Abstract:
PROBLEM TO BE SOLVED: To enable integrity of secure applications and their data to be achieved within a computer system.SOLUTION: In a microprocessor 100, each processor core 105, 110 includes logic 119 for implementing secure enclave techniques, to perform efficient resource allocation among a plurality of cores or processors, establishing one or more secure enclaves in which an application and data may be stored and executed.
Abstract:
An instruction of software outside of a secure enclave is decoded and the decoded instruction is executed to read bytes from an enclave page cache (EPC) page of an enclave. The enclave is marked as being a debug enclave. An address of the bytes to read from the debug enclave is preferably provided in our CX. A debug bit is preferably set in the EPC to indicate that the enclave is a debug enclave. The contents of the debug enclave are preferably encrypted. The debug enclave may allow access using commands EDBGRD (read) and EDBGWR (write).
Abstract:
The disclosed embodiments are generally directed to inline encryption of data at line speed at a chip interposed between two memory components. The inline encryption may be 5 implemented at a System-on-Chip (“800” or “SOC”). The memory components may comprise Non-Volatile Memory express (NVMe) and a dynamic random access memory (DRAM). An exemplary device includes an SOC to communicate with a Non-Volatile Memory NVMe circuitry to provide direct memory access (DMA) to an external memory component. The SOC may include: a cryptographic controller circuitry; a cryptographic memory circuitry in communication 10 with the cryptographic controller, the cryptographic memory circuitry configured to store instructions to encrypt or decrypt data transmitted through the SOC; and an encryption engine in communication with the crypto controller circuitry, the encryption engine configured to encrypt or decrypt data according to instructions stored at the crypto memory circuitry. Other embodiments are also disclosed and claimed.
Abstract:
Generally, this disclosure provides systems, devices, methods and computer readable media for virtualization-based intra-block workload isolation. The system may include a virtual machine manager (VMM) module to create a secure virtualization environment or sandbox. The system may also include a processor block to load data into a first region of the sandbox and to generate a workload package based on the data. The workload package is stored in a second region of the sandbox. The system may further include an operational block to fetch and execute instructions from the workload package.
Abstract:
Methods, apparatuses and system provide for technology that interleaves a plurality of verification commands with a plurality of copy commands in a command buffer, wherein each copy command includes a message authentication code (MAC) derived from a master 5 session key, wherein one or more of the plurality of verification commands corresponds to a copy command in the plurality of copy commands, and wherein a verification command at an end of the command buffer corresponds to contents of the command buffer. The technology may also add a MAC generation command to the command buffer, wherein the MAC generation command references an address of a compute result. 10
Abstract:
Methods, apparatuses and system provide for technology that interleaves a plurality of verification commands with a plurality of copy commands in a command buffer, wherein each copy command includes a message authentication code (MAC) derived from a master 5 session key, wherein one or more of the plurality of verification commands corresponds to a copy command in the plurality of copy commands, and wherein a verification command at an end of the command buffer corresponds to contents of the command buffer. The technology may also add a MAC generation command to the command buffer, wherein the MAC generation command references an address of a compute result. 10