Abstract: Systems, methods, and circuitry for pre-authentication of a signed data structure are provided. An integrated circuit device may include a device controller to verify a signature of a signed data structure based on, during an initial boot sequence, computing a full signature verification and computing and storing a message authentication code and, during a subsequent boot sequence, recomputing the message authentication code and comparing the recomputed message authentication code to the stored message authentication code. The integrated circuit device may include data utilization circuitry to use the signed data structure based on the signature of the signed data structure being verified.

Abstract: An apparatus to verify firmware in a computing system, comprising a non-volatile memory, including firmware memory to store agent firmware associated with each of a plurality of interconnect protocol (IP) agents and version memory to store security version numbers (SVNs) included in the agent firmware, a security controller comprising verifier logic to verify an integrity of the version memory by applying a hash algorithm to contents of the version memory to generate a SVN hash, and a trusted platform module (TPM) to store the SVN hash.

Abstract: A method includes receiving a bitstream including a signature associated with a private key, and detecting a first watermark of the bitstream, wherein the first watermark is associated with a first public key. The method also includes loading the bitstream based on determining that the first public key corresponds to a second public key and the private key and that the first public key is validated based on a validation value.

Abstract: A computing system or an integrated circuit includes a key storage circuit for storing a key and an access control enforcer circuit that grants access to the key stored in the key storage circuit in response to receiving a request based on a hardware identifier that identifies a hardware system and a subcomponent of the hardware system that is an owner of the key. The access control enforcer circuit accesses a hardware property for a key from an access control attributes circuit in response to a request to access the key. The access control enforcer circuit prevents the key from being returned to an initiator of the request if the hardware property indicates that the key is protected. The access control enforcer circuit permits the key to be used to derive, wrap, or unwrap other keys if the hardware property indicates that the key is protected.

Abstract: Techniques are described for providing consistent memory operations and security across electronic circuitry components having disparate memory and/or security architectures when integrating such disparately architected components within a single system, such as a system on chip. A programmable logical hierarchy of isolated memory region (IMR) enforcement circuits is provided to protect such IMRs, allowing or preventing memory access requests from one of multiple distinct circuitry components based on configuration registers for the IMR enforcement circuits. Integration of multiple trust domain architectures associated with the multiple distinct circuitry components is facilitated via trust domain conversion bridge circuitry that includes translation logic for generating information in accordance with a first trust domain architecture based on information provided in accordance with a distinct second trust domain architecture.

Abstract: An apparatus to verify firmware in a computing system, comprising a non-volatile memory, including firmware memory to store agent firmware associated with each of a plurality of interconnect protocol (IP) agents and version memory to store security version numbers (SVNs) included in the agent firmware, a security controller comprising verifier logic to verify an integrity of the version memory by applying a hash algorithm to contents of the version memory to generate a SVN hash, and a trusted platform module (TPM) to store the SVN hash.

Abstract: Systems or methods of the present disclosure may provide systems and techniques for controlling access to components and resources of an IC device by multiple tenants. For example, a method may include: receiving access control instructions defining a first mapping between one or more tenants and respective security attributes and a second mapping between one or more agent identifiers and respective access permissions; receiving a communication intended for a target component of the IC device; determining an origin tenant from which the communication originated; determining a security attribute associated with the origin tenant based on the first mapping; and sending the communication and an agent identifier comprising the security attribute and an initiator bridge identifier to a corresponding target bridge, wherein the corresponding target bridge is configured to grant or deny access of the communication to the target component based on the agent identifier and the second mapping.

Abstract: Systems or methods of the present disclosure may provide techniques for securing data on a shared accelerator of an integrated circuit device where each user of the shared accelerator is in a different trust boundary. For example, a method may include receiving a downstream communication intended for an accelerator from one or more components sharing the accelerator, determining an origin component from which the downstream communication originated, and assigning the downstream communication to a corresponding work queue of one or more work queues of the accelerator based on the determined origin component to isolate the accelerator from different owners. The method may also include tagging an upstream communication sent from the accelerator with an identifier that identifies the owner of the data and routing the upstream communication to a destination component based on the identifier and using the assigned attributes to isolate data within or external to the accelerator.

Abstract: A system and method of enhancing the mitigation of side channel attacks on platform interconnects using endpoint HW based detection, synchronization, and re-keying include generating a set of keys for link encryption based on a high entropy seed, storing the set of keys in a deterministic order in a register, detecting that a re-key programmable threshold is met during link encryption with a device, identifying a synchronization point associated with the device, where the synchronization point indicates the device is ready to switch a current key used for link encryption, and synchronizing a rekeying event with the device.

Abstract: An apparatus to verify firmware in a computing system, comprising a non-volatile memory, including firmware memory to store agent firmware associated with each of a plurality of interconnect protocol (IP) agents and version memory to store security version numbers (SVNs) included in the agent firmware, a security controller comprising verifier logic to verify an integrity of the version memory by applying a hash algorithm to contents of the version memory to generate a SVN hash, and a trusted platform module (TPM) to store the SVN hash.

Abstract: An apparatus to collect firmware measurement data at a computing system is disclosed. The apparatus includes a plurality of agents, each including a non-volatile memory storing firmware executed to perform a function associated with the agent, verification logic to generate measurement data by verifying the integrity of the firmware and a register to store the measurement data, and a processor to execute an instruction to collect firmware measurement data from each of the plurality of agents.

Abstract: An apparatus to implement an IP independent secure firmware load into an IP agent without a ROM to establish hardware root of trust is disclosed. The apparatus includes a plurality of agents, at least one agent including an isolated memory region accessible only to a trusted entity of the at least one agent and a main memory, and a processor to allocate a section of the isolated memory region of the at least one agent, verify a first stage firmware module, the first stage firmware module comprising instructions to enable the at least one agent to load and verify a second stage firmware module, place the first stage firmware module into memory of the at least one agent without a ROM to establish the hardware root of trust.

Abstract: A processor that was manufactured by a manufacturer comprises privileged debug operational circuitry, a debug restriction fuse, a credential store, a credential of the manufacturer in the credential store, and debug control circuitry. The debug restriction fuse is a one-time programmable fuse. The debug control circuitry is to automatically restrict access to the privileged debug operational circuitry, based on the debug restriction fuse. The processor may also include public debug operational circuitry, a prevent-unauthorized-debug (PUD) fuse, and an undo-PUD fuse. When the PUD fuse is set and the undo-PUD fuse is clear, the debug control circuitry may respond to an attempt by a debugger to use the public debug operational circuitry by determining whether the debugger is authorized, disallowing access if the debugger is not authorized, and allowing access if the debugger is authorized. Other embodiments are described and claimed.

Abstract: An integrated circuit provides a firmware dashboard to communicatively couple to a basic input/output system (BIOS), and provide to the BIOS a firmware load interface, and an intellectual property (IP) block interface to communicatively couple to an IP block, wherein the IP block provides a push model to load a firmware or a pull model to load the firmware, and wherein the firmware dashboard provides a common load flow to the BIOS for both the push model and pull model.

Abstract: There is disclosed in one example, a system-on-a-chip (SoC), including: a processor core; a fabric; an intellectual property (IP) block communicatively coupled to the processor core via the fabric, the IP block having a microcontroller configured to provide a microcontroller architecture; a firmware load interface configured to provide a standardized hardware interface to the microcontroller architecture, wherein the standardized hardware interface provides an architecture-agnostic mechanism to securely load a firmware to the intellectual property block; and logic to provide a loader to load a firmware to the IP block via the firmware load interface.

Abstract: An apparatus to verify firmware in a computing system, comprising a non-volatile memory, including firmware memory to store agent firmware associated with each of a plurality of interconnect protocol (IP) agents and version memory to store security version numbers (SVNs) included in the agent firmware, a security controller comprising verifier logic to verify an integrity of the version memory by applying a hash algorithm to contents of the version memory to generate a SVN hash, and a trusted platform module (TPM) to store the SVN hash.

Abstract: Techniques are described for providing consistent memory operations and security across electronic circuitry components having disparate memory and/or security architectures when integrating such disparately architected components within a single system, such as a system on chip. A programmable logical hierarchy of isolated memory region (IMR) enforcement circuits is provided to protect such IMRs, allowing or preventing memory access requests from one of multiple distinct circuitry components based on configuration registers for the IMR enforcement circuits. Integration of multiple trust domain architectures associated with the multiple distinct circuitry components is facilitated via trust domain conversion bridge circuitry that includes translation logic for generating information in accordance with a first trust domain architecture based on information provided in accordance with a distinct second trust domain architecture.

Abstract: An apparatus to collect firmware measurement data at a computing system is disclosed. The apparatus includes a plurality of agents, each including a non-volatile memory storing firmware executed to perform a function associated with the agent, verification logic to generate measurement data by verifying the integrity of the firmware and a register to store the measurement data, and a processor to execute an instruction to collect firmware measurement data from each of the plurality of agents.

Abstract: An apparatus to collect firmware measurement data at a computing system is disclosed. The apparatus includes a plurality of agents, each including a non-volatile memory storing firmware executed to perform a function associated with the agent, verification logic to generate measurement data by verifying the integrity of the firmware and a register to store the measurement data, and a processor to execute an instruction to collect firmware measurement data from each of the plurality of agents.

Abstract: An apparatus to verify firmware in a computing system, comprising a non-volatile memory, including firmware memory to store agent firmware associated with each of a plurality of interconnect protocol (IP) agents and version memory to store security version numbers (SVNs) included in the agent firmware, a security controller comprising verifier logic to verify an integrity of the version memory by applying a hash algorithm to contents of the version memory to generate a SVN hash, and a trusted platform module (TPM) to store the SVN hash.