-
公开(公告)号:US12204662B2
公开(公告)日:2025-01-21
申请号:US18496108
申请日:2023-10-27
Applicant: Intel Corporation
Inventor: Salessawi Ferede Yitbarek , Lawrence A. Booth, Jr. , Brent D. Thomas , Reshma Lal , Pradeep M. Pappachan , Akshay Kadam
Abstract: Embodiments are directed to protection of communications between a trusted execution environment and a hardware accelerator utilizing enhanced end-to-end encryption and inter-context security. An embodiment of an apparatus includes one or more processors having one or more trusted execution environments (TEEs) including a first TEE to include a first trusted application; an interface with a hardware accelerator, the hardware accelerator including trusted embedded software or firmware; and a computer memory to store an untrusted kernel mode driver for the hardware accelerator, the one or more processors to establish an encrypted tunnel between the first trusted application in the first TEE and the trusted software or firmware, generate a call for a first command from the first trusted application, generate an integrity tag for the first command, and transfer command parameters for the first command and the integrity tag to the kernel mode driver to generate the first command.
-
公开(公告)号:US09817787B2
公开(公告)日:2017-11-14
申请号:US14669295
申请日:2015-03-26
Applicant: Intel Corporation
Inventor: Mohan K. Nair , Brent D. Thomas , Ramamurthy Krithivas
CPC classification number: G06F13/4282 , G06F9/4411 , G06F13/4022 , G06F13/4068
Abstract: In one embodiment, a node includes at least one core to independently execute instructions; a first host device to receive information from the at least one core and to include the information in a first packet of a first communication protocol; a selection logic coupled to the first host device to receive the first packet and to provide the first packet to a conversion logic or a first interface to communicate with a first device via a first interconnect of the first communication protocol; the conversion logic to receive the first packet under selection of the selection logic and to encapsulate the first packet into a second packet of a second communication protocol; and a second interface coupled to the conversion logic to receive the second packet and to communicate the second packet to a second device via a second interconnect of the second communication protocol. Other embodiments are described and claimed.
-
公开(公告)号:US11836272B2
公开(公告)日:2023-12-05
申请号:US17875815
申请日:2022-07-28
Applicant: Intel Corporation
Inventor: Lawrence A. Booth, Jr. , Salessawi Ferede Yitbarek , Reshma Lal , Pradeep M. Pappachan , Brent D. Thomas
CPC classification number: G06F21/6245 , G06F16/152 , G06F16/783 , G06F21/31 , G06F21/44 , G06F21/107
Abstract: Embodiments are directed to protection of privacy and data on smart edge devices. An embodiment of an apparatus includes a sensor to produce a stream of sensor data; an analytics mechanism; and a trusted execution environment (TEE) including multiple keys for data security, the apparatus to exchange keys with a host server to establish one or more secure communication channels between the apparatus and a TEE on a host server, process the stream of sensor data utilizing the analytics mechanism to generate metadata, perform encryption and integrity protection of the metadata utilizing a key from the TEE for the sensor, sign the metadata utilizing a private key for the analytics mechanism, and transfer the encrypted and integrity protected metadata and the signature to the host server via the one or more secure communication channels in a manner that prevents privileged users on the host from accessing the data.
-
公开(公告)号:US11423171B2
公开(公告)日:2022-08-23
申请号:US16725187
申请日:2019-12-23
Applicant: Intel Corporation
Inventor: Lawrence A. Booth, Jr. , Salessawi Ferede Yitbarek , Reshma Lal , Pradeep M. Pappachan , Brent D. Thomas
Abstract: Embodiments are directed to protection of privacy and data on smart edge devices. An embodiment of an apparatus includes a sensor to produce a stream of sensor data; an analytics mechanism; and a trusted execution environment (TEE) including multiple keys for data security, the apparatus to exchange keys with a host server to establish one or more secure communication channels between the apparatus and a TEE on a host server, process the stream of sensor data utilizing the analytics mechanism to generate metadata, perform encryption and integrity protection of the metadata utilizing a key from the TEE for the sensor, sign the metadata utilizing a private key for the analytics mechanism, and transfer the encrypted and integrity protected metadata and the signature to the host server via the one or more secure communication channels in a manner that prevents privileged users on the host from accessing the data.
-
公开(公告)号:US11836262B2
公开(公告)日:2023-12-05
申请号:US17958621
申请日:2022-10-03
Applicant: Intel Corporation
Inventor: Salessawi Ferede Yitbarek , Lawrence A. Booth, Jr. , Brent D. Thomas , Reshma Lal , Pradeep M. Pappachan , Akshay Kadam
CPC classification number: G06F21/606 , G06F21/76 , H04L9/0827 , H04L9/14 , G06F2221/2149
Abstract: Embodiments are directed to protection of communications between a trusted execution environment and a hardware accelerator utilizing enhanced end-to-end encryption and inter-context security. An embodiment of an apparatus includes one or more processors having one or more trusted execution environments (TEEs) including a first TEE to include a first trusted application; an interface with a hardware accelerator, the hardware accelerator including trusted embedded software or firmware; and a computer memory to store an untrusted kernel mode driver for the hardware accelerator, the one or more processors to establish an encrypted tunnel between the first trusted application in the first TEE and the trusted software or firmware, generate a call for a first command from the first trusted application, generate an integrity tag for the first command, and transfer command parameters for the first command and the integrity tag to the kernel mode driver to generate the first command.
-
公开(公告)号:US20230026602A1
公开(公告)日:2023-01-26
申请号:US17958621
申请日:2022-10-03
Applicant: Intel Corporation
Inventor: Salessawi Ferede Yitbarek , Lawrence A. Booth, JR. , Brent D. Thomas , Reshma Lal , Pradeep M. Pappachan , Akshay Kadam
Abstract: Embodiments are directed to protection of communications between a trusted execution environment and a hardware accelerator utilizing enhanced end-to-end encryption and inter-context security. An embodiment of an apparatus includes one or more processors having one or more trusted execution environments (TEEs) including a first TEE to include a first trusted application; an interface with a hardware accelerator, the hardware accelerator including trusted embedded software or firmware; and a computer memory to store an untrusted kernel mode driver for the hardware accelerator, the one or more processors to establish an encrypted tunnel between the first trusted application in the first TEE and the trusted software or firmware, generate a call for a first command from the first trusted application, generate an integrity tag for the first command, and transfer command parameters for the first command and the integrity tag to the kernel mode driver to generate the first command.
-
公开(公告)号:US20240143802A1
公开(公告)日:2024-05-02
申请号:US18496108
申请日:2023-10-27
Applicant: Intel Corporation
Inventor: Salessawi Ferede Yitbarek , Lawrence A. Booth, Jr. , Brent D. Thomas , Reshma Lal , Pradeep M. Pappachan , Akshay Kadam
CPC classification number: G06F21/606 , G06F21/76 , H04L9/0827 , H04L9/14 , G06F2221/2149
Abstract: Embodiments are directed to protection of communications between a trusted execution environment and a hardware accelerator utilizing enhanced end-to-end encryption and inter-context security. An embodiment of an apparatus includes one or more processors having one or more trusted execution environments (TEEs) including a first TEE to include a first trusted application; an interface with a hardware accelerator, the hardware accelerator including trusted embedded software or firmware; and a computer memory to store an untrusted kernel mode driver for the hardware accelerator, the one or more processors to establish an encrypted tunnel between the first trusted application in the first TEE and the trusted software or firmware, generate a call for a first command from the first trusted application, generate an integrity tag for the first command, and transfer command parameters for the first command and the integrity tag to the kernel mode driver to generate the first command.
-
公开(公告)号:US11489822B2
公开(公告)日:2022-11-01
申请号:US17063485
申请日:2020-10-05
Applicant: Intel Corporation
Inventor: Brent D. Thomas , Eric Innis , Raghunandan Makaram
Abstract: An apparatus for cloud key management may include a networking interface, a memory, and a processor, coupled to the memory and the networking interface, the networking interface to couple the apparatus to one or more endpoint servers (EPSs) of a cloud service provider (CSP), each EPS including a hardware accelerator, and a management node (MN) of the CSP. The apparatus may further include an accelerator functional unit (AFU) developer interface module operated by the processor to receive cryptographic material (CM) for each of one or more AFU developers (AFUDs) and store it into the memory, the CM includes a public key hash (PKH), and an encryption key (EK) to decrypt an AFU of the AFUD. The apparatus may also include an EK communication module operated by the processor to: receive, from the MN, a request to send to a targeted EPS an encrypted lookup table (LUT), the LUT including PKHs and associated EKs for a set of the one or more AFUDs from which the targeted EPS is authorized to receive AFUs, and in response to the request, send, to the targeted EPS, the LUT.
-
公开(公告)号:US20220366081A1
公开(公告)日:2022-11-17
申请号:US17875815
申请日:2022-07-28
Applicant: Intel Corporation
Inventor: Lawrence A. Booth, JR. , Salessawi Ferede Yitbarek , Reshma Lal , Pradeep M. Pappachan , Brent D. Thomas
IPC: G06F21/62 , G06F21/31 , G06F16/783 , G06F16/14 , G06F21/44
Abstract: Embodiments are directed to protection of privacy and data on smart edge devices. An embodiment of an apparatus includes a sensor to produce a stream of sensor data; an analytics mechanism; and a trusted execution environment (TEE) including multiple keys for data security, the apparatus to exchange keys with a host server to establish one or more secure communication channels between the apparatus and a TEE on a host server, process the stream of sensor data utilizing the analytics mechanism to generate metadata, perform encryption and integrity protection of the metadata utilizing a key from the TEE for the sensor, sign the metadata utilizing a private key for the analytics mechanism, and transfer the encrypted and integrity protected metadata and the signature to the host server via the one or more secure communication channels in a manner that prevents privileged users on the host from accessing the data.
-
公开(公告)号:US11461483B2
公开(公告)日:2022-10-04
申请号:US16774719
申请日:2020-01-28
Applicant: Intel Corporation
Inventor: Salessawi Ferede Yitbarek , Lawrence A. Booth, Jr. , Brent D. Thomas , Reshma Lal , Pradeep M. Pappachan , Akshay Kadam
Abstract: Embodiments are directed to protection of communications between a trusted execution environment and a hardware accelerator utilizing enhanced end-to-end encryption and inter-context security. An embodiment of an apparatus includes one or more processors having one or more trusted execution environments (TEEs) including a first TEE to include a first trusted application; an interface with a hardware accelerator, the hardware accelerator including trusted embedded software or firmware; and a computer memory to store an untrusted kernel mode driver for the hardware accelerator, the one or more processors to establish an encrypted tunnel between the first trusted application in the first TEE and the trusted software or firmware, generate a call for a first command from the first trusted application, generate an integrity tag for the first command, and transfer command parameters for the first command and the integrity tag to the kernel mode driver to generate the first command.
-
-
-
-
-
-
-
-
-