专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

11. 发明申请

WO2017218180A1 PLATFORM ATTESTATION AND REGISTRATION FOR SERVERS 审中-公开
标题翻译：平台验证和服务器注册
公开(公告)号：WO2017218180A1
公开(公告)日：2017-12-21
申请号：PCT/US2017/035080
申请日：2017-05-30
申请人： INTEL CORPORATION
发明人： SCARLATA, Vincent R. , MCKEEN, Francis X. , ROZAS, Carlos V. , JOHNSON, Simon P. , ZHANG, Bo , BEANEY, James D. , ZMIJEWSKI, Piotr , SMITH, Wesley Hamilton , CABRE, Eduardo , SAVAGAONKAR, Uday R.
IPC分类号： G06F21/62 , G06F21/50 , G06F21/60 , H04L9/30
CPC分类号： H04L9/3263 , G09C1/00 , H04L9/0816 , H04L9/0822 , H04L9/14 , H04L9/3268 , H04L63/06 , H04L63/0823 , H04L63/12
摘要： Embodiments include systems, methods, computer readable media, and devices configured to, for a first processor of a platform, generate a platform root key; create a data structure to encapsulate the platform root key, the data structure comprising a platform provisioning key and an identification of a registration service; and transmit, on a secure connection, the data structure to the registration service to register the platform root key for the first processor of the platform. Embodiments include systems, methods, computer readable media, and devices configured to store a device certificate received from a key generation facility; receive a manifest from a platform, the manifest comprising an identification of a processor associated with the platform; and validate the processor using a stored device certificate.
摘要翻译：实施例包括被配置为对于平台的第一处理器生成平台根密钥的系统，方法，计算机可读介质和设备; 创建数据结构以封装平台根密钥，所述数据结构包括平台供应密钥和注册服务的标识; 并且在安全连接上将所述数据结构传输到所述注册服务以注册用于所述平台的所述第一处理器的所述平台根密钥。实施例包括被配置为存储从密钥生成设施接收到的设备证书的系统，方法，计算机可读介质和设备; 从平台接收清单，所述清单包括与所述平台相关联的处理器的标识; 并使用存储的设备证书验证处理器。

12. 发明申请

WO2016209547A1 PROCESSORS, METHODS, SYSTEMS, AND INSTRUCTIONS TO SUPPORT LIVE MIGRATION OF PROTECTED CONTAINERS 审中-公开
标题翻译：处理者，方法，系统和支持保护集装箱移动的指示
公开(公告)号：WO2016209547A1
公开(公告)日：2016-12-29
申请号：PCT/US2016/034519
申请日：2016-05-27
申请人： INTEL CORPORATION
发明人： ROZAS, Carlos V. , VIJ, Mona , LESLIE-HURD, Rebekah M. , ZMUDZINSKI, Krystof C. , CHAKRABARTI, Somnath , MCKEEN, Francis X. , SCARLATA, Vincent R. , JOHNSON, Simon P. , ALEXANDROVICH, Ilya , NEIGER, Gilbert , SHANBHOGUE, Vedvyas , ANATI, Ittai
IPC分类号： H04L29/06 , H04L9/08 , H04L29/08
CPC分类号： G06F12/1408 , G06F9/30145 , G06F21/53 , G06F21/602 , G06F2212/1052
摘要： A processor includes a decode unit to decode an instruction that is to indicate a page of a protected container memory, and a storage location outside of the protected container memory. An execution unit, in response to the instruction, is to ensure that there are no writable references to the page of the protected container memory while it has a write protected state. The execution unit is to encrypt a copy of the page of the protected container memory. The execution unit is to store the encrypted copy of the page to the storage location outside of the protected container memory, after it has been ensured that there are no writable references. The execution unit is to leave the page of the protected container memory in the write protected state, which is also valid and readable, after the encrypted copy has been stored to the storage location.
摘要翻译：处理器包括解码单元，用于解码指示受保护的容器存储器的页面的指令以及受保护的容器存储器之外的存储位置。执行单元响应于该指令，是确保在受保护的容器存储器具有写保护状态时不存在对受保护的容器存储器的页的可写引用。执行单元是加密受保护的容器存储器的页面的副本。在确保没有可写入引用之后，执行单元将页面的加密副本存储到受保护的容器存储器外部的存储位置。执行单元将保护的容器存储器的页面保留在写保护状态中，该保护状态在加密的副本已被存储到存储位置之后也是有效和可读的。

13. 发明申请

WO2016048478A1 MEMORY INITIALIZATION IN A PROTECTED REGION 审中-公开
标题翻译：保护区的记忆初始化
公开(公告)号：WO2016048478A1
公开(公告)日：2016-03-31
申请号：PCT/US2015/045385
申请日：2015-08-14
申请人： INTEL CORPORATION
发明人： LESLIE-HURD, Rebekah M. , MCKEEN, Francis X. , ROZAS, Carlos V. , ZMUDZINSKI, Krystof C.
IPC分类号： G06F12/14 , G06F12/08 , G06F13/16
CPC分类号： G06F12/1441 , G06F9/52 , G06F21/53 , G06F21/74 , G06F21/79
摘要： Secure memory allocation technologies are described. A processor includes a processor core and a memory controller that is coupled between the processor core and main memory. The main memory comprises a protected region including secured pages. The processor, in response to a content copy instruction, is to initialize a target page in the protected region of an application address space. The processor, in response to the content copy instruction, is also to select content of a source page in the protected region to be copied. The processor, in response to the content copy instruction, is also to copy the selected content to the target page in the protected region of the application address space.
摘要翻译：描述了安全的内存分配技术。处理器包括耦合在处理器核心和主存储器之间的处理器核心和存储器控制器。主存储器包括保护区域，包括安全页面。响应于内容复制指令的处理器是初始化应用地址空间的受保护区域中的目标页面。处理器响应于内容复制指令，也是选择要复制的受保护区域中的源页面的内容。响应于内容复制指令，处理器还将所选择的内容复制到应用地址空间的受保护区域中的目标页面。

14. 发明申请

WO2015013062A1 MEASURING A SECURE ENCLAVE 审中-公开
标题翻译：测量一个安全的包装
公开(公告)号：WO2015013062A1
公开(公告)日：2015-01-29
申请号：PCT/US2014/046667
申请日：2014-07-15
申请人： INTEL CORPORATION , ROZAS, Carlos V. , ANATI, Ittai , GERZON, Gideon , GUERON, Shay , JOHNSON, Simon P. , MCKEEN, Francis X. , SAVAGAONKAR, Uday R. , SCARLATA, Vincent R.
发明人： ROZAS, Carlos V. , ANATI, Ittai , GERZON, Gideon , GUERON, Shay , JOHNSON, Simon P. , MCKEEN, Francis X. , SAVAGAONKAR, Uday R. , SCARLATA, Vincent R.
IPC分类号： G06F21/00 , G06F9/06
CPC分类号： H04L9/3239 , G06F9/3004 , G06F12/1441 , G06F21/71 , G06F2221/2111
摘要： Embodiments of an invention for measuring a secure enclave are disclosed. In one embodiment, a processor includes an instruction unit and an execution unit. The instruction unit is to receive a first, a second, and a third instruction. The execution unit is to execute the first, the second, and the third instruction. Execution of the first instruction includes initializing a measurement field in a control structure of a secure enclave with an initial value. Execution of the second instruction includes adding a region to the secure enclave. Execution of the third instruction includes measuring a subregion of the region.
摘要翻译：公开了用于测量安全飞地的发明的实施例。在一个实施例中，处理器包括指令单元和执行单元。指令单元将接收第一，第二和第三指令。执行单元执行第一，第二和第三指令。执行第一指令包括初始化具有初始值的安全飞地的控制结构中的测量场。执行第二条指令包括将一个区域添加到安全飞地。执行第三条指令包括测量该区域的一个子区域。

16. 发明授权

EP2726991B1 METHOD AND APPARATUS FOR MEMORY ENCRYPTION WITH INTEGRITY CHECK AND PROTECTION AGAINST REPLAY ATTACKS 有权
标题翻译：具有完整性检查和防止重放攻击的保护的存储器加密方法和设备
公开(公告)号：EP2726991B1
公开(公告)日：2018-03-14
申请号：EP11868426.5
申请日：2011-06-29
申请人： Intel Corporation
发明人： GUERON, Shay , SAVAGAONKAR, Uday , MCKEEN, Francis X. , ROZAS, Carlos V. , DURHAM, David M. , DOWECK, Jacob , MULLA, Ofir , ANATI, Ittai , GREENFIELD, Zvika , MAOR, Moshe
IPC分类号： G06F12/14 , G06F21/72 , G06F21/64 , H04L9/06 , H04L9/32
CPC分类号： G06F21/72 , G06F12/1408 , G06F21/00 , G06F21/64 , H04L9/0637 , H04L9/3242
摘要： A method and apparatus to provide cryptographic integrity checks and replay protection to protect against hardware attacks on system memory is provided. A mode of operation for block ciphers enhances the standard XTS-AES mode of operation to perform memory encryption by extending a tweak to include a “time stamp” indicator. A tree-based replay protection scheme uses standard XTS-AES to encrypt contents of a cache line in the system memory. A Message-Authentication Code (MAC) for the cache line is encrypted using enhanced XTS-AES and a “time stamp” indicator associated with the cache line. The “time stamp indicator” is stored in a processor.

17. 发明申请

WO2018063802A1 PROCESSOR EXTENSIONS TO IDENTIFY AND AVOID TRACKING CONFLICTS BETWEEN VIRTUAL MACHINE MONITOR AND GUEST VIRTUAL MACHINE 审中-公开
标题翻译：处理器扩展来识别和避免虚拟机监控器和客户虚拟机之间的冲突
公开(公告)号：WO2018063802A1
公开(公告)日：2018-04-05
申请号：PCT/US2017/051384
申请日：2017-09-13
申请人： INTEL CORPORATION
发明人： LESLIE-HURD, Rebekah M. , ROZAS, Carlos V. , CASPI, Dror
IPC分类号： G06F21/53 , G06F9/455
摘要： A processing system includes an execution unit, communicatively coupled to an architecturally-protected memory, the execution unit comprising a logic circuit to execute a virtual machine monitor (VMM ) that supports a virtual machine (VM) comprising a guest operating system (OS) and to implement an architecturally-protected execution environment, wherein the logic circuit is to responsive to executing a blocking instruction by the guest OS directed at a first page stored in the architecturally -protected memory during a first time period identified by a value stored in a first counter, copy the value from the first counter to a second counter, responsive to executing a first tracking instruction issued by the VMM, increment the value stored in the first counter, and set a flag to indicate successful execution of the second tracking instruction.
摘要翻译：处理系统包括通信地耦合到架构受保护的存储器的执行单元，所述执行单元包括用于执行支持虚拟机（VM）的虚拟机监视器（VMM）的逻辑电路，所述虚拟机包括客户操作系统（OS）并且实现架构保护的执行环境，其中所述逻辑电路响应于在第一时间段期间由所述客户OS针对存储在所述架构保护的存储器中的第一页执行阻止指令通过存储在第一计数器中的值识别，响应于执行由VMM发出的第一跟踪指令，将来自第一计数器的值复制到第二计数器，递增存储在第一计数器中的值，并设置标志以指示成功执行第二个跟踪指令。

18. 发明申请

WO2018044475A1 MANAGING ENCLAVE MEMORY PAGES 审中-公开
标题翻译：管理ENCLAVE内存页面
公开(公告)号：WO2018044475A1
公开(公告)日：2018-03-08
申请号：PCT/US2017/044961
申请日：2017-08-01
申请人： INTEL CORPORATION
发明人： LESLIE-HURD, Rebekah M. , MCKEEN, Francis X. , ROZAS, Carlos V. , CHAKRABARTI, Somnath , MALLICK, Asit K.
IPC分类号： G06F12/14
CPC分类号： G06F12/0824 , G06F12/0808 , G06F12/0811 , G06F12/084 , G06F21/53 , G06F21/572 , G06F2212/1008 , G06F2212/1052 , G06F2212/152 , G06F2212/60 , G06F2212/62 , G06F2221/032
摘要： A processing device includes a first counter having a first count value of a number of child pages among a plurality of child pages present in an enclave memory of a first virtual machine (VM). The plurality of child pages are associated with a parent page in the enclave memory. The processing device includes a second counter having a second count value of a number of child pages among the plurality of child pages not present in the enclave memory and being shared by a second VM, wherein the second VM is different from the first VM. A non-zero value of at least one of the first counter or the second counter prevents eviction of the parent page from the enclave memory.
摘要翻译：处理设备包括第一计数器，该第一计数器具有存在于第一虚拟机（VM）的区域存储器中的多个子页面中的多个子页面的第一计数值。多个子页面与区域存储器中的父页面相关联。处理设备包括第二计数器，该第二计数器具有第二计数器，该第二计数器具有第二计数器，该第二计数器具有在该区域存储器中不存在并且由第二VM共享的多个子页面中的多个子页面的第二计数值，其中第二VM不同于第一VM。第一计数器或第二计数器中的至少一个的非零值防止从飞地存储器中逐出父页面。

19. 发明申请

WO2017210145A1 FLEXIBLE PROVISIONING OF ATTESTATION KEYS IN SECURE ENCLAVES 审中-公开
标题翻译：在安全环境中灵活地提供证明密钥
公开(公告)号：WO2017210145A1
公开(公告)日：2017-12-07
申请号：PCT/US2017/034897
申请日：2017-05-28
申请人： INTEL CORPORATION
发明人： SCARLATA, Vincent R. , MCKEEN, Francis X. , ROZAS, Carlos V. , JOHNSON, Simon P. , ZHANG, Bo , BEANEY, JR., James D. , ZMIJEWSKI, Piotr , SMITH, Wesley Hamilton , CABRE, Eduardo
IPC分类号： G06F21/53 , G06F21/62 , H04L9/08
CPC分类号： H04L9/3252 , G06F21/44 , G06F21/53 , G09C1/00 , H04L9/0866 , H04L9/14 , H04L9/302 , H04L9/3066 , H04L9/3234 , H04L9/3247 , H04L9/3249 , H04L63/06 , H04L63/062 , H04L63/0823 , H04L63/12 , H04L2209/127
摘要： A computing platform implements one or more secure enclaves including a first provisioning enclave to interface with a first provisioning service to obtain a first attestation key from the first provisioning service, a second provisioning enclave to interface with a different, second provisioning service to obtain a second attestation key from the second provisioning service, and a provisioning certification enclave to sign first data from the first provisioning enclave and second data from the second provisioning enclave using a hardware-based provisioning attestation key. The signed first data is used by the first provisioning enclave to authenticate to the first provisioning service to obtain the first attestation key and the signed second data is used by the second provisioning enclave to authenticate to the second provisioning service to obtain the second attestation key.
摘要翻译：计算平台实现一个或多个安全区域，所述安全区域包括第一供应区域和第一供应服务，以从第一供应服务获得第一认证密钥，第二供应区域与不同的，第二供应服务以从第二供应服务获得第二认证密钥，以及供应认证区域，以使用基于硬件的供应认证密钥来对来自第一供应区域的第一数据和来自第二供应区域的第二数据进行签名。经签名的第一数据由第一供应区域用于向第一供应服务认证以获得第一认证密钥，并且由第二供应区域使用经签署的第二数据来向第二供应服务认证以获得第二认证密钥。

20. 发明申请

WO2017112248A1 TRUSTED LAUNCH OF SECURE ENCLAVES IN VIRTUALIZED ENVIRONMENTS 审中-公开
标题翻译：值得信赖的安全环境在虚拟化环境中的推出
公开(公告)号：WO2017112248A1
公开(公告)日：2017-06-29
申请号：PCT/US2016/063301
申请日：2016-11-22
申请人： INTEL CORPORATION
发明人： ROBINSON, Scott H. , SAHITA, Ravi L. , SHANAHAN, Mark W. , GREWAL, Karanvir S. , SARANGDHAR, Nitin V. , ROZAS, Carlos V. , ZHANG, Bo , CEN, Shanwei
IPC分类号： G06F21/53 , G06F21/54
CPC分类号： G06F12/145 , G06F9/45558 , G06F12/0815 , G06F21/575 , G06F2009/45579 , G06F2009/45583 , G06F2009/45587 , G06F2009/45591 , G06F2212/1052 , G06F2212/621 , G06F2221/034
摘要： Systems, apparatuses and methods may provide for verifying, from outside a trusted computing base of a computing system, an identity an enclave instance prior to the enclave instance being launched in the trusted computing base, determining a memory location of the enclave instance and confirming that the memory location is local to the computing system. In one example, the enclave instance is a proxy enclave instance, wherein communications are conducted with one or more additional enclave instances in the trusted computing base via the proxy enclave instance and an unencrypted channel.
摘要翻译：系统，装置和方法可以提供用于从计算系统的可信计算基础的外部验证在可靠计算库中启动包围区实例之前的包围区实例的身份，确定存储器飞地实例的位置以及确认存储位置对于计算系统是本地的。在一个示例中，飞地实例是代理飞地实例，其中经由代理飞地实例和未加密信道与可信计算库中的一个或多个附加飞地实例进行通信。

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式