-
公开(公告)号：US11288372B2
公开(公告)日：2022-03-29
申请号：US16595159
申请日：2019-10-07
发明人： Neeraj Ladkani , Bryan David Kelly
摘要： A computing device includes circuitry that is configured to disable a physical interface between a baseboard management controller (BMC) and a processor when the BMC is not running and a logical interface between the BMC and the processor is not available. Disabling the physical interface prevents an attacker from writing malicious code to the BMC using the physical interface. The computing device also includes circuitry that enables the physical interface between the BMC and the processor in response to receiving a unique signal sequence from a trusted external entity. When firmware should be installed on the BMC, someone with proper authorization can cause the trusted external entity to send the unique signal sequence to the circuitry on the computing device, thereby enabling the physical interface between the BMC and the processor. The processor can then write the firmware to non-volatile memory within the BMC across the physical interface.
-
公开(公告)号：US12101410B2
公开(公告)日：2024-09-24
申请号：US17401181
申请日：2021-08-12
发明人： Md. Nazmus Sakib , Ronald Aigner , Ling Tony Chen , Peter David Waxman , David Guy Weston , Bryan David Kelly
CPC分类号： H04L9/3234 , G06F9/45558 , H04L9/083 , G06F2009/45587
摘要： Methods, systems, apparatuses, and computer-readable storage mediums described herein enable executable code of a hardware security platform (HSP) circuit to communicate with a hypervisor in a separate processor. The hypervisor generates and manages virtual machines. The HSP code comprises trusted platform module (TPM) logic, that processes TPM commands received via the hypervisor, and in response to the processing, communicates security information (e.g., measurements, keys, authorization data) with the virtual machines via the hypervisor. The TPM logic receives security information related to a virtual machine from the hypervisor and stores the security information in non-volatile memory of the HSP circuit, where security information from a particular VM is distinguishable from security information from another VM in the HSP memory. The hypervisor (and VMs) communicate via a network fabric with the HSP circuit within an SOC, or the HSP may reside on a discrete chip and communicate via a secure encrypted channel.
-
公开(公告)号：US11176020B2
公开(公告)日：2021-11-16
申请号：US16674723
申请日：2019-11-05
发明人： Bryan David Kelly , Neeraj Ladkani
摘要： A system and method of monitoring a status of a server using a baseboard management controller (BMC) is disclosed. First, the BMC may access a status code generated in Domain 0 of the server through a command line interface to the server and send the status code to an alert management system. Second, the BMC may snoop on a status code generated in the hypervisor of the server through input/output port 80h and send the status code to the alert management system. Third, the BMC may read a status code generated in the hypervisor and written in a Model Specific Register (MSR) and send the status code to the alert management system. The system and method can enable the alert management system to readily recognize the occurrence of an error, including the type of the error which is a software error, and the cause of the error in real time or nearly real time.
-
公开(公告)号：US11853428B2
公开(公告)日：2023-12-26
申请号：US17337251
申请日：2021-06-02
CPC分类号： G06F21/572 , G06F9/541 , G06F21/554 , G06F2221/033
摘要： Embodiments described herein are directed to firmware policy enforcement of a computing device. For example, a security processor of the computing device is utilized to boot the computing device. During a boot session, the security processor loads and executes specialized firmware. The specialized firmware, when executed, causes the security processor to determine whether other types of firmware to be executed on the computing device is in compliance with a policy specified by the specialized firmware. Based at least on a determination that the other firmware is in compliance with the policy, the security processor executes the other firmware. Based at least on a determination that the other firmware is not in compliance with the policy, the security processor performs a mitigation with respect to the other firmware.
-
公开(公告)号：US10740252B2
公开(公告)日：2020-08-11
申请号：US15958122
申请日：2018-04-20
摘要： A processor may be coupled to a flash memory by way of an interface. The processor may be caused to read and/or write data, such as computer executable instructions, from/to the flash memory via the interface. An interface filter may be interposed between the processor and the flash memory to enhance the security and validity of data transactions associated with the processor and the flash memory.
-
公开(公告)号：US11971993B2
公开(公告)日：2024-04-30
申请号：US17335980
申请日：2021-06-01
发明人： Vishal Soni , Bryan David Kelly
CPC分类号： G06F21/575 , H04L9/30 , H04L9/3236
摘要： A system includes a stored counter value and a stored boot manifest including a manifest type flag. A manifest type of the boot manifest is determined based on the manifest type flag, a tenancy mode is determined based on a parity of the counter value, a first boot is executed if the manifest type is a first manifest type and the tenancy mode is a first tenancy mode, a second boot flow is executed if the manifest type is the first manifest type and the tenancy mode is a second tenancy mode, a third boot flow is executed if the manifest type is a second manifest type and the tenancy mode is the first tenancy mode, and a fourth boot flow is executed if the manifest type is the second manifest type and the tenancy mode is the second tenancy mode.
-
公开(公告)号：US11893118B2
公开(公告)日：2024-02-06
申请号：US17330170
申请日：2021-05-25
CPC分类号： G06F21/575 , G06F21/572 , G06F21/6209 , H04L9/0891 , H04L9/3236 , H04L9/3247
摘要： Embodiments described herein are directed to transferring the ownership of a computing device from one entity to another entity. For example, a security processor is utilized to boot the computing device. During a boot session, the security processor loads and executes boot code, which determines whether specialized firmware authorized by the current owner indicates whether a transfer of ownership is to occur. In response to determining that the specialized firmware indicates that a transfer of ownership is to occur, the secure processor loads and executes the specialized firmware. The specialized firmware, when executed, causes the security processor to program a set of fuses with the public key of the new owner. Execution of the specialized firmware also causes the security processor to invalidate the public key of the original owner, which is stored in another set of fuses.
-
-
-
-
-
-
搜索结果
7 条记录 (耗时 0.013 秒)
