-
公开(公告)号：US07024555B2
公开(公告)日：2006-04-04
申请号：US10043843
申请日：2001-11-01
申请人： Michael A. Kozuch , James A. Sutton, II , David Grawrock , Gilbert Neiger , Richard A. Uhlig , Bradley G. Burgess , David I. Poisner , Clifford D. Hall , Andy Glew , Lawrence O. Smith, III , Robert George
发明人： Michael A. Kozuch , James A. Sutton, II , David Grawrock , Gilbert Neiger , Richard A. Uhlig , Bradley G. Burgess , David I. Poisner , Clifford D. Hall , Andy Glew , Lawrence O. Smith, III , Robert George
IPC分类号： G06F1/26
CPC分类号： G06F21/57
摘要： An apparatus and method for unilaterally loading a secure operating system within a multiprocessor environment are described. The method includes disregarding a received load secure region instruction when a currently active load secure region operation is detected. Otherwise, a memory protection element is directed, in response to the received load secure region instruction, to form a secure memory environment. Once directed, unauthorized read/write access to one or more protected memory regions are prohibited. Finally, a cryptographic hash value of the one or more protected memory regions is stored within a digest information repository as a secure software identification value. Once stored, outside agents may request access to a digitally signed software identification value in order to establish security verification of secure software within the secure memory environment.
-
2.发明授权Apparatus and method for unilaterally loading a secure operating system within a multiprocessor environment 有权在多处理器环境中单方面加载安全操作系统的装置和方法公开(公告)号：US07921293B2
公开(公告)日：2011-04-05
申请号：US11340181
申请日：2006-01-24
申请人： Michael A. Kozuch , James A. Sutton, II , David Grawrock , Gilbert Neiger , Richard A. Uhlig , Bradley G. Burgess , David I. Poisner , Clifford D. Hall , Andy Glew , Lawrence O. Smith, III , Robert George
发明人： Michael A. Kozuch , James A. Sutton, II , David Grawrock , Gilbert Neiger , Richard A. Uhlig , Bradley G. Burgess , David I. Poisner , Clifford D. Hall , Andy Glew , Lawrence O. Smith, III , Robert George
CPC分类号： G06F21/57
摘要： An apparatus and method for unilaterally loading a secure operating system within a multiprocessor environment are described. The method includes disregarding a received load secure region instruction when a currently active load secure region operation is detected. Otherwise, a memory protection element is directed, in response to the received load secure region instruction, to form a secure memory environment. Once directed, unauthorized read/write access to one or more protected memory regions are prohibited. Finally, a cryptographic hash value of the one or more protected memory regions is stored within a digest information repository as a secure software identification value. Once stored, outside agents may request access to a digitally signed software identification value to establish security verification of secure software within the secure memory environment.
摘要翻译： 描述了在多处理器环境内单方面加载安全操作系统的装置和方法。 该方法包括当检测到当前活动的负载安全区域操作时忽略接收的负载安全区域指令。 否则，响应于接收到的负载安全区域指令，引导存储器保护元件以形成安全存储器环境。 一旦定向，就禁止对一个或多个受保护的存储器区域进行未经授权的读/写访问。 最后，一个或多个受保护的存储器区域的加密散列值作为安全的软件识别值存储在摘要信息库中。 一旦存储，外部代理可以请求访问数字签名的软件标识值以建立安全存储器环境内的安全软件的安全验证。
-
3.发明申请Apparatus and method for unilaterally loading a secure operating system within a multiprocessor environment 有权在多处理器环境中单方面加载安全操作系统的装置和方法公开(公告)号：US20070192577A1
公开(公告)日：2007-08-16
申请号：US11340181
申请日：2006-01-24
申请人： Michael Kozuch , James Sutton , David Grawrock , Gilbert Neiger , Richard Uhlig , Bradley Burgess , David Poisner , Clifford Hall , Andy Glew , Lawrence Smith , Robert George
发明人： Michael Kozuch , James Sutton , David Grawrock , Gilbert Neiger , Richard Uhlig , Bradley Burgess , David Poisner , Clifford Hall , Andy Glew , Lawrence Smith , Robert George
IPC分类号： G06F15/177
CPC分类号： G06F21/57
摘要： An apparatus and method for unilaterally loading a secure operating system within a multiprocessor environment are described. The method includes disregarding a received load secure region instruction when a currently active load secure region operation is detected. Otherwise, a memory protection element is directed, in response to the received load secure region instruction, to form a secure memory environment. Once directed, unauthorized read/write access to one or more protected memory regions are prohibited. Finally, a cryptographic hash value of the one or more protected memory regions is stored within a digest information repository as a secure software identification value. Once stored, outside agents may request access to a digitally signed software identification value to establish security verification of secure software within the secure memory environment.
摘要翻译： 描述了在多处理器环境内单方面加载安全操作系统的装置和方法。 该方法包括当检测到当前活动的负载安全区域操作时忽略接收到的负载安全区域指令。 否则，响应于接收到的负载安全区域指令，引导存储器保护元件以形成安全存储器环境。 一旦定向，就禁止对一个或多个受保护的存储器区域进行未经授权的读/写访问。 最后，一个或多个受保护的存储器区域的加密散列值作为安全的软件识别值存储在摘要信息库中。 一旦存储，外部代理可以请求访问数字签名的软件标识值以建立安全存储器环境内的安全软件的安全验证。
-
公开(公告)号：US08386788B2
公开(公告)日：2013-02-26
申请号：US12615475
申请日：2009-11-10
IPC分类号： H04L29/06
CPC分类号： G06F9/45533 , G06F9/445 , G06F21/57 , G06F21/575 , G06F2009/45583 , G06F2009/45587
摘要： A method and apparatus is provided for securing a region in a memory of a computer. According to one embodiment, the method comprises halting of all but one of a plurality of processors in a computer. The halted processors entering into a special halted state. Content is loaded into the region only after the halting of all but the one of the plurality of processors and the region is protected from access by the halted processors. The method further comprises placing the non-halted processor into a known privileged state, and causing the halted processors to exit the halted state after the non-halted processor has been placed into the known privileged state.
摘要翻译： 提供了一种用于将区域固定在计算机的存储器中的方法和装置。 根据一个实施例，该方法包括在计算机中停止多个处理器中的所有处理器中的所有处理器。 停止的处理器进入特殊的停止状态。 只有在除了多个处理器中的一个处理器之外的所有处理器停止之后，内容被加载到该区域中，并且该区域被保护以免被暂停的处理器访问。 该方法还包括将非暂停处理器置于已知特权状态，并且在非停止处理器已经被置于已知特权状态之后使得暂停的处理器退出停止状态。
-
公开(公告)号：US08407476B2
公开(公告)日：2013-03-26
申请号：US12615519
申请日：2009-11-10
IPC分类号： H04L29/06
CPC分类号： G06F9/45533 , G06F9/445 , G06F21/57 , G06F21/575 , G06F2009/45583 , G06F2009/45587
摘要： An article of manufacture is provided for securing a region in a memory of a computer. According to one embodiment, the article of manufacture comprises a machine-accessible medium including data that, when accessed by a machine, causes the machine to: halt all but one of a plurality of processing elements in a computer, where the halted processing elements enter into a special halted state; load content into the region only after the halting of all but the one of the plurality of processing elements and the region is protected from access by the halted processing elements; place the non-halted processing element into a known privileged state; and cause the halted processing elements to exit the halted state after the non-halted processing element has been placed into the known privileged state.
摘要翻译： 提供了一种用于将区域固定在计算机的存储器中的制造物品。 根据一个实施例，制品包括机器可访问介质，其包括当由机器访问时使机器停止计算机中的多个处理元件中除了一个处理元件之外的所有其中停止的处理元件进入的数据 进入特殊的停止状态; 只有在除了多个处理元件中的一个处理元件之外的所有处理器停止之后才将内容加载到该区域中，并且该区域被保护以防止被暂停的处理元件的访问; 将未停止的处理元素置于已知的特权状态; 并且在非停止处理元件已经被置于已知的特权状态之后使得暂停的处理元件退出停止状态。
-
公开(公告)号：US20100058076A1
公开(公告)日：2010-03-04
申请号：US12615519
申请日：2009-11-10
IPC分类号： G06F12/14
CPC分类号： G06F9/45533 , G06F9/445 , G06F21/57 , G06F21/575 , G06F2009/45583 , G06F2009/45587
摘要： An article of manufacture is provided for securing a region in a memory of a computer. According to one embodiment, the article of manufacture comprises a machine-accessible medium including data that, when accessed by a machine, causes the machine to: halt all but one of a plurality of processing elements in a computer, where the halted processing elements enter into a special halted state; load content into the region only after the halting of all but the one of the plurality of processing elements and the region is protected from access by the halted processing elements; place the non-halted processing element into a known privileged state; and cause the halted processing elements to exit the halted state after the non-halted processing element has been placed into the known privileged state.
摘要翻译： 提供了一种用于将区域固定在计算机的存储器中的制造物品。 根据一个实施例，制品包括机器可访问介质，其包括当由机器访问时使机器停止计算机中的多个处理元件中除了一个处理元件之外的所有其中停止的处理元件进入的数据 进入特殊的停止状态; 只有在除了多个处理元件中的一个处理元件之外的所有处理器停止之后才将内容加载到该区域中，并且该区域被保护以防止被暂停的处理元件的访问; 将未停止的处理元素置于已知的特权状态; 并且在非停止处理元件已经被置于已知的特权状态之后使得暂停的处理元件退出停止状态。
-
公开(公告)号：US20100058075A1
公开(公告)日：2010-03-04
申请号：US12615475
申请日：2009-11-10
CPC分类号： G06F9/45533 , G06F9/445 , G06F21/57 , G06F21/575 , G06F2009/45583 , G06F2009/45587
摘要： A method and apparatus is provided for securing a region in a memory of a computer. According to one embodiment, the method comprises halting of all but one of a plurality of processors in a computer. The halted processors entering into a special halted state. Content is loaded into the region only after the halting of all but the one of the plurality of processors and the region is protected from access by the halted processors. The method further comprises placing the non-halted processor into a known privileged state, and causing the halted processors to exit the halted state after the non-halted processor has been placed into the known privileged state.
摘要翻译： 提供了一种用于将区域固定在计算机的存储器中的方法和装置。 根据一个实施例，该方法包括在计算机中停止多个处理器中的所有处理器中的所有处理器。 停止的处理器进入特殊的停止状态。 只有在除了多个处理器中的一个处理器之外的所有处理器停止之后，内容被加载到该区域中，并且该区域被保护以免被暂停的处理器访问。 该方法还包括将非暂停处理器置于已知特权状态，并且在非停止处理器已经被置于已知特权状态之后使得暂停的处理器退出停止状态。
-
公开(公告)号：US07631196B2
公开(公告)日：2009-12-08
申请号：US10085839
申请日：2002-02-25
CPC分类号： G06F9/45533 , G06F9/445 , G06F21/57 , G06F21/575 , G06F2009/45583 , G06F2009/45587
摘要： A method and apparatus is provided in which a trustable operating system is loaded into a region in memory. A start secure operation (SSO) triggers a join secure operation (JSO) to halt all but one central processing unit (CPU) in a multi-processor computer. The SSO causes the active CPU to load a component of an operating system into a specified region in memory, register the identity of the loaded operating system by recording a cryptographic hash of the contents of the specified region in memory, begin executing at a known entry point in the specified region and trigger the JSO to cause the halted CPUs to do the same.
摘要翻译： 提供了一种方法和装置，其中可信操作系统被加载到存储器中的区域中。 启动安全操作（SSO）触发连接安全操作（JSO），以在多处理器计算机中停止除一个中央处理器（CPU）之外的所有其他操作。 SSO使活动CPU将操作系统的组件加载到存储器中的指定区域中，通过在存储器中记录指定区域的内容的加密散列来注册加载的操作系统的标识，以已知条目开始执行 指向指定的区域并触发JSO以使停止的CPU执行相同操作。
-
公开(公告)号：US20060015719A1
公开(公告)日：2006-01-19
申请号：US11203538
申请日：2005-08-12
申请人： Howard Herbert , David Grawrock , Carl Ellison , Roger Golliver , Derrick Lin , Francis McKeen , Gilbert Neiger , Ken Reneris , James Sutton , Shreekant Thakkar , Millind Mittal
发明人： Howard Herbert , David Grawrock , Carl Ellison , Roger Golliver , Derrick Lin , Francis McKeen , Gilbert Neiger , Ken Reneris , James Sutton , Shreekant Thakkar , Millind Mittal
IPC分类号： H04L9/00
CPC分类号： G06F21/305 , G06F9/30189 , G06F12/1491 , G06F21/35 , G06F21/53 , G06F21/57 , G06F21/575 , G06F21/64 , G06F21/74 , G06F2221/2101 , G06F2221/2103 , G06F2221/2105 , G06F2221/2149
摘要： In one embodiment, a method of remote attestation for a special mode of operation. The method comprises storing an audit log within protected memory of a platform. The audit log is a listing of data representing each of a plurality of IsoX software modules loaded into the platform. The audit log is retrieved from the protected memory in response to receiving a remote attestation request from a remotely located platform. Then, the retrieved audit log is digitally signed to produce a digital signature for transfer to the remotely located platform.
-
公开(公告)号：US07971057B2
公开(公告)日：2011-06-28
申请号：US12753537
申请日：2010-04-02
申请人： Steven Grobman , David Grawrock , Narendar B. Sahgal , Joe Gruber
发明人： Steven Grobman , David Grawrock , Narendar B. Sahgal , Joe Gruber
IPC分类号： H04L29/06
CPC分类号： G06F21/10 , G06F2221/0735
摘要： Executing a monitor on a platform, the monitor capable of providing exclusive, secure access to an audio I/O device of the platform, executing a first partition on the platform, providing an audio device model in the first partition by directly mapping the audio I/O device from the monitor to the first partition for applications executing in the first partition, and providing exclusive, secure access to the audio I/O device to a program performing an audio function in a secure mode in the first partition.
摘要翻译： 在平台上执行监视器，监视器能够提供对平台的音频I / O设备的独占，安全访问，在平台上执行第一分区，通过直接映射音频I来在第一分区中提供音频设备模型 / O设备从监视器到第一分区，用于在第一分区中执行的应用，并且向第一分区中以安全模式执行音频功能的程序提供对音频I / O设备的独占安全访问。
-
-
-
-
-
-
-
-
-
搜索结果
43 条记录 (耗时 0.048 秒)