专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

1. 发明授权

US07194634B2 Attestation key memory device and bus 有权
标题翻译：证明密钥存储设备和总线
公开(公告)号：US07194634B2
公开(公告)日：2007-03-20
申请号：US09672602
申请日：2001-02-26
申请人： Carl M. Ellison , Roger A. Golliver , Howard C. Herbert , Derrick C. Lin , Francis X. McKeen , Gilbert Neiger , Ken Reneris , James A. Sutton , Shreekant S. Thakkar , Millind Mittal
发明人： Carl M. Ellison , Roger A. Golliver , Howard C. Herbert , Derrick C. Lin , Francis X. McKeen , Gilbert Neiger , Ken Reneris , James A. Sutton , Shreekant S. Thakkar , Millind Mittal
IPC分类号： G06F11/30
CPC分类号： G06F12/1491 , G06F21/57 , G06F2221/2105
摘要： In an embodiment of the present invention, a technique is provided for remote attestation. An interface maps a device via a bus to an address space of a chipset in a secure environment for an isolated execution mode. The secure environment is associated with an isolated memory area accessible by at least one processor. The at least one processor operates in one of a normal execution mode and the isolated execution mode. A communication storage corresponding to the address space allows the device to exchange security information with the at least one processor in the isolated execution mode in a remote attestation.
摘要翻译：在本发明的实施例中，提供了用于远程证明的技术。接口将设备通过总线映射到安全环境中的芯片组的地址空间，用于隔离执行模式。安全环境与由至少一个处理器可访问的隔离存储器区域相关联。所述至少一个处理器以正常执行模式和隔离执行模式之一进行操作。对应于地址空间的通信存储器允许设备在远程证明中以隔离执行模式与至少一个处理器交换安全信息。

2. 发明授权

US06957332B1 Managing a secure platform using a hierarchical executive architecture in isolated execution mode 有权
标题翻译：在隔离执行模式下使用分层执行体系管理安全平台
公开(公告)号：US06957332B1
公开(公告)日：2005-10-18
申请号：US09539344
申请日：2000-03-31
申请人： Carl M. Ellison , Roger A. Golliver , Howard C. Herbert , Derrick C. Lin , Francis X. McKeen , Gilbert Neiger , Ken Reneris , James A. Sutton , Shreekant S. Thakkar , Milland Mittal
发明人： Carl M. Ellison , Roger A. Golliver , Howard C. Herbert , Derrick C. Lin , Francis X. McKeen , Gilbert Neiger , Ken Reneris , James A. Sutton , Shreekant S. Thakkar , Milland Mittal
IPC分类号： G06F12/14 , G06F15/00 , G06F21/00 , H04L9/00
CPC分类号： G06F12/1491 , G06F21/57 , G06F21/74
摘要： A processor executive (PE) handles an operating system executive (OSE) in a secure environment. The secure environment has a fused key (FK) and is associated with an isolated memory area in the platform. The OSE manages a subset of an operating system (OS) running on the platform. The platform has a processor operating in one of a normal execution mode and an isolated execution mode. The isolated memory area is accessible to the processor in the isolated execution mode. A PE supplement supplements the PE with a PE manifest representing the PE and a PE identifier to identify the PE. A PE handler handles the PE using the FK and the PE supplement.
摘要翻译：处理器执行（PE）在安全环境中处理操作系统执行程序（OSE）。安全环境具有融合密钥（FK），并且与平台中的隔离存储器区域相关联。 OSE管理在平台上运行的操作系统（OS）的子集。该平台具有以正常执行模式和隔离执行模式之一操作的处理器。在隔离的执行模式下，处理器可以访问隔离的内存区域。 PE补充用PE代替PE补充PE，PE标识符用于标识PE。 PE处理程序使用FK和PE补充来处理PE。

3. 发明授权

US06941458B1 Managing a secure platform using a hierarchical executive architecture in isolated execution mode 有权
标题翻译：在隔离执行模式下使用分层执行体系管理安全平台
公开(公告)号：US06941458B1
公开(公告)日：2005-09-06
申请号：US09668585
申请日：2000-09-22
申请人： Carl M. Ellison , Roger A. Golliver , Howard C. Herbert , Derrick C. Lin , Francis X. McKeen , Gilbert Neiger , Ken Reneris , James A. Sutton , Shreekant S. Thakkar , Milland Mittal
发明人： Carl M. Ellison , Roger A. Golliver , Howard C. Herbert , Derrick C. Lin , Francis X. McKeen , Gilbert Neiger , Ken Reneris , James A. Sutton , Shreekant S. Thakkar , Milland Mittal
IPC分类号： G06F12/14 , G06F15/00 , G06F21/00 , H04L9/00
CPC分类号： G06F12/1491 , G06F21/57 , G06F21/74
摘要： A processor executive (PE) handles an operating system executive (OSE) in a secure environment. The secure environment has a platform key (PK) and is associated with an isolated memory area in the platform. The OSE manages a subset of an operating system (OS) running on the platform. The platform has a processor operating in one of a normal execution mode and an isolated execution mode. The isolated memory area is accessible to the processor in the isolated execution mode. A PE supplement supplements the PE with a PE manifest representing the PE and a PE identifier to identify the PE. A PE handler handles the PE using the PK and the PE supplement.
摘要翻译：处理器执行（PE）在安全环境中处理操作系统执行程序（OSE）。安全环境具有平台密钥（PK），并且与平台中的隔离存储器区域相关联。 OSE管理在平台上运行的操作系统（OS）的子集。该平台具有以正常执行模式和隔离执行模式之一操作的处理器。在隔离的执行模式下，处理器可以访问隔离的内存区域。 PE补充用PE代替PE补充PE，PE标识符用于标识PE。 PE处理程序使用PK和PE补充来处理PE。

4. 发明授权

US06754815B1 Method and system for scrubbing an isolated area of memory after reset of a processor operating in isolated execution mode if a cleanup flag is set 有权
标题翻译：如果设置了清除标志，则在分离执行模式下操作的处理器复位后，擦除存储器隔离区域的方法和系统
公开(公告)号：US06754815B1
公开(公告)日：2004-06-22
申请号：US09618659
申请日：2000-07-18
申请人： Carl M. Ellison , Roger A. Golliver , Howard C. Herbert , Derrick C. Lin , Francis X. McKeen , Gilbert Neiger , Ken Reneris , James A. Sutton , Shreekant S. Thakkar , Millind Mittal
发明人： Carl M. Ellison , Roger A. Golliver , Howard C. Herbert , Derrick C. Lin , Francis X. McKeen , Gilbert Neiger , Ken Reneris , James A. Sutton , Shreekant S. Thakkar , Millind Mittal
IPC分类号： G06F15177
CPC分类号： G06F21/74 , G06F9/4401 , G06F21/62 , G06F2221/2143
摘要： The present invention provides a method, apparatus, and system for invoking a reset process in response to a processor being individually reset. The reset processor operates within a platform in an isolated execution mode and is associated with an isolated area of memory. An initialization process is invoked for an initializing processor. The initialization process determines whether or not a cleanup flag is set. If the cleanup flag is set, the isolated area of memory is scrubbed. In one embodiment, when a last processor operating in the platform is reset, it is reset without clearing the cleanup flag. Subsequently, an initializing processor invokes the initialization process. The initialization process determines that the cleanup flag is set. The initialization process invokes the execution of a processor nub loader. If the cleanup flag is set, the processor nub loader scrubs the isolated area of memory and invokes a controlled close for the initializing processor. The controlled close clears the cleanup flag. The initializing processor then re-performs the initialization process. Upon the second iteration of the initialization process, with the cleanup flag not set, a new isolated area of memory is created for the initializing processor.
摘要翻译：本发明提供了一种响应于处理器被单独复位来调用复位过程的方法，装置和系统。复位处理器在孤立执行模式的平台内运行，并与存储器的隔离区域相关联。初始化处理器调用初始化过程。初始化过程确定是否设置清除标志。如果清除标志置位，则清除隔离区的内存。在一个实施例中，当在平台中操作的最后一个处理器被重置时，它被重置而不清除清除标志。随后，初始化处理器调用初始化过程。初始化过程确定清除标志被设置。初始化过程调用处理器nub加载器的执行。如果清除标志置位，则处理器nub加载器将擦除存储器的隔离区域，并为初始化处理器调用受控关闭。受控关闭清除清除标志。初始化处理器然后重新执行初始化过程。在初始化过程的第二次迭代时，在清除标志未设置的情况下，为初始化处理器创建一个新的隔离区域。

5. 发明授权

US07096497B2 File checking using remote signing authority via a network 有权
公开(公告)号：US07096497B2
公开(公告)日：2006-08-22
申请号：US09823131
申请日：2001-03-30
申请人： Carl M. Ellison , Roger A. Golliver , Howard C. Herbert , Derrick C. Lin , Francis X. McKeen , Gilbert Neiger , Ken Reneris , James A. Sutton , Shreekant S. Thakkar
发明人： Carl M. Ellison , Roger A. Golliver , Howard C. Herbert , Derrick C. Lin , Francis X. McKeen , Gilbert Neiger , Ken Reneris , James A. Sutton , Shreekant S. Thakkar
IPC分类号： G06F11/30 , H04L9/00
CPC分类号： G06F21/645
摘要： A file is sent to a remote signing authority via a network. The signing authority checks the file and provides a signature indicating file integrity of the file. The signature returned from the signing authority via the network is verified.

6. 发明授权

US07082615B1 Protecting software environment in isolated execution 失效
标题翻译：在孤立执行中保护软件环境
公开(公告)号：US07082615B1
公开(公告)日：2006-07-25
申请号：US09668610
申请日：2000-09-22
申请人： Carl M. Ellison , Roger A. Golliver , Howard C. Herbert , Derrick C. Lin , Francis X. McKeen , Gilbert Neiger , Ken Reneris , James A. Sutton , Shreekant S. Thakkar , Millind Mittal
发明人： Carl M. Ellison , Roger A. Golliver , Howard C. Herbert , Derrick C. Lin , Francis X. McKeen , Gilbert Neiger , Ken Reneris , James A. Sutton , Shreekant S. Thakkar , Millind Mittal
IPC分类号： G06F7/04
CPC分类号： G06F21/53 , G06F9/468 , G06F21/562 , G06F21/57 , G06F21/74 , G06F2221/2105
摘要： The present invention is a method and apparatus to protect a subset of a software environment. A key generator generates an operating system nub key (OSNK). The OSNK is unique to an operating system (OS) nub. The OS nub is part of an operating system in a secure platform. A usage protector uses the OSNK to protect usage of a subset of the software environment.
摘要翻译：本发明是一种保护软件环境子集的方法和装置。密钥生成器生成操作系统nub（OSNK）。 OSNK是操作系统（OS）nub所独有的。 OS nub是安全平台中操作系统的一部分。使用保护程序使用OSNK来保护软件环境的子集的使用。

7. 发明授权

US06678825B1 Controlling access to multiple isolated memories in an isolated execution environment 有权
标题翻译：在独立的执行环境中控制对多个隔离存储器的访问
公开(公告)号：US06678825B1
公开(公告)日：2004-01-13
申请号：US09618738
申请日：2000-07-18
申请人： Carl M. Ellison , Roger A. Golliver , Howard C. Herbert , Derrick C. Lin , Francis X. McKeen , Gilbert Neiger , Ken Reneris , James A. Sutton , Shreekant S. Thakkar , Millind Mittal
发明人： Carl M. Ellison , Roger A. Golliver , Howard C. Herbert , Derrick C. Lin , Francis X. McKeen , Gilbert Neiger , Ken Reneris , James A. Sutton , Shreekant S. Thakkar , Millind Mittal
IPC分类号： G06F1760
CPC分类号： G06F12/145 , G06F12/0831 , G06F12/1009 , G06F12/1491 , G06F21/74 , G06F2212/1016 , G06F2212/1041 , G06F2212/1052
摘要： The present invention provides a method, apparatus, and system for controlling memory accesses to multiple isolated memory areas in an isolated execution environment. A page manager is used to distribute a plurality of pages to a plurality of different areas of a memory, respectively. The memory is divided into non-isolated areas and isolated areas. The page manager is located in an isolated area of memory. Further, a memory ownership page table describes each page of memory and is also located in an isolated area of memory. The page manager assigns an isolated attribute to a page if the page is distributed to an isolated area of memory. On the other hand, the page manager assigns a non-isolated attribute to a page if the page is distributed to a non-isolated area of memory. The memory ownership page table records the attribute for each page. In one embodiment, a processor having a normal execution mode and an isolated execution mode generates an access transaction. The access transaction is configured using a configuration storage that contains configuration settings related to a page and access information. An access checking circuit coupled to the configuration storage checks the access transaction using at least one of the configuration settings and the access information and generates an access grant signal if the access transaction is valid.
摘要翻译：本发明提供一种用于控制对隔离执行环境中的多个隔离存储器区域的存储器访问的方法，装置和系统。页面管理器用于分别将多个页面分发到存储器的多个不同区域。记忆分为非隔离区和隔离区。页面管理器位于隔离区内。此外，存储器所有权页表描述了存储器的每一页，并且还位于存储器的隔离区域中。页面管理器将一个隔离的属性分配给页面，如果该页面被分发到一个隔离的内存区域。另一方面，如果页面被分发到存储器的非隔离区域，则页面管理器将非隔离属性分配给页面。内存所有权页表记录每个页面的属性。在一个实施例中，具有正常执行模式和隔离执行模式的处理器生成访问事务。访问事务使用包含与页面和访问信息相关的配置设置的配置存储进行配置。耦合到配置存储器的访问检查电路使用配置设置和访问信息中的至少一个来检查访问事务，并且如果访问事务有效则生成访问许可信号。

8. 发明授权

US07380278B2 Protecting software environment in isolated execution 有权
标题翻译：在孤立执行中保护软件环境
公开(公告)号：US07380278B2
公开(公告)日：2008-05-27
申请号：US11386269
申请日：2006-03-21
申请人： Carl M. Ellison , Roger A. Golliver , Howard C. Herbert , Derrick C. Lin , Francis X. McKeen , Gilbert Neiger , Ken Reneris , James A. Sutton , Shreekant S. Thakkar , Millind Mittal
发明人： Carl M. Ellison , Roger A. Golliver , Howard C. Herbert , Derrick C. Lin , Francis X. McKeen , Gilbert Neiger , Ken Reneris , James A. Sutton , Shreekant S. Thakkar , Millind Mittal
IPC分类号： G06F7/04 , G06F9/00 , G06F12/00 , H04L9/00 , H04L9/32
CPC分类号： G06F21/53 , G06F9/468 , G06F21/562 , G06F21/57 , G06F21/74 , G06F2221/2105
摘要： A processing system has a processor that can operate in a normal ring 0 operating mode and one or more higher ring operating modes above the normal ring 0 operating mode. In addition, the processor can operate in an isolated execution mode. A memory in the processing system may include an ordinary memory area that can be accessed from the normal ring 0 operating mode, as well as an isolated memory area that can be accessed from the isolated execution mode but not from the normal ring 0 operating mode. The processing system may also include an operating system (OS) nub, as well as a key generator. The key generator may generate an OS nub key (OSNK) based at least in part on an identification of the OS nub and a master binding key (BK0) of the platform. Other embodiments are described and claimed.
摘要翻译：处理系统具有处理器，该处理器可以在正常环0操作模式和高于正常环0操作模式的一个或多个较高环操作模式下操作。此外，处理器可以在隔离的执行模式下操作。处理系统中的存储器可以包括可以从正常环0操作模式访问的普通存储器区域以及可以从隔离执行模式而不是从正常环0操作模式访问的隔离存储器区域。处理系统还可以包括操作系统（OS）nub以及密钥生成器。密钥生成器可以至少部分地基于OS nub的标识和平台的主绑定密钥（BK 0）来生成OS nub密钥（OSNK）。描述和要求保护其他实施例。

9. 发明授权

US07089418B1 Managing accesses in a processor for isolated execution 有权
标题翻译：管理处理器中的访问以进行隔离执行
公开(公告)号：US07089418B1
公开(公告)日：2006-08-08
申请号：US09540611
申请日：2000-03-31
申请人： Carl M. Ellison , Roger A. Golliver , Howard C. Herbert , Derrick C. Lin , Francis X. McKeen , Gilbert Neiger , Ken Reneris , James A. Sutton , Shreekant S. Thakkar , Millind Mittal
发明人： Carl M. Ellison , Roger A. Golliver , Howard C. Herbert , Derrick C. Lin , Francis X. McKeen , Gilbert Neiger , Ken Reneris , James A. Sutton , Shreekant S. Thakkar , Millind Mittal
IPC分类号： G06F13/16
CPC分类号： G06F12/0831 , G06F12/1491
摘要： In one embodiment, a method comprises configuring an access transaction generated by a processor by a configuration storage containing configuration parameters. The processor has a normal execution mode and an isolated execution mode. The access transaction has access information. In a further embodiment, a method comprises checking the access transaction by an access checking circuit using at least one of the configuration parameters and the access information.
摘要翻译：在一个实施例中，一种方法包括通过包含配置参数的配置存储器配置由处理器生成的访问事务。处理器具有正常执行模式和隔离执行模式。访问事务具有访问信息。在另一实施例中，一种方法包括使用至少一个配置参数和访问信息来检查访问检查电路的访问事务。

10. 发明授权

US06990579B1 Platform and method for remote attestation of a platform 失效
标题翻译：平台和平台的远程认证方法
公开(公告)号：US06990579B1
公开(公告)日：2006-01-24
申请号：US09541108
申请日：2000-03-31
申请人： Howard C. Herbert , David W. Grawrock , Carl M. Ellison , Roger A. Golliver , Derrick C. Lin , Francis X. McKeen , Gilbert Neiger , Ken Reneris , James A. Sutton , Shreekant S. Thakkar , Millind Mittal
发明人： Howard C. Herbert , David W. Grawrock , Carl M. Ellison , Roger A. Golliver , Derrick C. Lin , Francis X. McKeen , Gilbert Neiger , Ken Reneris , James A. Sutton , Shreekant S. Thakkar , Millind Mittal
IPC分类号： H04L9/00
CPC分类号： G06F21/305 , G06F9/30189 , G06F12/1491 , G06F21/35 , G06F21/53 , G06F21/57 , G06F21/575 , G06F21/64 , G06F21/74 , G06F2221/2101 , G06F2221/2103 , G06F2221/2105 , G06F2221/2149
摘要： In one embodiment, a method of remote attestation for a special mode of operation. The method comprises storing an audit log within protected memory of a platform. The audit log is a listing of data representing each of a plurality of IsoX software modules loaded into the platform. The audit log is retrieved from the protected memory in response to receiving a remote attestation request from a remotely located platform. Then, the retrieved audit log is digitally signed to produce a digital signature for transfer to the remotely located platform.
摘要翻译：在一个实施例中，用于特殊操作模式的远程认证的方法。该方法包括将审核日志存储在平台的受保护的存储器内。审计日志是表示加载到平台中的多个IsoX软件模块中的每一个的数据的列表。响应于从远程位置的平台接收远程认证请求，从受保护的内存中检索审核日志。然后，检索的审核日志进行数字签名，以产生数字签名，以转移到位于远程的平台。

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式