公开(公告)号：US20140283098A1

公开(公告)日：2014-09-18

申请号：US13844101

申请日：2013-03-15

申请人： Vinay Phegade ,  Anand Rajan ,  Simon Johnson ,  Vincent Scarlata ,  Carlos Rozas ,  Nikhil Deshpande

发明人： Vinay Phegade ,  Anand Rajan ,  Simon Johnson ,  Vincent Scarlata ,  Carlos Rozas ,  Nikhil Deshpande

IPC分类号： G06F21/60

CPC分类号： H04L63/0428 ,  G06F21/57 ,  G06F21/60 ,  G06F21/64 ,  G06F2221/2105 ,  H04L63/126 ,  H04L63/302

摘要： An apparatus for sharing information between entities includes a processor and a trusted execution module executing on the processor. The trusted execution module is configured to receive first confidential information from a first client device associated with a first entity, seal the first confidential information within a trusted execution environment, receive second confidential information from a second client device associated with a second entity, seal the second confidential information within the trusted execution environment, and execute code within the trusted execution environment. The code is configured to compute a confidential result based upon the first confidential information and the second confidential information.

摘要翻译： 用于在实体之间共享信息的装置包括处理器和在处理器上执行的可信执行模块。 可信执行模块被配置为从与第一实体相关联的第一客户端设备接收第一机密信息，将可信执行环境中的第一机密信息密封，从与第二实体相关联的第二客户端设备接收第二机密信息， 可信执行环境中的第二机密信息，并在可信执行环境内执行代码。 代码被配置为基于第一机密信息和第二机密信息来计算机密结果。

公开(公告)号：US20150188710A1

公开(公告)日：2015-07-02

申请号：US14142837

申请日：2013-12-28

申请人： Simon Johnson ,  Francis McKeen ,  Vincent Scarlata ,  Carlos Rozas ,  Uday Savagaonkar ,  Michael Goldsmith ,  Ernie Brickell

发明人： Simon Johnson ,  Francis McKeen ,  Vincent Scarlata ,  Carlos Rozas ,  Uday Savagaonkar ,  Michael Goldsmith ,  Ernie Brickell

IPC分类号： H04L9/32

CPC分类号： H04L9/3247 ,  G06F21/53 ,  G06F21/74

摘要： Embodiments of an invention for offloading functionality from a secure processing environment are disclosed. In one embodiment, a processor includes an instruction unit and an execution unit. The instruction unit is to receive an instruction to initialize a secure enclave. The execution unit is to execute the instruction. Execution of the instruction includes verifying that a signature structure key matches a hardware key that permits functionality to be offloaded.

摘要翻译： 公开了一种用于从安全处理环境卸载功能的发明的实施例。 在一个实施例中，处理器包括指令单元和执行单元。 指令单元将接收初始化安全飞地的指令。 执行单元执行指令。 指令的执行包括验证签名结构密钥与允许卸载功能的硬件密钥相匹配。

公开(公告)号：US20150033316A1

公开(公告)日：2015-01-29

申请号：US13949213

申请日：2013-07-23

申请人： Vincent Scarlata ,  Carlos Rozas ,  Simon Johnson ,  Uday Savagaonkar ,  Ittai Anati ,  Francis McKeen ,  Michael Goldsmith

发明人： Vincent Scarlata ,  Carlos Rozas ,  Simon Johnson ,  Uday Savagaonkar ,  Ittai Anati ,  Francis McKeen ,  Michael Goldsmith

IPC分类号： G06F21/10 ,  H04L9/32

CPC分类号： H04L9/3213 ,  G06F21/12 ,  G06F21/53 ,  H04L9/3263

摘要： Embodiments of an invention for feature licensing in a secure processing environment are disclosed. In one embodiment, a processor includes an instruction unit and an execution unit. The instruction unit is to receive an instruction to initialize a secure enclave. The execution unit is to execute the instruction. Execution of the instruction includes determining whether a requested feature is licensed for use in the secure enclave.

摘要翻译： 公开了在安全处理环境中的特征许可的发明的实施例。 在一个实施例中，处理器包括指令单元和执行单元。 指令单元将接收初始化安全飞地的指令。 执行单元执行指令。 指令的执行包括确定所请求的特征是否被许可用于安全飞地。

公开(公告)号：US20060020781A1

公开(公告)日：2006-01-26

申请号：US10876994

申请日：2004-06-24

申请人： Vincent Scarlata ,  Carlos Rozas

发明人： Vincent Scarlata ,  Carlos Rozas

IPC分类号： G06F1/24

CPC分类号： G06F21/57 ,  G06F9/45558 ,  G06F21/53 ,  G06F2009/45587

摘要： A method and a related apparatus provide a virtual trusted platform module (TPM). In an example embodiment, a virtual TPM service creates a virtual TPM for use in a processing system that contains a physical TPM. The virtual TPM service may store a key for the virtual TPM in the physical TPM. The virtual TPM service may then use the virtual TPM to provide emulated physical TPM features. In one embodiment, the virtual TPM service may use the virtual TPM to emulate a physical TPM for a virtual machine in the processing system. Other embodiments are described and claimed.

公开(公告)号：US20070006169A1

公开(公告)日：2007-01-04

申请号：US11170853

申请日：2005-06-30

申请人： Alexander Iliev ,  Vincent Scarlata ,  Carlos Rozas

发明人： Alexander Iliev ,  Vincent Scarlata ,  Carlos Rozas

IPC分类号： G06F9/44

CPC分类号： G06F21/57 ,  G06F21/72 ,  G06F2221/2141 ,  H04L9/0897

摘要： A method and apparatus for binding trusted platform module (TPM) keys to execution entities are described. In one embodiment, the method includes the receipt of an authorization request issued by an execution entity for authorization data. According to the authorization request, the execution entity may be measured to generate an entity digest value. Once the entity digest value is generated, a platform reference module may grant the authorization request if the entity digest value verifies that the execution entity is an owner of the key held by the TPM. Accordingly, in one embodiment, a platform reference module, rather than an execution entity, holds the authorization data required by a TPM to use a key owned by the execution entity and held within sealed storage by the TPM. Other embodiments are described and claimed.

摘要翻译： 描述了将可信平台模块（TPM）密钥绑定到执行实体的方法和装置。 在一个实施例中，该方法包括接收由执行实体发出的授权数据的授权请求。 根据授权请求，可以测量执行实体以生成实体摘要值。 一旦生成实体摘要值，如果实体摘要值验证执行实体是TPM持有的密钥的所有者，则平台引用模块可以授予授权请求。 因此，在一个实施例中，平台参考模块而不是执行实体保存TPM所需的授权数据，以使用由执行实体拥有的密钥并由TPM保存在密封存储器内。 描述和要求保护其他实施例。

公开(公告)号：US20060256105A1

公开(公告)日：2006-11-16

申请号：US11171133

申请日：2005-06-29

申请人： Vincent Scarlata ,  Carlos Rozas

发明人： Vincent Scarlata ,  Carlos Rozas

IPC分类号： G06T1/00

CPC分类号： G06F21/72 ,  G06F21/53 ,  G06F21/552 ,  G06F21/577 ,  G06F21/602 ,  G06F21/74 ,  G06F21/79 ,  G06F2221/2103 ,  G06F2221/2105 ,  G06F2221/2149

摘要： A virtual security coprocessor framework supports creation of at least one device model to emulate a predetermined cryptographic coprocessor. In one embodiment, the virtual security coprocessor framework uses a cryptographic coprocessor in a processing system to create an instance of the device model (DM) in the processing system. The DM may be based at least in part on a predetermined device model design. The DM may emulate the predetermined cryptographic coprocessor in accordance with the control logic of the device model design. In one embodiment, the virtual security coprocessor framework uses a physical trusted platform module (TPM) in a processing system to support one or more virtual TPMs (vTPMs) for one or more virtual machines (VMs) in the processing system. Other embodiments are described and claimed.

公开(公告)号：US20160117265A1

公开(公告)日：2016-04-28

申请号：US14525421

申请日：2014-10-28

申请人： Francis X. MCKEEN ,  Vincent Scarlata ,  Carlos Rozas ,  Ittai Anati ,  Vedvyas Shanbhogue

发明人： Francis X. MCKEEN ,  Vincent Scarlata ,  Carlos Rozas ,  Ittai Anati ,  Vedvyas Shanbhogue

IPC分类号： G06F12/14 ,  G06F12/08

CPC分类号： G06F12/1416 ,  G06F9/4418 ,  G06F12/0804 ,  G06F12/0875 ,  G06F12/1408 ,  G06F12/1441 ,  G06F21/53 ,  G06F2212/1016 ,  G06F2212/1028 ,  G06F2212/1052 ,  G06F2212/152 ,  G06F2212/452 ,  Y02D10/13

摘要： Embodiments of an invention for maintaining a secure processing environment across power cycles are disclosed. In one embodiment, a processor includes an instruction unit and an execution unit. The instruction unit is to receive an instruction to evict a root version array page entry from a secure cache. The execution unit is to execute the instruction. Execution of the instruction includes generating a blob to contain information to maintain a secure processing environment across a power cycle and storing the blob in a non-volatile memory.

摘要翻译： 公开了用于在电力周期内保持安全处理环境的发明的实施例。 在一个实施例中，处理器包括指令单元和执行单元。 指令单元接收从安全缓存驱逐根版本阵列页条目的指令。 执行单元执行指令。 该指令的执行包括生成一个blob以包含信息以在整个电源周期内维护一个安全的处理环境，并将该blob存储在一个非易失性存储器中。

公开(公告)号：US20060256106A1

公开(公告)日：2006-11-16

申请号：US11171134

申请日：2005-06-29

申请人： Vincent Scarlata ,  Carlos Rozas

发明人： Vincent Scarlata ,  Carlos Rozas

IPC分类号： G06T1/00

CPC分类号： H04L63/0823 ,  G06F21/53 ,  G06F21/552 ,  G06F21/57 ,  G06F21/577 ,  G06F21/602 ,  G06F21/72 ,  G06F21/74 ,  G06F2221/2103 ,  G06F2221/2105 ,  G06F2221/2149 ,  H04L63/0876

摘要： A first processing system determines whether a second processing system provides a trustworthy state for supporting a virtual security coprocessor. In response to determining that the second processing system provides a trustworthy state for supporting the virtual security coprocessor, the first processing system transfers the virtual security coprocessor to the second processing system. In one embodiment, the first processing system receives a key and proof of bindings of the key from the second processing system. The first processing system may determine whether the second processing system provides a trustworthy state for migration of the virtual security coprocessor, based at least in part on the proof of bindings received from the second processing system. After the second processing system receives the virtual security coprocessor, the virtual security coprocessor may be removed from the first processing system. Other embodiments are described and claimed.

公开(公告)号：US20150186272A1

公开(公告)日：2015-07-02

申请号：US14142838

申请日：2013-12-28

申请人： Michael Goldsmith ,  Carlos Rozas ,  Vincent Scarlata

发明人： Michael Goldsmith ,  Carlos Rozas ,  Vincent Scarlata

IPC分类号： G06F12/08

CPC分类号： G06F12/084 ,  G06F9/468 ,  G06F12/1483 ,  G06F21/606 ,  G06F21/71 ,  G06F21/79 ,  G06F2212/608 ,  G06F2221/2141

摘要： Embodiments of an invention for sharing memory in a secure processing environment are disclosed. In one embodiment, a processor includes an instruction unit and an execution unit. The instruction unit is to receive an instruction to match an offer to make a page in an enclave page cache shareable to a bid to make the page shareable. The execution unit is to execute the instruction. Execution of the instruction includes making the page shareable.

摘要翻译： 公开了一种用于在安全处理环境中共享存储器的发明的实施例。 在一个实施例中，处理器包括指令单元和执行单元。 该指令单元将接收一个指令以匹配报价，使得在飞地页面缓存中的页面可共享到出价以使页面可共享。 执行单元执行指令。 执行该指令包括使页面可共享。

公开(公告)号：US20090086979A1

公开(公告)日：2009-04-02

申请号：US11864512

申请日：2007-09-28

申请人： Tasneem Brutch ,  Alok Kumar ,  Vincent Scarlata ,  Faraz A. Siddiqi ,  Ned M. Smith ,  Willard M. Wiseman

发明人： Tasneem Brutch ,  Alok Kumar ,  Vincent Scarlata ,  Faraz A. Siddiqi ,  Ned M. Smith ,  Willard M. Wiseman

IPC分类号： H04L9/08

CPC分类号： H04L9/0836 ,  H04L2209/127

摘要： The present subject matter related to trusted computing, and more particularly, to virtual trusted platform module keys rooted in a hardware trusted platform module. Some embodiments include a trusted platform virtualization module operable to capture virtual machine trusted platform module calls and operates to generate, maintain, and utilize hardware trusted platform module keys on behalf of the one or more virtual machines. Some embodiments include virtual trusted platform module keys having a public portion on top of an private portion including an encrypted hardware trusted platform module key.

摘要翻译： 与可信计算相关的本主题，更具体地，涉及植根于硬件可信平台模块中的虚拟可信平台模块键。 一些实施例包括可操作以捕获虚拟机可信平台模块调用并且代表一个或多个虚拟机生成，维护和利用硬件可信平台模块密钥的可信平台虚拟化模块。 一些实施例包括虚拟可信平台模块密钥，其具有位于私有部分之上的公共部分，包括加密的硬件可信平台模块密钥。