专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

1. 发明申请

WO2017210145A1 FLEXIBLE PROVISIONING OF ATTESTATION KEYS IN SECURE ENCLAVES 审中-公开
标题翻译：在安全环境中灵活地提供证明密钥
公开(公告)号：WO2017210145A1
公开(公告)日：2017-12-07
申请号：PCT/US2017/034897
申请日：2017-05-28
申请人： INTEL CORPORATION
发明人： SCARLATA, Vincent R. , MCKEEN, Francis X. , ROZAS, Carlos V. , JOHNSON, Simon P. , ZHANG, Bo , BEANEY, JR., James D. , ZMIJEWSKI, Piotr , SMITH, Wesley Hamilton , CABRE, Eduardo
IPC分类号： G06F21/53 , G06F21/62 , H04L9/08
CPC分类号： H04L9/3252 , G06F21/44 , G06F21/53 , G09C1/00 , H04L9/0866 , H04L9/14 , H04L9/302 , H04L9/3066 , H04L9/3234 , H04L9/3247 , H04L9/3249 , H04L63/06 , H04L63/062 , H04L63/0823 , H04L63/12 , H04L2209/127
摘要： A computing platform implements one or more secure enclaves including a first provisioning enclave to interface with a first provisioning service to obtain a first attestation key from the first provisioning service, a second provisioning enclave to interface with a different, second provisioning service to obtain a second attestation key from the second provisioning service, and a provisioning certification enclave to sign first data from the first provisioning enclave and second data from the second provisioning enclave using a hardware-based provisioning attestation key. The signed first data is used by the first provisioning enclave to authenticate to the first provisioning service to obtain the first attestation key and the signed second data is used by the second provisioning enclave to authenticate to the second provisioning service to obtain the second attestation key.
摘要翻译：计算平台实现一个或多个安全区域，所述安全区域包括第一供应区域和第一供应服务，以从第一供应服务获得第一认证密钥，第二供应区域与不同的，第二供应服务以从第二供应服务获得第二认证密钥，以及供应认证区域，以使用基于硬件的供应认证密钥来对来自第一供应区域的第一数据和来自第二供应区域的第二数据进行签名。经签名的第一数据由第一供应区域用于向第一供应服务认证以获得第一认证密钥，并且由第二供应区域使用经签署的第二数据来向第二供应服务认证以获得第二认证密钥。

2. 发明申请

WO2014105161A1 MEMORY MANAGEMENT IN SECURE ENCLAVES 审中-公开
标题翻译：内存管理在安全的包装
公开(公告)号：WO2014105161A1
公开(公告)日：2014-07-03
申请号：PCT/US2013/047339
申请日：2013-06-24
申请人： INTEL CORPORATION , LESLIE-HURD, Rebekah , ROZAS, Carlos V. , SCARLATA, Vincent R. , JOHNSON, Simon P. , SAVAGAONKAR, Uday R. , HUNTLEY, Barry E. , SHANBHOGUE, Vedvyas , ANATI, Ittai , MCKEEN, Francis X. , GOLDSMITH, Michael A. , ALEXANDROVICH, Ilya , BERENZON, Alex , SMITH, Wesley H. , NEIGER, Gilbert
发明人： LESLIE-HURD, Rebekah , ROZAS, Carlos V. , SCARLATA, Vincent R. , JOHNSON, Simon P. , SAVAGAONKAR, Uday R. , HUNTLEY, Barry E. , SHANBHOGUE, Vedvyas , ANATI, Ittai , MCKEEN, Francis X. , GOLDSMITH, Michael A. , ALEXANDROVICH, Ilya , BERENZON, Alex , SMITH, Wesley H. , NEIGER, Gilbert
IPC分类号： G06F12/14 , G06F12/08
CPC分类号： G06F9/3004 , G06F9/30047 , G06F9/30076 , G06F9/44 , G06F12/084 , G06F12/0875 , G06F12/1483 , G06F2212/452
摘要： Embodiments of an invention for memory management in secure enclaves are disclosed. In one embodiment, a processor includes an instruction unit and an execution unit. The instruction unit is to receive a first instruction and a second instruction. The execution unit is to execute the first instruction, wherein execution of the first instruction includes allocating a page in an enclave page cache to a secure enclave. The execution unit is also to execute the second instruction, wherein execution of the second instruction includes confirming the allocation of the page.
摘要翻译：公开了用于安全飞行器中的存储器管理的发明的实施例。在一个实施例中，处理器包括指令单元和执行单元。指令单元接收第一指令和第二指令。执行单元执行第一指令，其中第一指令的执行包括将飞地页面缓存中的页面分配到安全飞地。执行单元还执行第二指令，其中第二指令的执行包括确认页的分配。

3. 发明申请

WO2018005384A1 DATA SECURITY IN A CLOUD NETWORK 审中-公开
标题翻译：云网络中的数据安全
公开(公告)号：WO2018005384A1
公开(公告)日：2018-01-04
申请号：PCT/US2017/039331
申请日：2017-06-26
申请人： INTEL CORPORATION
发明人： SCARLATA, Vincent R. , MCKEEN, Francis X. , ROZAS, Carlos V. , JOHNSON, Simon P. , ZHANG, Bo , VIJ, Mona , BAKER, Brandon , KUMAR, Mohan J. , MALLICK, Asit K. , GENTRY, Mark A. , CHAKRABARTI, Somnath
IPC分类号： G06F21/60 , G06F21/62 , H04L29/06 , H04L9/08
CPC分类号： H04L9/0816 , G06F21/6218 , H04L9/0861 , H04L9/088 , H04L9/0894 , H04L9/14 , H04L63/06
摘要： Particular embodiments described herein provide for an electronic device that can be configured to store data in a secure domain in a cloud network, create encryption keys, where each encryption key is to provide a different type of access to the data, and store the encryption keys in a secure domain key store in the cloud network. In an example, each encryption key provides access to a different version of the data. In another example, a counter engine stores the location of each version of the data in the cloud network.
摘要翻译：这里描述的特定实施例提供了一种电子设备，其可以被配置为将数据存储在云网络中的安全域中，创建加密密钥，其中每个加密密钥将提供对数据，并将加密密钥存储在云网络中的安全域密钥存储中。在一个示例中，每个加密密钥提供对不同版本的数据的访问。在另一个例子中，计数器引擎将每个数据版本的位置存储在云网络中。

4. 发明申请

WO2017014858A1 SUPPORTING CONFIGURABLE SECURITY LEVELS FOR MEMORY ADDRESS RANGES 审中-公开
标题翻译：支持存储地址范围的可配置安全级别
公开(公告)号：WO2017014858A1
公开(公告)日：2017-01-26
申请号：PCT/US2016/037011
申请日：2016-06-10
申请人： INTEL CORPORATION
发明人： BHATTACHARYYA, Binata , MAKARAM, Raghunandan , SANTONI, Amy L. , CHRYSOS, George Z. , JOHNSON, Simon P. , MORRIS, Brian S. , MCKEEN, Francis X.
IPC分类号： G06F21/79 , G06F21/62 , G06F12/14
CPC分类号： G06F21/62 , G06F21/602 , G06F21/64 , G06F21/78 , G06F2221/2113
摘要： A processor implementing techniques for supporting configurable security levels for memory address ranges is disclosed. In one embodiment, the processor includes a processing core a memory controller, operatively coupled to the processing core, to access data in an off chip memory and a memory encryption engine (MEE) operatively coupled to the memory controller. The MEE is to responsive to detecting a memory access operation with respect to a memory location identified by a memory address within a memory address range associated with the off-chip memory, identify a security level indicator associated with the memory location based on a value stored on a security range register. The MEE is further to access at least a portion of a data item associated with the memory address range of the off-chip memory in view of the security level indicator.
摘要翻译：公开了一种实现用于支持存储器地址范围的可配置安全级别的技术的处理器。在一个实施例中，处理器包括处理核心，存储器控制器，可操作地耦合到处理核心，以访问非芯片存储器中的数据和可操作地耦合到存储器控制器的存储器加密引擎（MEE）。所述MEE响应于检测相对于与所述片外存储器相关联的存储器地址范围内的存储器地址识别的存储器位置的存储器访问操作，基于存储的值来识别与所述存储器位置相关联的安全级别指示符在安全范围寄存器上。鉴于安全级别指示符，MEE进一步访问与片外存储器的存储器地址范围相关联的数据项的至少一部分。

5. 发明申请

WO2016073114A1 SYSTEM FOR ESTABLISHING OWNERSHIP OF A SECURE WORKSPACE 审中-公开
标题翻译：建立安全工作场所所有权制度
公开(公告)号：WO2016073114A1
公开(公告)日：2016-05-12
申请号：PCT/US2015/054186
申请日：2015-10-06
申请人： INTEL CORPORATION
发明人： JOHNSON, Simon P. , ALTMAN, Asher M. , DAS, Abhishek , SCARLATA, Vincent R.
IPC分类号： H04L9/32 , H04L9/08 , H04L9/14
CPC分类号： H04L63/0876 , G06F21/51 , G06F21/53 , G06F21/57 , G06F21/60 , H04L63/061 , H04L63/08
摘要： The present application is directed to establishing ownership of a secure workspace (SW). A client device may provide a SW data structure (SWDS) to a SW configurator. A SWDS may comprise a hash of an original SW and a public key, and may be signed by a private key corresponding to the public key. The SW configurator may cause an execution container (EC) to be generated including a SW initiated using the SWDS. The client device may claim SW ownership using a request (signed by the private key) transmitted along with a copy of the public key. SW ownership may be determined by an ownership determination module that verifies the signature of the request using the public key received with the request, determines a hash of the received public key and compares the hash of the received public key to a hash of the public key in the SWDS.
摘要翻译：本申请旨在建立安全工作区（SW）的所有权。客户端设备可以向SW配置器提供SW数据结构（SWDS）。 SWDS可以包括原始SW和公共密钥的散列，并且可以由对应于公开密钥的私有密钥进行签名。 SW配置程序可能会导致生成执行容器（EC），包括使用SWDS启动的SW。客户端设备可以使用与公钥的副本一起发送的请求（由私钥签名）来声明SW所有权。 SW所有权可以由所有权确定模块确定，该模块使用通过该请求接收到的公开密钥来验证请求的签名，确定所接收的公开密钥的散列，并将接收到的公开密钥的散列与公钥的散列进行比较在SWDS。

6. 发明申请

WO2015047789A1 SECURE MEMORY REPARTITIONING 审中-公开
标题翻译：安全记忆重写
公开(公告)号：WO2015047789A1
公开(公告)日：2015-04-02
申请号：PCT/US2014/055807
申请日：2014-09-16
申请人： INTEL CORPORATION , CHHABRA, Siddhartha , SAVAGAONKAR, Uday R. , GOLDSMITH, Michael A. , JOHNSON, Simon P. , LESLIE-HURD, Rebekah M. , MCKEEN, Francis X. , NEIGER, Gilbert , MAKARAM, Raghunandan , ROZAS, Carlos V. , SANTONI, Amy L. , SCARLATA, Vincent R. , SHANBHOGUE, Vedvyas , SMITH, Wesley H. , ANATI, Ittai , ALEXANDROVICH, Ilya
发明人： CHHABRA, Siddhartha , SAVAGAONKAR, Uday R. , GOLDSMITH, Michael A. , JOHNSON, Simon P. , LESLIE-HURD, Rebekah M. , MCKEEN, Francis X. , NEIGER, Gilbert , MAKARAM, Raghunandan , ROZAS, Carlos V. , SANTONI, Amy L. , SCARLATA, Vincent R. , SHANBHOGUE, Vedvyas , SMITH, Wesley H. , ANATI, Ittai , ALEXANDROVICH, Ilya
IPC分类号： G06F21/79 , G06F12/14
CPC分类号： G06F12/1408 , G06F9/45558 , G06F12/0808 , G06F12/0897 , G06F12/1027 , G06F2009/45587 , G06F2212/1032 , G06F2212/1048 , G06F2212/152
摘要： Secure memory repartitioning technologies are described. A processor includes a processor core and a memory controller coupled between the processor core and main memory. The main memory includes a memory range including a section of convertible pages are convertible to secure pages or non-secure pages. The processor core, in response to a page conversion instruction, is to determine from the instruction a convertible page in the memory range to be converted and convert the convertible page to be at least one of a secure page or a non-secure page. The memory range may also include a hardware reserved section are convertible in response to a section conversion instruction.
摘要翻译：描述了安全的内存重新分区技术。处理器包括耦合在处理器核心和主存储器之间的处理器核心和存储器控制器。主存储器包括一个内存范围，包括可转换页面的一部分可转换为安全页面或非安全页面。响应于页面转换指令的处理器核心是从指令中确定要转换的存储器范围内的可转换页面，并将可转换页面转换为安全页面或非安全页面中的至少一个页面。存储器范围还可以包括可响应于段转换指令而转换的硬件保留部分。

7. 发明申请

WO2017112908A1 INSTRUCTIONS AND LOGIC TO SUSPEND/RESUME MIGRATION OF ENCLAVES IN A SECURE ENCLAVE PAGE CACHE 审中-公开
标题翻译：指示和逻辑在挂起页面缓存中暂停/恢复Enclve的迁移
公开(公告)号：WO2017112908A1
公开(公告)日：2017-06-29
申请号：PCT/US2016/068447
申请日：2016-12-22
申请人： INTEL CORPORATION
发明人： ROZAS, Carlos V. , ALEXANDROVICH, Ilya , NEIGER, Gilbert , MCKEEN, Francis X. , ANATI, Ittai , SHANBHOGUE, Vedvyas , VIJ, Mona , LESLIE-HURD, Rebekah M. , ZMUDZINSKI, Krystof C. , CHAKRABARTI, Somnath , SCARLATA, Vincent R. , JOHNSON, Simon P.
IPC分类号： G06F12/14
CPC分类号： G06F12/1408 , G06F12/0802 , G06F12/1466 , G06F2212/1052 , G06F2212/402 , G06F2212/60 , H04L9/0891 , H04L9/0894 , H04L9/14 , H04L9/32 , H04L9/3226
摘要： Instructions and logic support suspending and resuming migration of enclaves in a secure enclave page cache (EPC). An EPC stores a secure domain control structure (SDCS) in storage accessible by an enclave for a management process, and by a domain of enclaves. A second processor checks if a corresponding version array (VA) page is bound to the SDCS, and if so: increments a version counter in the SDCS for the page, performs an authenticated encryption of the page from the EPC using the version counter in the SDCS, and writes the encrypted page to external memory. A second processor checks if a corresponding VA page is bound to a second SDCS of the second processor, and if so: performs an authenticated decryption of the page using a version counter in the second SDCS, and loads the decrypted page to the EPC in the second processor if authentication passes.
摘要翻译：
指令和逻辑支持暂停和恢复安全区域页面缓存（EPC）中的区域迁移。 EPC将安全域控制结构（SDCS）存储在可由管理进程的飞地访问的存储中，并且通过飞地域来存储。第二个处理器检查相应版本阵列（VA）页面是否绑定到SDCS，如果是：在页面的SDCS中递增版本计数器，使用版本计数器在EPC中使用版本计数器对EPC进行认证加密 SDCS，并将加密的页面写入外部存储器。第二处理器检查相应的VA页面是否绑定到第二处理器的第二SDCS，并且如果是：使用第二SDCS中的版本计数器执行对页面的认证解密，并且将解密的页面加载到EPC中的第二个处理器，如果验证通过。

8. 发明申请

WO2017030822A1 PLATFORM MIGRATION OF SECURE ENCLAVES 审中-公开
标题翻译：平台安全移民安全
公开(公告)号：WO2017030822A1
公开(公告)日：2017-02-23
申请号：PCT/US2016/046062
申请日：2016-08-08
申请人： INTEL CORPORATION
发明人： ROZAS, Carlos V. , VIJ, Mona , LESLIE-HURD, Rebekah M. , ZMUDZINSKI, Krystof C. , CHAKRABARTI, Somnath , MCKEEN, Francis X. , SCARLATA, Vincent R. , JOHNSON, Simon P. , ALEXANDROVICH, Ilya
IPC分类号： G06F12/14
CPC分类号： H04L9/0891 , G06F9/45558 , G06F2009/45575 , G06F2009/45587 , H04L63/061 , H04L63/10 , H04L67/34
摘要： A processor to support platform migration of secure enclaves is disclosed. In one embodiment, the processor includes a memory controller unit to access secure enclaves and a processor core coupled to the memory controller unit. The processor core to identify a control structure associated with a secure enclave. The control structure comprises a plurality of data slots and keys associated with a first platform comprising the memory controller unit and the processor core. A version of data from the secure enclave is associated with the plurality of data slots. Migratable keys are generated as a replacement for the keys associated with the control structure. The migratable keys control access to the secure enclave. Thereafter, the control structure is migrated to a second platform to enable access to the secure enclave on the second platform.
摘要翻译：公开了一种用于支持安全飞行器的平台迁移的处理器。在一个实施例中，处理器包括存储器控制器单元以访问安全的包围层和耦合到存储器控制器单元的处理器核心。处理器核心，用于识别与安全飞地相关联的控制结构。控制结构包括与包括存储器控制器单元和处理器核心的第一平台相关联的多个数据时隙和密钥。来自安全飞地的数据的版本与多个数据时隙相关联。生成可迁移键作为与控制结构相关联的键的替代。可移植键控制对安全飞地的访问。此后，将控制结构迁移到第二平台以使得能够访问第二平台上的安全飞地。

9. 发明申请

WO2014105160A1 LOGGING IN SECURE ENCLAVES 审中-公开
标题翻译：登录在安全的包装
公开(公告)号：WO2014105160A1
公开(公告)日：2014-07-03
申请号：PCT/US2013/047332
申请日：2013-06-24
申请人： INTEL CORPORATION , MCKEEN, Francis X. , GOLDSMITH, Michael A. , HUNTLEY, Barrey E. , JOHNSON, Simon P. , LESLIE-HURD, Rebekah , ROZAS, Carlos V. , SAVAGAONKAR, Uday R. , SCARLATA, Vincent R. , SHANBHOGUE, Vedvyas , SMITH, Wesley H. , NEIGER, Gilbert
发明人： MCKEEN, Francis X. , GOLDSMITH, Michael A. , HUNTLEY, Barrey E. , JOHNSON, Simon P. , LESLIE-HURD, Rebekah , ROZAS, Carlos V. , SAVAGAONKAR, Uday R. , SCARLATA, Vincent R. , SHANBHOGUE, Vedvyas , SMITH, Wesley H. , NEIGER, Gilbert
IPC分类号： G06F12/14 , G06F12/08
CPC分类号： G06F21/60 , G06F12/0875 , G06F12/14 , G06F12/145 , G06F21/72 , G06F2212/1052 , G06F2212/152 , G06F2212/452
摘要： Embodiments of an invention for logging in secure enclaves are disclosed. In one embodiment, a processor includes an instruction unit and an execution unit. The instruction unit is to receive an instruction having an associated enclave page cache address. The execution unit is to execute the instruction without causing a virtual machine exit, wherein execution of the instruction includes logging the instruction and the associated enclave page cache address.
摘要翻译：公开了用于登录安全飞行器的发明的实施例。在一个实施例中，处理器包括指令单元和执行单元。该指令单元用于接收具有关联的飞地页面缓存地址的指令。执行单元执行指令而不引起虚拟机退出，其中指令的执行包括记录指令和关联的飞地页面缓存地址。

10. 发明申请

WO2014105159A1 PAGING IN SECURE ENCLAVES 审中-公开
标题翻译：寻找安全的包装
公开(公告)号：WO2014105159A1
公开(公告)日：2014-07-03
申请号：PCT/US2013/047322
申请日：2013-06-24
申请人： INTEL CORPORATION , MCKEEN, Francis X. , GOLDSMITH, Michael A. , HUNTLEY, Barry E. , JOHNSON, Simon P. , LESLIE-HURD, Rebekah , ROZAS, Carlos V. , SAVAGAONKAR, Uday R. , SCARLATA, Vincent R. , SHANBHOGUE, Vedvyas , SMITH, Wesley H. , ANATI, Ittai , ALEXANDROVICH, Ilya , BERENZON, Alex , NEIGER, Gilbert
发明人： MCKEEN, Francis X. , GOLDSMITH, Michael A. , HUNTLEY, Barry E. , JOHNSON, Simon P. , LESLIE-HURD, Rebekah , ROZAS, Carlos V. , SAVAGAONKAR, Uday R. , SCARLATA, Vincent R. , SHANBHOGUE, Vedvyas , SMITH, Wesley H. , ANATI, Ittai , ALEXANDROVICH, Ilya , BERENZON, Alex , NEIGER, Gilbert
IPC分类号： G06F12/14
CPC分类号： G06F12/0804 , G06F9/30047 , G06F12/0875 , G06F12/1408 , G06F2212/1052 , G06F2212/402
摘要： Embodiments of an invention for paging in secure enclaves are disclosed. In one embodiment, a processor includes an instruction unit and an execution unit. The instruction unit is to receive a first instruction. The execution unit is to execute the first instruction, wherein execution of the first instruction includes evicting a first page from an enclave page cache.
摘要翻译：公开了用于在安全飞行器中寻呼的发明的实施例。在一个实施例中，处理器包括指令单元和执行单元。指令单元接收第一条指令。执行单元执行第一指令，其中第一指令的执行包括从飞地页面缓存中逐出第一页。

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式