专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

1. 发明授权

US06990579B1 Platform and method for remote attestation of a platform 失效
标题翻译：平台和平台的远程认证方法
公开(公告)号：US06990579B1
公开(公告)日：2006-01-24
申请号：US09541108
申请日：2000-03-31
申请人： Howard C. Herbert , David W. Grawrock , Carl M. Ellison , Roger A. Golliver , Derrick C. Lin , Francis X. McKeen , Gilbert Neiger , Ken Reneris , James A. Sutton , Shreekant S. Thakkar , Millind Mittal
发明人： Howard C. Herbert , David W. Grawrock , Carl M. Ellison , Roger A. Golliver , Derrick C. Lin , Francis X. McKeen , Gilbert Neiger , Ken Reneris , James A. Sutton , Shreekant S. Thakkar , Millind Mittal
IPC分类号： H04L9/00
CPC分类号： G06F21/305 , G06F9/30189 , G06F12/1491 , G06F21/35 , G06F21/53 , G06F21/57 , G06F21/575 , G06F21/64 , G06F21/74 , G06F2221/2101 , G06F2221/2103 , G06F2221/2105 , G06F2221/2149
摘要： In one embodiment, a method of remote attestation for a special mode of operation. The method comprises storing an audit log within protected memory of a platform. The audit log is a listing of data representing each of a plurality of IsoX software modules loaded into the platform. The audit log is retrieved from the protected memory in response to receiving a remote attestation request from a remotely located platform. Then, the retrieved audit log is digitally signed to produce a digital signature for transfer to the remotely located platform.
摘要翻译：在一个实施例中，用于特殊操作模式的远程认证的方法。该方法包括将审核日志存储在平台的受保护的存储器内。审计日志是表示加载到平台中的多个IsoX软件模块中的每一个的数据的列表。响应于从远程位置的平台接收远程认证请求，从受保护的内存中检索审核日志。然后，检索的审核日志进行数字签名，以产生数字签名，以转移到位于远程的平台。

2. 发明授权

US07254707B2 Platform and method for remote attestation of a platform 有权
标题翻译：平台和平台的远程认证方法
公开(公告)号：US07254707B2
公开(公告)日：2007-08-07
申请号：US11203538
申请日：2005-08-12
申请人： Howard C. Herbert , David W. Grawrock , Carl M. Ellison , Roger A. Golliver , Derrick C. Lin , Francis X. McKeen , Gilbert Neiger , Ken Reneris , James A. Sutton , Shreekant S. Thakkar , Millind Mittal
发明人： Howard C. Herbert , David W. Grawrock , Carl M. Ellison , Roger A. Golliver , Derrick C. Lin , Francis X. McKeen , Gilbert Neiger , Ken Reneris , James A. Sutton , Shreekant S. Thakkar , Millind Mittal
IPC分类号： H04L9/00
CPC分类号： G06F21/305 , G06F9/30189 , G06F12/1491 , G06F21/35 , G06F21/53 , G06F21/57 , G06F21/575 , G06F21/64 , G06F21/74 , G06F2221/2101 , G06F2221/2103 , G06F2221/2105 , G06F2221/2149
摘要： In one embodiment, a method of attestation involves a special mode of operation. The method comprises storing an audit log within protected memory of a platform. The audit log is a listing of data representing one or more software modules loaded into the platform. The audit log is retrieved from the protected memory in response to receiving an attestation request. Then, the retrieved audit log is digitally signed to produce a digital signature in response to the attestation request.
摘要翻译：在一个实施例中，认证方法涉及特殊的操作模式。该方法包括将审核日志存储在平台的受保护的存储器内。审计日志是表示加载到平台中的一个或多个软件模块的数据列表。响应于接收到认证请求，从受保护的存储器检索审核日志。然后，检索的审核日志被数字签名以响应于认证请求产生数字签名。

3. 发明授权

US07194634B2 Attestation key memory device and bus 有权
标题翻译：证明密钥存储设备和总线
公开(公告)号：US07194634B2
公开(公告)日：2007-03-20
申请号：US09672602
申请日：2001-02-26
申请人： Carl M. Ellison , Roger A. Golliver , Howard C. Herbert , Derrick C. Lin , Francis X. McKeen , Gilbert Neiger , Ken Reneris , James A. Sutton , Shreekant S. Thakkar , Millind Mittal
发明人： Carl M. Ellison , Roger A. Golliver , Howard C. Herbert , Derrick C. Lin , Francis X. McKeen , Gilbert Neiger , Ken Reneris , James A. Sutton , Shreekant S. Thakkar , Millind Mittal
IPC分类号： G06F11/30
CPC分类号： G06F12/1491 , G06F21/57 , G06F2221/2105
摘要： In an embodiment of the present invention, a technique is provided for remote attestation. An interface maps a device via a bus to an address space of a chipset in a secure environment for an isolated execution mode. The secure environment is associated with an isolated memory area accessible by at least one processor. The at least one processor operates in one of a normal execution mode and the isolated execution mode. A communication storage corresponding to the address space allows the device to exchange security information with the at least one processor in the isolated execution mode in a remote attestation.
摘要翻译：在本发明的实施例中，提供了用于远程证明的技术。接口将设备通过总线映射到安全环境中的芯片组的地址空间，用于隔离执行模式。安全环境与由至少一个处理器可访问的隔离存储器区域相关联。所述至少一个处理器以正常执行模式和隔离执行模式之一进行操作。对应于地址空间的通信存储器允许设备在远程证明中以隔离执行模式与至少一个处理器交换安全信息。

4. 发明授权

US06754815B1 Method and system for scrubbing an isolated area of memory after reset of a processor operating in isolated execution mode if a cleanup flag is set 有权
标题翻译：如果设置了清除标志，则在分离执行模式下操作的处理器复位后，擦除存储器隔离区域的方法和系统
公开(公告)号：US06754815B1
公开(公告)日：2004-06-22
申请号：US09618659
申请日：2000-07-18
申请人： Carl M. Ellison , Roger A. Golliver , Howard C. Herbert , Derrick C. Lin , Francis X. McKeen , Gilbert Neiger , Ken Reneris , James A. Sutton , Shreekant S. Thakkar , Millind Mittal
发明人： Carl M. Ellison , Roger A. Golliver , Howard C. Herbert , Derrick C. Lin , Francis X. McKeen , Gilbert Neiger , Ken Reneris , James A. Sutton , Shreekant S. Thakkar , Millind Mittal
IPC分类号： G06F15177
CPC分类号： G06F21/74 , G06F9/4401 , G06F21/62 , G06F2221/2143
摘要： The present invention provides a method, apparatus, and system for invoking a reset process in response to a processor being individually reset. The reset processor operates within a platform in an isolated execution mode and is associated with an isolated area of memory. An initialization process is invoked for an initializing processor. The initialization process determines whether or not a cleanup flag is set. If the cleanup flag is set, the isolated area of memory is scrubbed. In one embodiment, when a last processor operating in the platform is reset, it is reset without clearing the cleanup flag. Subsequently, an initializing processor invokes the initialization process. The initialization process determines that the cleanup flag is set. The initialization process invokes the execution of a processor nub loader. If the cleanup flag is set, the processor nub loader scrubs the isolated area of memory and invokes a controlled close for the initializing processor. The controlled close clears the cleanup flag. The initializing processor then re-performs the initialization process. Upon the second iteration of the initialization process, with the cleanup flag not set, a new isolated area of memory is created for the initializing processor.
摘要翻译：本发明提供了一种响应于处理器被单独复位来调用复位过程的方法，装置和系统。复位处理器在孤立执行模式的平台内运行，并与存储器的隔离区域相关联。初始化处理器调用初始化过程。初始化过程确定是否设置清除标志。如果清除标志置位，则清除隔离区的内存。在一个实施例中，当在平台中操作的最后一个处理器被重置时，它被重置而不清除清除标志。随后，初始化处理器调用初始化过程。初始化过程确定清除标志被设置。初始化过程调用处理器nub加载器的执行。如果清除标志置位，则处理器nub加载器将擦除存储器的隔离区域，并为初始化处理器调用受控关闭。受控关闭清除清除标志。初始化处理器然后重新执行初始化过程。在初始化过程的第二次迭代时，在清除标志未设置的情况下，为初始化处理器创建一个新的隔离区域。

5. 发明授权

US07082615B1 Protecting software environment in isolated execution 失效
标题翻译：在孤立执行中保护软件环境
公开(公告)号：US07082615B1
公开(公告)日：2006-07-25
申请号：US09668610
申请日：2000-09-22
申请人： Carl M. Ellison , Roger A. Golliver , Howard C. Herbert , Derrick C. Lin , Francis X. McKeen , Gilbert Neiger , Ken Reneris , James A. Sutton , Shreekant S. Thakkar , Millind Mittal
发明人： Carl M. Ellison , Roger A. Golliver , Howard C. Herbert , Derrick C. Lin , Francis X. McKeen , Gilbert Neiger , Ken Reneris , James A. Sutton , Shreekant S. Thakkar , Millind Mittal
IPC分类号： G06F7/04
CPC分类号： G06F21/53 , G06F9/468 , G06F21/562 , G06F21/57 , G06F21/74 , G06F2221/2105
摘要： The present invention is a method and apparatus to protect a subset of a software environment. A key generator generates an operating system nub key (OSNK). The OSNK is unique to an operating system (OS) nub. The OS nub is part of an operating system in a secure platform. A usage protector uses the OSNK to protect usage of a subset of the software environment.
摘要翻译：本发明是一种保护软件环境子集的方法和装置。密钥生成器生成操作系统nub（OSNK）。 OSNK是操作系统（OS）nub所独有的。 OS nub是安全平台中操作系统的一部分。使用保护程序使用OSNK来保护软件环境的子集的使用。

6. 发明授权

US06678825B1 Controlling access to multiple isolated memories in an isolated execution environment 有权
标题翻译：在独立的执行环境中控制对多个隔离存储器的访问
公开(公告)号：US06678825B1
公开(公告)日：2004-01-13
申请号：US09618738
申请日：2000-07-18
申请人： Carl M. Ellison , Roger A. Golliver , Howard C. Herbert , Derrick C. Lin , Francis X. McKeen , Gilbert Neiger , Ken Reneris , James A. Sutton , Shreekant S. Thakkar , Millind Mittal
发明人： Carl M. Ellison , Roger A. Golliver , Howard C. Herbert , Derrick C. Lin , Francis X. McKeen , Gilbert Neiger , Ken Reneris , James A. Sutton , Shreekant S. Thakkar , Millind Mittal
IPC分类号： G06F1760
CPC分类号： G06F12/145 , G06F12/0831 , G06F12/1009 , G06F12/1491 , G06F21/74 , G06F2212/1016 , G06F2212/1041 , G06F2212/1052
摘要： The present invention provides a method, apparatus, and system for controlling memory accesses to multiple isolated memory areas in an isolated execution environment. A page manager is used to distribute a plurality of pages to a plurality of different areas of a memory, respectively. The memory is divided into non-isolated areas and isolated areas. The page manager is located in an isolated area of memory. Further, a memory ownership page table describes each page of memory and is also located in an isolated area of memory. The page manager assigns an isolated attribute to a page if the page is distributed to an isolated area of memory. On the other hand, the page manager assigns a non-isolated attribute to a page if the page is distributed to a non-isolated area of memory. The memory ownership page table records the attribute for each page. In one embodiment, a processor having a normal execution mode and an isolated execution mode generates an access transaction. The access transaction is configured using a configuration storage that contains configuration settings related to a page and access information. An access checking circuit coupled to the configuration storage checks the access transaction using at least one of the configuration settings and the access information and generates an access grant signal if the access transaction is valid.
摘要翻译：本发明提供一种用于控制对隔离执行环境中的多个隔离存储器区域的存储器访问的方法，装置和系统。页面管理器用于分别将多个页面分发到存储器的多个不同区域。记忆分为非隔离区和隔离区。页面管理器位于隔离区内。此外，存储器所有权页表描述了存储器的每一页，并且还位于存储器的隔离区域中。页面管理器将一个隔离的属性分配给页面，如果该页面被分发到一个隔离的内存区域。另一方面，如果页面被分发到存储器的非隔离区域，则页面管理器将非隔离属性分配给页面。内存所有权页表记录每个页面的属性。在一个实施例中，具有正常执行模式和隔离执行模式的处理器生成访问事务。访问事务使用包含与页面和访问信息相关的配置设置的配置存储进行配置。耦合到配置存储器的访问检查电路使用配置设置和访问信息中的至少一个来检查访问事务，并且如果访问事务有效则生成访问许可信号。

7. 发明授权

US07380278B2 Protecting software environment in isolated execution 有权
标题翻译：在孤立执行中保护软件环境
公开(公告)号：US07380278B2
公开(公告)日：2008-05-27
申请号：US11386269
申请日：2006-03-21
申请人： Carl M. Ellison , Roger A. Golliver , Howard C. Herbert , Derrick C. Lin , Francis X. McKeen , Gilbert Neiger , Ken Reneris , James A. Sutton , Shreekant S. Thakkar , Millind Mittal
发明人： Carl M. Ellison , Roger A. Golliver , Howard C. Herbert , Derrick C. Lin , Francis X. McKeen , Gilbert Neiger , Ken Reneris , James A. Sutton , Shreekant S. Thakkar , Millind Mittal
IPC分类号： G06F7/04 , G06F9/00 , G06F12/00 , H04L9/00 , H04L9/32
CPC分类号： G06F21/53 , G06F9/468 , G06F21/562 , G06F21/57 , G06F21/74 , G06F2221/2105
摘要： A processing system has a processor that can operate in a normal ring 0 operating mode and one or more higher ring operating modes above the normal ring 0 operating mode. In addition, the processor can operate in an isolated execution mode. A memory in the processing system may include an ordinary memory area that can be accessed from the normal ring 0 operating mode, as well as an isolated memory area that can be accessed from the isolated execution mode but not from the normal ring 0 operating mode. The processing system may also include an operating system (OS) nub, as well as a key generator. The key generator may generate an OS nub key (OSNK) based at least in part on an identification of the OS nub and a master binding key (BK0) of the platform. Other embodiments are described and claimed.
摘要翻译：处理系统具有处理器，该处理器可以在正常环0操作模式和高于正常环0操作模式的一个或多个较高环操作模式下操作。此外，处理器可以在隔离的执行模式下操作。处理系统中的存储器可以包括可以从正常环0操作模式访问的普通存储器区域以及可以从隔离执行模式而不是从正常环0操作模式访问的隔离存储器区域。处理系统还可以包括操作系统（OS）nub以及密钥生成器。密钥生成器可以至少部分地基于OS nub的标识和平台的主绑定密钥（BK 0）来生成OS nub密钥（OSNK）。描述和要求保护其他实施例。

8. 发明授权

US07089418B1 Managing accesses in a processor for isolated execution 有权
标题翻译：管理处理器中的访问以进行隔离执行
公开(公告)号：US07089418B1
公开(公告)日：2006-08-08
申请号：US09540611
申请日：2000-03-31
申请人： Carl M. Ellison , Roger A. Golliver , Howard C. Herbert , Derrick C. Lin , Francis X. McKeen , Gilbert Neiger , Ken Reneris , James A. Sutton , Shreekant S. Thakkar , Millind Mittal
发明人： Carl M. Ellison , Roger A. Golliver , Howard C. Herbert , Derrick C. Lin , Francis X. McKeen , Gilbert Neiger , Ken Reneris , James A. Sutton , Shreekant S. Thakkar , Millind Mittal
IPC分类号： G06F13/16
CPC分类号： G06F12/0831 , G06F12/1491
摘要： In one embodiment, a method comprises configuring an access transaction generated by a processor by a configuration storage containing configuration parameters. The processor has a normal execution mode and an isolated execution mode. The access transaction has access information. In a further embodiment, a method comprises checking the access transaction by an access checking circuit using at least one of the configuration parameters and the access information.
摘要翻译：在一个实施例中，一种方法包括通过包含配置参数的配置存储器配置由处理器生成的访问事务。处理器具有正常执行模式和隔离执行模式。访问事务具有访问信息。在另一实施例中，一种方法包括使用至少一个配置参数和访问信息来检查访问检查电路的访问事务。

9. 发明授权

US06769058B1 Resetting a processor in an isolated execution environment 有权
标题翻译：在独立的执行环境中重置处理器
公开(公告)号：US06769058B1
公开(公告)日：2004-07-27
申请号：US09751586
申请日：2000-12-29
申请人： Carl M. Ellison , Roger A. Golliver , Howard C. Herbert , Derrick C. Lin , Francis X. McKeen , Gilbert Neiger , James A. Sutton , Shreekant S. Thakkar , Millind Mittal , Ken Reneris
发明人： Carl M. Ellison , Roger A. Golliver , Howard C. Herbert , Derrick C. Lin , Francis X. McKeen , Gilbert Neiger , James A. Sutton , Shreekant S. Thakkar , Millind Mittal , Ken Reneris
IPC分类号： G06F900
CPC分类号： G06F9/30076 , G06F1/24 , G06F9/45558 , G06F21/53 , G06F2009/45583 , G06F2009/45587
摘要： A method, apparatus, and system for invoking a reset process in response to a logical processor being individually reset is disclosed. When a last logical processor operating within a platform in an isolated execution mode and associated with an isolated area of memory is reset, it is reset without clearing a cleanup flag. Subsequently, an initializing physical processor invokes an initialization process that determines that the cleanup flag is set. The initialization process invokes the execution of a processor nub loader, and if the cleanup flag is set, the processor nub loader scrubs the isolated area of memory and invokes a controlled close for the initializing physical processor which clears the cleanup flag. The initializing physical processor then re-performs the initialization process. Upon the second iteration of the initialization process, with the cleanup flag not set, a new clean isolated area of memory is created for the initializing physical processor.
摘要翻译：公开了一种用于响应于逻辑处理器被单独复位来调用复位过程的方法，装置和系统。当处于隔离执行模式并与存储器隔离区域相关联的最后一个逻辑处理器在平台内运行时，它将被复位而不清除清除标志。随后，初始化物理处理器调用确定清除标志被设置的初始化过程。初始化过程调用处理器nub加载程序的执行，并且如果设置了清除标志，则处理器nub加载器将擦除存储器的隔离区域，并调用初始化物理处理器的受控关闭，该物理处理器将清除清除标志。然后，初始化物理处理器重新执行初始化过程。在初始化过程的第二次迭代时，在清除标志未设置的情况下，将为初始化物理处理器创建一个新的干净的隔离区。

10. 发明授权

US07111176B1 Generating isolated bus cycles for isolated execution 有权
标题翻译：生成隔离执行的隔离总线周期
公开(公告)号：US07111176B1
公开(公告)日：2006-09-19
申请号：US09538954
申请日：2000-03-31
申请人： Carl M. Ellison , Roger A. Golliver , Howard C. Herbert , Derrick C. Lin , Francis X. McKeen , Gilbert Neiger , Ken Reneris , James A. Sutton , Shreekant S. Thakkar , Millind Mittal
发明人： Carl M. Ellison , Roger A. Golliver , Howard C. Herbert , Derrick C. Lin , Francis X. McKeen , Gilbert Neiger , Ken Reneris , James A. Sutton , Shreekant S. Thakkar , Millind Mittal
IPC分类号： G06F17/00
CPC分类号： G06F12/1491 , G06F21/71 , G06F2221/2105
摘要： The present invention is a method and apparatus to generates an isolated bus cycle for a transaction in a processor. A configuration storage contains configuration parameters to configure a processor in one of a normal execution mode and an isolated execution mode. An access generator circuit generates an isolated access signal using at least one of the isolated area parameters and access information in the transaction. The isolated access signal is asserted when the processor is configured in the isolated execution mode. A bus cycle decoder generates an isolated bus cycle corresponding to a destination in the transaction using the asserted isolated access signal and the access information.
摘要翻译：本发明是一种用于为处理器中的事务生成隔离总线周期的方法和装置。配置存储包含用于将处理器配置为正常执行模式和隔离执行模式之一的配置参数。访问发生器电路使用交易中的隔离区域参数和访问信息中的至少一个来生成隔离访问信号。当处理器配置为隔离执行模式时，隔离访问信号被断言。总线周期解码器使用断言的隔离访问信号和访问信息来生成对应于交易中的目的地的隔离总线周期。

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式