公开(公告)号：US20150033316A1

公开(公告)日：2015-01-29

申请号：US13949213

申请日：2013-07-23

申请人： Vincent Scarlata ,  Carlos Rozas ,  Simon Johnson ,  Uday Savagaonkar ,  Ittai Anati ,  Francis McKeen ,  Michael Goldsmith

发明人： Vincent Scarlata ,  Carlos Rozas ,  Simon Johnson ,  Uday Savagaonkar ,  Ittai Anati ,  Francis McKeen ,  Michael Goldsmith

IPC分类号： G06F21/10 ,  H04L9/32

CPC分类号： H04L9/3213 ,  G06F21/12 ,  G06F21/53 ,  H04L9/3263

摘要： Embodiments of an invention for feature licensing in a secure processing environment are disclosed. In one embodiment, a processor includes an instruction unit and an execution unit. The instruction unit is to receive an instruction to initialize a secure enclave. The execution unit is to execute the instruction. Execution of the instruction includes determining whether a requested feature is licensed for use in the secure enclave.

摘要翻译： 公开了在安全处理环境中的特征许可的发明的实施例。 在一个实施例中，处理器包括指令单元和执行单元。 指令单元将接收初始化安全飞地的指令。 执行单元执行指令。 指令的执行包括确定所请求的特征是否被许可用于安全飞地。

公开(公告)号：US20150188710A1

公开(公告)日：2015-07-02

申请号：US14142837

申请日：2013-12-28

申请人： Simon Johnson ,  Francis McKeen ,  Vincent Scarlata ,  Carlos Rozas ,  Uday Savagaonkar ,  Michael Goldsmith ,  Ernie Brickell

发明人： Simon Johnson ,  Francis McKeen ,  Vincent Scarlata ,  Carlos Rozas ,  Uday Savagaonkar ,  Michael Goldsmith ,  Ernie Brickell

IPC分类号： H04L9/32

CPC分类号： H04L9/3247 ,  G06F21/53 ,  G06F21/74

摘要： Embodiments of an invention for offloading functionality from a secure processing environment are disclosed. In one embodiment, a processor includes an instruction unit and an execution unit. The instruction unit is to receive an instruction to initialize a secure enclave. The execution unit is to execute the instruction. Execution of the instruction includes verifying that a signature structure key matches a hardware key that permits functionality to be offloaded.

摘要翻译： 公开了一种用于从安全处理环境卸载功能的发明的实施例。 在一个实施例中，处理器包括指令单元和执行单元。 指令单元将接收初始化安全飞地的指令。 执行单元执行指令。 指令的执行包括验证签名结构密钥与允许卸载功能的硬件密钥相匹配。

公开(公告)号：US20160117265A1

公开(公告)日：2016-04-28

申请号：US14525421

申请日：2014-10-28

申请人： Francis X. MCKEEN ,  Vincent Scarlata ,  Carlos Rozas ,  Ittai Anati ,  Vedvyas Shanbhogue

发明人： Francis X. MCKEEN ,  Vincent Scarlata ,  Carlos Rozas ,  Ittai Anati ,  Vedvyas Shanbhogue

IPC分类号： G06F12/14 ,  G06F12/08

CPC分类号： G06F12/1416 ,  G06F9/4418 ,  G06F12/0804 ,  G06F12/0875 ,  G06F12/1408 ,  G06F12/1441 ,  G06F21/53 ,  G06F2212/1016 ,  G06F2212/1028 ,  G06F2212/1052 ,  G06F2212/152 ,  G06F2212/452 ,  Y02D10/13

摘要： Embodiments of an invention for maintaining a secure processing environment across power cycles are disclosed. In one embodiment, a processor includes an instruction unit and an execution unit. The instruction unit is to receive an instruction to evict a root version array page entry from a secure cache. The execution unit is to execute the instruction. Execution of the instruction includes generating a blob to contain information to maintain a secure processing environment across a power cycle and storing the blob in a non-volatile memory.

摘要翻译： 公开了用于在电力周期内保持安全处理环境的发明的实施例。 在一个实施例中，处理器包括指令单元和执行单元。 指令单元接收从安全缓存驱逐根版本阵列页条目的指令。 执行单元执行指令。 该指令的执行包括生成一个blob以包含信息以在整个电源周期内维护一个安全的处理环境，并将该blob存储在一个非易失性存储器中。

公开(公告)号：US20150186272A1

公开(公告)日：2015-07-02

申请号：US14142838

申请日：2013-12-28

申请人： Michael Goldsmith ,  Carlos Rozas ,  Vincent Scarlata

发明人： Michael Goldsmith ,  Carlos Rozas ,  Vincent Scarlata

IPC分类号： G06F12/08

CPC分类号： G06F12/084 ,  G06F9/468 ,  G06F12/1483 ,  G06F21/606 ,  G06F21/71 ,  G06F21/79 ,  G06F2212/608 ,  G06F2221/2141

摘要： Embodiments of an invention for sharing memory in a secure processing environment are disclosed. In one embodiment, a processor includes an instruction unit and an execution unit. The instruction unit is to receive an instruction to match an offer to make a page in an enclave page cache shareable to a bid to make the page shareable. The execution unit is to execute the instruction. Execution of the instruction includes making the page shareable.

摘要翻译： 公开了一种用于在安全处理环境中共享存储器的发明的实施例。 在一个实施例中，处理器包括指令单元和执行单元。 该指令单元将接收一个指令以匹配报价，使得在飞地页面缓存中的页面可共享到出价以使页面可共享。 执行单元执行指令。 执行该指令包括使页面可共享。

公开(公告)号：US20140283098A1

公开(公告)日：2014-09-18

申请号：US13844101

申请日：2013-03-15

申请人： Vinay Phegade ,  Anand Rajan ,  Simon Johnson ,  Vincent Scarlata ,  Carlos Rozas ,  Nikhil Deshpande

发明人： Vinay Phegade ,  Anand Rajan ,  Simon Johnson ,  Vincent Scarlata ,  Carlos Rozas ,  Nikhil Deshpande

IPC分类号： G06F21/60

CPC分类号： H04L63/0428 ,  G06F21/57 ,  G06F21/60 ,  G06F21/64 ,  G06F2221/2105 ,  H04L63/126 ,  H04L63/302

摘要： An apparatus for sharing information between entities includes a processor and a trusted execution module executing on the processor. The trusted execution module is configured to receive first confidential information from a first client device associated with a first entity, seal the first confidential information within a trusted execution environment, receive second confidential information from a second client device associated with a second entity, seal the second confidential information within the trusted execution environment, and execute code within the trusted execution environment. The code is configured to compute a confidential result based upon the first confidential information and the second confidential information.

摘要翻译： 用于在实体之间共享信息的装置包括处理器和在处理器上执行的可信执行模块。 可信执行模块被配置为从与第一实体相关联的第一客户端设备接收第一机密信息，将可信执行环境中的第一机密信息密封，从与第二实体相关联的第二客户端设备接收第二机密信息， 可信执行环境中的第二机密信息，并在可信执行环境内执行代码。 代码被配置为基于第一机密信息和第二机密信息来计算机密结果。

公开(公告)号：US20060020781A1

公开(公告)日：2006-01-26

申请号：US10876994

申请日：2004-06-24

申请人： Vincent Scarlata ,  Carlos Rozas

发明人： Vincent Scarlata ,  Carlos Rozas

IPC分类号： G06F1/24

CPC分类号： G06F21/57 ,  G06F9/45558 ,  G06F21/53 ,  G06F2009/45587

摘要： A method and a related apparatus provide a virtual trusted platform module (TPM). In an example embodiment, a virtual TPM service creates a virtual TPM for use in a processing system that contains a physical TPM. The virtual TPM service may store a key for the virtual TPM in the physical TPM. The virtual TPM service may then use the virtual TPM to provide emulated physical TPM features. In one embodiment, the virtual TPM service may use the virtual TPM to emulate a physical TPM for a virtual machine in the processing system. Other embodiments are described and claimed.

公开(公告)号：US20070006169A1

公开(公告)日：2007-01-04

申请号：US11170853

申请日：2005-06-30

申请人： Alexander Iliev ,  Vincent Scarlata ,  Carlos Rozas

发明人： Alexander Iliev ,  Vincent Scarlata ,  Carlos Rozas

IPC分类号： G06F9/44

CPC分类号： G06F21/57 ,  G06F21/72 ,  G06F2221/2141 ,  H04L9/0897

摘要： A method and apparatus for binding trusted platform module (TPM) keys to execution entities are described. In one embodiment, the method includes the receipt of an authorization request issued by an execution entity for authorization data. According to the authorization request, the execution entity may be measured to generate an entity digest value. Once the entity digest value is generated, a platform reference module may grant the authorization request if the entity digest value verifies that the execution entity is an owner of the key held by the TPM. Accordingly, in one embodiment, a platform reference module, rather than an execution entity, holds the authorization data required by a TPM to use a key owned by the execution entity and held within sealed storage by the TPM. Other embodiments are described and claimed.

摘要翻译： 描述了将可信平台模块（TPM）密钥绑定到执行实体的方法和装置。 在一个实施例中，该方法包括接收由执行实体发出的授权数据的授权请求。 根据授权请求，可以测量执行实体以生成实体摘要值。 一旦生成实体摘要值，如果实体摘要值验证执行实体是TPM持有的密钥的所有者，则平台引用模块可以授予授权请求。 因此，在一个实施例中，平台参考模块而不是执行实体保存TPM所需的授权数据，以使用由执行实体拥有的密钥并由TPM保存在密封存储器内。 描述和要求保护其他实施例。

公开(公告)号：US20060256105A1

公开(公告)日：2006-11-16

申请号：US11171133

申请日：2005-06-29

申请人： Vincent Scarlata ,  Carlos Rozas

发明人： Vincent Scarlata ,  Carlos Rozas

IPC分类号： G06T1/00

CPC分类号： G06F21/72 ,  G06F21/53 ,  G06F21/552 ,  G06F21/577 ,  G06F21/602 ,  G06F21/74 ,  G06F21/79 ,  G06F2221/2103 ,  G06F2221/2105 ,  G06F2221/2149

摘要： A virtual security coprocessor framework supports creation of at least one device model to emulate a predetermined cryptographic coprocessor. In one embodiment, the virtual security coprocessor framework uses a cryptographic coprocessor in a processing system to create an instance of the device model (DM) in the processing system. The DM may be based at least in part on a predetermined device model design. The DM may emulate the predetermined cryptographic coprocessor in accordance with the control logic of the device model design. In one embodiment, the virtual security coprocessor framework uses a physical trusted platform module (TPM) in a processing system to support one or more virtual TPMs (vTPMs) for one or more virtual machines (VMs) in the processing system. Other embodiments are described and claimed.

公开(公告)号：US20060256106A1

公开(公告)日：2006-11-16

申请号：US11171134

申请日：2005-06-29

申请人： Vincent Scarlata ,  Carlos Rozas

发明人： Vincent Scarlata ,  Carlos Rozas

IPC分类号： G06T1/00

CPC分类号： H04L63/0823 ,  G06F21/53 ,  G06F21/552 ,  G06F21/57 ,  G06F21/577 ,  G06F21/602 ,  G06F21/72 ,  G06F21/74 ,  G06F2221/2103 ,  G06F2221/2105 ,  G06F2221/2149 ,  H04L63/0876

摘要： A first processing system determines whether a second processing system provides a trustworthy state for supporting a virtual security coprocessor. In response to determining that the second processing system provides a trustworthy state for supporting the virtual security coprocessor, the first processing system transfers the virtual security coprocessor to the second processing system. In one embodiment, the first processing system receives a key and proof of bindings of the key from the second processing system. The first processing system may determine whether the second processing system provides a trustworthy state for migration of the virtual security coprocessor, based at least in part on the proof of bindings received from the second processing system. After the second processing system receives the virtual security coprocessor, the virtual security coprocessor may be removed from the first processing system. Other embodiments are described and claimed.

公开(公告)号：US20210110070A1

公开(公告)日：2021-04-15

申请号：US17131716

申请日：2020-12-22

申请人： Anjo Lucas Vahldiek-Oberwagner ,  Ravi L. Sahita ,  Mona Vij ,  Rameshkumar Illikkal ,  Michael Steiner ,  Thomas Knauth ,  Dmitrii Kuvaiskii ,  Sudha Krishnakumar ,  Krystof C. Zmudzinski ,  Vincent Scarlata ,  Francis McKeen

发明人： Anjo Lucas Vahldiek-Oberwagner ,  Ravi L. Sahita ,  Mona Vij ,  Rameshkumar Illikkal ,  Michael Steiner ,  Thomas Knauth ,  Dmitrii Kuvaiskii ,  Sudha Krishnakumar ,  Krystof C. Zmudzinski ,  Vincent Scarlata ,  Francis McKeen

IPC分类号： G06F21/79 ,  H04L9/14 ,  H04L9/32 ,  G06F12/14 ,  G06F3/06

摘要： Example methods and systems are directed to reducing latency in providing trusted execution environments (TEES). Initializing a TEE includes multiple steps before the TEE starts executing. Besides workload-specific initialization, workload-independent initialization is performed, such as adding memory to the TEE. In function-as-a-service (FaaS) environments, a large portion of the TEE is workload-independent, and thus can be performed prior to receiving the workload. Certain steps performed during TEE initialization are identical for certain classes of workloads. Thus, the common parts of the TEE initialization sequence may be performed before the TEE is requested. When a TEE is requested for a workload in the class and the parts to specialize the TEE for its particular purpose are known, the final steps to initialize the TEE are performed.