data structure using a first key; securely providing the data structure and the MAC to a module executed on the processor; the module verifying the MAC, comparing the monotonic counter value with a counter value stored during a previous suspend operation and, if the counter values match, then loading processor state required for the resume operation to complete. Another embodiment of a method comprises: generating a first key by a processor; securely sharing the first key with an off-processor component; and using the first key to generate a pairing ID usable to identify a pairing between the processor and the off-processor component.

    摘要翻译: 一种用于安全地挂起并恢复处理器状态的装置和方法。 例如,方法的一个实施例包括:生成至少包括单调计数器值的数据结构; 使用第一密钥在数据结构上生成消息认证码(MAC); 将数据结构和MAC安全地提供给在处理器上执行的模块; 所述模块验证所述MAC,将所述单调计数器值与在先前暂停操作期间存储的计数器值进行比较,并且如果所述计数器值匹配,则加载完成所述恢复操作所需的处理器状态。 方法的另一实施例包括:由处理器生成第一密钥; 用脱离处理器组件安全地共享第一个密钥; 以及使用所述第一密钥来生成可用于识别所述处理器和所述关闭处理器组件之间的配对的配对ID。

    DATA TAINTING TO MITIGATE SPECULATION VULNERABILITIES

    公开(公告)号:US20220207149A1

    公开(公告)日:2022-06-30

    申请号:US17134347

    申请日:2020-12-26

    申请人: Intel Corporation

    IPC分类号: G06F21/57 G06F21/75 G06F21/53

    摘要: Embodiments for dynamically mitigating speculation vulnerabilities are disclosed. In an embodiment, an apparatus includes speculation vulnerability detection hardware and execution hardware. The speculation vulnerability detection hardware is to detect vulnerability to a speculative execution attack and, in connection with a detection of vulnerability to a speculative execution attack, to provide an indication that data from a first operation is tainted. The execution hardware is to perform a second operation using the data if the second operation is to be performed non-speculatively and to prevent performance of the second operation if the second operation is to be performed speculatively and the data is tainted.

    ENABLING STATELESS ACCELERATOR DESIGNS SHARED ACROSS MUTUALLY-DISTRUSTFUL TENANTS

    公开(公告)号:US20210111863A1

    公开(公告)日:2021-04-15

    申请号:US17130407

    申请日:2020-12-22

    申请人: Intel Corporation

    摘要: An apparatus to facilitate enabling stateless accelerator designs shared across mutually-distrustful tenants is disclosed. The apparatus includes a fully-homomorphic encryption (FHE)-capable compute kernel. The FHE-capable compute kernel is to establish a secure session with a trusted environment executing on a host device communicably coupled to the apparatus; generate, as part of establishing the secure session, per-tenant FHE keys for each tenant utilizing the FHE-capable compute kernel, the per-tenant FHE keys utilized to encrypt tenant data provided to the FHE-capable compute kernel; process tenant data that is in an FHE-encrypted format encrypted with a per-tenant FHE key of the per-tenant FHE keys; and store the tenant data that is in the FHE-encrypted format encrypted with the per-tenant FHE key of the per-tenant FHE keys.