Abstract: Techniques for tamper detection of a memory module having non-volatile memory devices resident on a printed circuit board (PCB) by circuitry of a controller also resident on the PCB. Examples include determining resistance values of a character pattern sprayed on a side of a cover facing the non-volatile memory devices using conductive ink following first and second boots of the memory module and asserting a bit of a register to indicate tampering of the memory modules based on a comparison of the resistance values. Tamper policy actions may be initiated based on detection of tampering.

Abstract: Technologies disclosed herein provide mitigations against warm boot attacks on memory modules. For instance, in one embodiment, a non-volatile dual in-line memory module (NVDIMM) in a host computing system may detect a transition from a low-power state to a full-power state, receive a nonce value from a processor of the host computing system after the transition, verify the nonce value, and allow access to data stored on the NVDIMM based on successful verification of the nonce value. In another embodiment, an NVDIMM may be locked in response to detecting a transition from a high-power state to a low-power state in a host computing system. After a transition from the low-power state to the full-power state, the NVDIMM may obtain one or more passphrases, verify the one or more passphrases, and allow access to data stored on the NVDIMM based on successful verification of the one or more passphrases.

Abstract: Techniques for tamper detection of a memory module having non-volatile memory devices resident on a printed circuit board (PCB) by circuitry of a controller also resident on the PCB. Examples include determining resistance values of a character pattern sprayed on a side of a cover facing the non-volatile memory devices using conductive ink following first and second boots of the memory module and asserting a bit of a register to indicate tampering of the memory modules based on a comparison of the resistance values. Tamper policy actions may be initiated based on detection of tampering.

Abstract: Technologies disclosed herein provide mitigations against warm boot attacks on memory modules. For instance, in one embodiment, a non-volatile dual in-line memory module (NVDIMM) in a host computing system may detect a transition from a low-power state to a full-power state, receive a nonce value from a processor of the host computing system after the transition, verify the nonce value, and allow access to data stored on the NVDIMM based on successful verification of the nonce value. In another embodiment, an NVDIMM may be locked in response to detecting a transition from a high-power state to a low-power state in a host computing system. After a transition from the low-power state to the full-power state, the NVDIMM may obtain one or more passphrases, verify the one or more passphrases, and allow access to data stored on the NVDIMM based on successful verification of the one or more passphrases.

Abstract: Embodiments are generally directed to intelligent memory support for platform reset operation. An embodiment of a memory module includes a memory module controller and one or more memory banks. The memory module controller is to perform one or more internal reset processes as required for the memory module, and is to support a plurality of host platform reset processes to synchronize with the host platform.

Abstract: The present application is directed to establishing ownership of a secure workspace (SW). A client device may provide a SW data structure (SWDS) to a SW configurator. A SWDS may comprise a hash of an original SW and a public key, and may be signed by a private key corresponding to the public key. The SW configurator may cause an execution container (EC) to be generated including a SW initiated using the SWDS. The client device may claim SW ownership using a request (signed by the private key) transmitted along with a copy of the public key. SW ownership may be determined by an ownership determination module that verifies the signature of the request using the public key received with the request, determines a hash of the received public key and compares the hash of the received public key to a hash of the public key in the SWDS.

Abstract: The present application is directed to establishing ownership of a secure workspace (SW). A client device may provide a SW data structure (SWDS) to a SW configurator. A SWDS may comprise a hash of an original SW and a public key, and may be signed by a private key corresponding to the public key. The SW configurator may cause an execution container (EC) to be generated including a SW initiated using the SWDS. The client device may claim SW ownership using a request (signed by the private key) transmitted along with a copy of the public key. SW ownership may be determined by an ownership determination module that verifies the signature of the request using the public key received with the request, determines a hash of the received public key and compares the hash of the received public key to a hash of the public key in the SWDS.

Abstract: Techniques and mechanisms for providing access to a storage device of a computer platform. In an embodiment, an agent executing on the platform may be registered for access to the storage device, the agent being allocated a memory space by a host operating system of the platform. Registration of the agent may result in a location in the allocated memory space being mapped to a location in the storage device. In another embodiment, the agent may write to the location in the allocated memory space to request access to the storage device, wherein the request is independent of any system call to the host OS which describes the requested access.

Abstract: Embodiments include systems, methods, and apparatuses associated with storing data in a persistent memory are disclosed herein. In embodiments, a memory controller may be configured to encrypt data with an encryption key, and the encrypted data may be stored in persistent memory. The memory controller may be further configured to alter and/or destroy the encryption key in response to a reset event. Other embodiments may be disclosed and/or claimed.

Abstract: Techniques and mechanisms for providing access to a storage device of a computer platform. In an embodiment, an agent executing on the platform may be registered for access to the storage device, the agent being allocated a memory space by a host operating system of the platform. Registration of the agent may result in a location in the allocated memory space being mapped to a location in the storage device. In another embodiment, the agent may write to the location in the allocated memory space to request access to the storage device, wherein the request is independent of any system call to the host OS which describes the requested access.