Patents by Inventor Francis X. McKeen

Francis X. McKeen has filed for patents to protect the following inventions. This listing includes patent applications that are pending as well as patents that have already been granted by the United States Patent and Trademark Office (USPTO).

  • Patent number: 10325118
    Abstract: Memory security technologies are described. An example processing system includes a processor core and a memory controller coupled to the processor core and a memory. The processor core can receive a content read instruction from an application. The processor core can identify a cache line (CL) from a plurality of CLs of a cryptographic cache block (CCB) requested in the content read instruction. The processor core can load, from a cryptographic tree, tree nodes with security metadata. The processor core can retrieve, from the memory, the CCB. The processor core can generate a second MAC from the CCB. The processor core can compare the first MAC with the second MAC. The processor core can decrypt the CCB using security metadata when the first MAC matches the second MAC. The processor core can send at least the identified CL from the decrypted CCB to the application.
    Type: Grant
    Filed: January 4, 2018
    Date of Patent: June 18, 2019
    Assignee: Intel Corporation
    Inventors: Siddhartha Chhabra, Francis X. Mckeen, Carlos V. Rozas, Saeedeh Komijani, Tamara S. Lehman
  • Patent number: 10289554
    Abstract: A processor implementing techniques to supporting fault information delivery is disclosed. In one embodiment, the processor includes a memory controller unit to access an enclave page cache (EPC) and a processor core coupled to the memory controller unit. The processor core to detect a fault associated with accessing the EPC and generate an error code associated with the fault. The error code reflects an EPC-related fault cause. The processor core is further to encode the error code into a data structure associated with the processor core. The data structure is for monitoring a hardware state related to the processor core.
    Type: Grant
    Filed: September 21, 2017
    Date of Patent: May 14, 2019
    Assignee: Intel Corporation
    Inventors: Rebekah M. Leslie-Hurd, Carlos V. Rozas, Francis X. Mckeen, Ilya Alexandrovich, Vedvyas Shanbhogue, Bin Xing, Mark W. Shanahan, Simon P. Johnson
  • Patent number: 10282306
    Abstract: A processor for supporting secure memory intent is disclosed. The processor of the disclosure includes a memory execution unit to access memory and a processor core coupled to the memory execution unit. The processor core is to receive a request to access a convertible page of the memory. In response to the request, the processor core to determine an intent for the convertible page in view of a page table entry (PTE) corresponding to the convertible page. The intent indicates whether the convertible page is to be accessed as at least one of a secure page or a non-secure page.
    Type: Grant
    Filed: January 3, 2018
    Date of Patent: May 7, 2019
    Assignee: Intel Corporation
    Inventors: Krystof C. Zmudzinski, Siddhartha Chhabra, Uday R. Savagaonkar, Simon P. Johnson, Rebekah M. Leslie-Hurd, Francis X. McKeen, Gilbert Neiger, Raghunandan Makaram, Carlos V. Rozas, Amy L. Santoni, Vincent R. Scarlata, Vedvyas Shanbhogue, Ilya Alexandrovich, Ittai Anati, Wesley H. Smith, Michael Goldsmith
  • Publication number: 20190102324
    Abstract: Cache behavior for secure memory repartitioning systems is described. Implementations may include a processing core and a memory controller coupled between the processor core and a memory device. The processor core is to receive a memory access request to a page in the memory device, the memory access request comprising a first guarded attribute (GA) indicator indicating whether the page is a secure page belonging to an enclave, determine whether the first GA indicator matches a second GA indicator in a cache line entry corresponding to the page, the cache line entry comprised in a cache, and responsive to a determination that the first GA indicator does not match the second GA indicator, apply an eviction policy to the cache line entry based on whether the cache line is indicated as a dirty cache line and accessing second data in the memory device for the page.
    Type: Application
    Filed: September 29, 2017
    Publication date: April 4, 2019
    Inventors: Meltem Ozsoy, Krystof C. Zmudzinski, Larisa Novakovsky, Julius Mandelblat, Francis X. McKeen, Carlos V. Rozas, Ittai Anati, Ilya Alexandrovich
  • Publication number: 20190095357
    Abstract: A system includes a processor core and main memory. The processor core is to, in response to execution of a patch-load instruction, retrieve, from a predetermined area of the main memory, memory protection metadata and a memory range of reserved memory, wherein the reserved memory is not flexibly convertible to enclave pages. The processor core is further to retrieve a bit from an architectural control register, wherein a value of the bit is to indicate whether an operating system is capable of management of flexibly-convertible enclave pages. The processor core is further to activate, using the memory protection metadata and one of the first information or the second information, a mode of protected memory management for the processor core in response to the value of the bit in the architectural control register.
    Type: Application
    Filed: September 28, 2017
    Publication date: March 28, 2019
    Inventors: Meltem OZSOY, Vedvyas SHANBHOGUE, Krystof C. ZMUDZINSKI, Francis X. MCKEEN, Carlos V. ROZAS, Ilya ALEXANDROVICH, Ittai ANATI, Raghunandan MAKARAM, Dror CASPI, Hisham SHAFI
  • Publication number: 20190095334
    Abstract: Secure memory repartitioning technologies are described. Embodiments of the disclosure may include a processing device including a processing core and a memory controller coupled between the processor core and a memory device. The memory device includes a memory range including a section of convertible pages that are convertible to secure pages or non-secure pages. The processor core is to receive a non-secure access request to a page in the memory device, responsive to a determination, based on one or more secure state bits in one or more secure state bit arrays, that the page is a secure page, insert an abort page address into a translation lookaside buffer, and responsive to a determination, based on the one or more secure state bits in the one or more secure state bit arrays, that the page is a non-secure page, insert the page into the translation lookaside buffer.
    Type: Application
    Filed: September 28, 2017
    Publication date: March 28, 2019
    Inventors: Vedvyas Shanbhogue, Krystof C. Zmudzinski, Carlos V. Rozas, Francis X. McKeen, Raghunandan Makaram, Ilya Alexandrovich, Ittai Anati, Meltem Ozsoy
  • Publication number: 20190087586
    Abstract: A technique to enable secure application and data integrity within a computer system. In one embodiment, one or more secure enclaves are established in which an application and data may be stored and executed.
    Type: Application
    Filed: September 6, 2018
    Publication date: March 21, 2019
    Inventors: Francis X. McKEEN, Carlos V. ROZAS, Uday R. SAVAGAONKAR, Simon P. JOHNSON, Vincent SCARLATA, Michael A. GOLDSMITH, Ernie BRICKELL, Jiang Tao LI, Howard C. HERBERT, Prashant DEWAN, Stephen J. TOLOPKA, Gilbert NEIGER, David DURHAM, Gary GRAUNKE, Bernard LINT, Don A. VAN DYKE, Joseph CIHULA, Stalinselvaraj JEYASINGH, Stephen R. VAN DOREN, Dion RODGERS, John GARNEY, Asher ALTMAN
  • Patent number: 10230528
    Abstract: Systems and methods for memory protection for implementing trusted execution environment. An example processing system comprises: an on-package memory; a memory encryption engine (MEE) comprising a MEE cache, the MEE to: responsive to failing to locate, within the MEE cache, an encryption metadata associated with a data item loaded from an external memory, retrieve at least part of the encryption metadata from the OPM, and validate the data item using the encryption metadata.
    Type: Grant
    Filed: May 4, 2015
    Date of Patent: March 12, 2019
    Assignee: Intel Corporation
    Inventors: Binata Bhattacharyya, Amy L. Santoni, Raghunandan Makaram, Francis X. McKeen, Simon P. Johnson, George Z. Chrysos, Siddhartha Chhabra
  • Patent number: 10216648
    Abstract: Embodiments of an invention for maintaining a secure processing environment across power cycles are disclosed. In one embodiment, a processor includes an instruction unit and an execution unit. The instruction unit is to receive an instruction to evict a root version array page entry from a secure cache. The execution unit is to execute the instruction. Execution of the instruction includes generating a blob to contain information to maintain a secure processing environment across a power cycle and storing the blob in a non-volatile memory.
    Type: Grant
    Filed: June 2, 2017
    Date of Patent: February 26, 2019
    Assignee: Intel Corporation
    Inventors: Francis X. McKeen, Vincent R. Scarlata, Carlos V. Rozas, Ittai Anati, Vedvyas Shanbhogue
  • Publication number: 20190052469
    Abstract: A computing platform implements one or more secure enclaves including a first provisioning enclave to interface with a first provisioning service to obtain a first attestation key from the first provisioning service, a second provisioning enclave to interface with a different, second provisioning service to obtain a second attestation key from the second provisioning service, and a provisioning certification enclave to sign first data from the first provisioning enclave and second data from the second provisioning enclave using a hardware-based provisioning attestation key. The signed first data is used by the first provisioning enclave to authenticate to the first provisioning service to obtain the first attestation key and the signed second data is used by the second provisioning enclave to authenticate to the second provisioning service to obtain the second attestation key.
    Type: Application
    Filed: October 17, 2018
    Publication date: February 14, 2019
    Applicant: Intel Corporation
    Inventors: Vincent R. Scarlata, Francis X. McKeen, Carlos V. Rozas, Simon P. Johnson, Bo Zhang, James D. Beaney, JR., Piotr Zmijewski, Wesley H. Smith, Eduardo Cabre
  • Publication number: 20190012273
    Abstract: Secure memory allocation technologies are described. A processor includes a processor core and a memory controller that is coupled between the processor core and main memory. The main memory comprises a protected region including secured pages. The processor, in response to a content copy instruction, is to initialize a target page in the protected region of an application address space. The processor, in response to the content copy instruction, is also to select content of a source page in the protected region to be copied. The processor, in response to the content copy instruction, is also to copy the selected content to the target page in the protected region of the application address space.
    Type: Application
    Filed: July 16, 2018
    Publication date: January 10, 2019
    Inventors: Rebekah M. Leslie-Hurd, Francis X. McKeen, Carlos V. Rozas, Krystof C. Zmudzinski
  • Publication number: 20180365438
    Abstract: A processor implementing techniques for supporting configurable security levels for memory address ranges is disclosed. In one embodiment, the processor includes a processing core a memory controller, operatively coupled to the processing core, to access data in an off-chip memory and a memory encryption engine (MEE) operatively coupled to the memory controller. The MEE is to responsive to detecting a memory access operation with respect to a memory location identified by a memory address within a memory address range associated with the off-chip memory, identify a security level indicator associated with the memory location based on a value stored on a security range register. The MEE is further to access at least a portion of a data item associated with the memory address range of the off-chip memory in view of the security level indicator.
    Type: Application
    Filed: April 5, 2018
    Publication date: December 20, 2018
    Inventors: Binata Bhattacharyya, Raghunandan Makaram, Amy L. Santoni, George Z. Chrysos, Simon P. Johnson, Brian S. Morris, Francis X. McKeen
  • Patent number: 10152350
    Abstract: Particular embodiments described herein provide for an electronic device that can be configured to determine that a secure domain has been created on a device, where keys are required to access the secure domain, obtain the keys that are required to access the secure domain from a network element, and encrypt the keys and store the encrypted keys on the device. In an example, only the secure domain can decrypt the encrypted keys and the device is a virtual machine.
    Type: Grant
    Filed: July 1, 2016
    Date of Patent: December 11, 2018
    Assignee: Intel Corporation
    Inventors: Somnath Chakrabarti, Mona Vij, Carlos V. Rozas, Brandon Baker, Vincent R. Scarlata, Francis X. McKeen, Simon P. Johnson
  • Patent number: 10135622
    Abstract: A computing platform implements one or more secure enclaves including a first provisioning enclave to interface with a first provisioning service to obtain a first attestation key from the first provisioning service, a second provisioning enclave to interface with a different, second provisioning service to obtain a second attestation key from the second provisioning service, and a provisioning certification enclave to sign first data from the first provisioning enclave and second data from the second provisioning enclave using a hardware-based provisioning attestation key. The signed first data is used by the first provisioning enclave to authenticate to the first provisioning service to obtain the first attestation key and the signed second data is used by the second provisioning enclave to authenticate to the second provisioning service to obtain the second attestation key.
    Type: Grant
    Filed: September 29, 2016
    Date of Patent: November 20, 2018
    Assignee: Intel Corporation
    Inventors: Vincent R. Scarlata, Francis X. McKeen, Carlos V. Rozas, Simon P. Johnson, Bo Zhang, James D. Beaney, Jr., Piotr Zmijewski, Wesley H. Smith, Eduardo Cabre
  • Publication number: 20180329707
    Abstract: Embodiments of an invention for memory management in secure enclaves are disclosed. In one embodiment, a processor includes an instruction unit and an execution unit. The instruction unit is to receive a first instruction and a second instruction. The execution unit is to execute the first instruction, wherein execution of the first instruction includes allocating a page in an enclave page cache to a secure enclave. The execution unit is also to execute the second instruction, wherein execution of the second instruction includes confirming the allocation of the page.
    Type: Application
    Filed: May 7, 2018
    Publication date: November 15, 2018
    Inventors: Rebekah Leslie-Hurd, Carlos V. Rozas, Vincent R. Scarlata, Simon P. Johnson, Uday R. Savagaonkar, Barry E. Huntley, Vedvyas Shanbhogue, Ittai Anati, Francis X. Mckeen, Michael A. Goldsmith, Ilya Alexandrovich, Alex Berenzon, Wesley H. Smith, Gilbert Neiger
  • Publication number: 20180329829
    Abstract: Translation lookaside buffer (TLB) tracking and managing technologies are described. A processing device comprises a translation lookaside buffer (TLB) and a processing core to execute a virtual machine monitor (VMM), the VMM to manage a virtual machine (VM) including virtual processors. The processing core to execute, via the VM, a plurality of conversion instructions on at least one of the virtual processors to convert a plurality of non-secure pages to a plurality of secure pages. The processing core also to execute, via the VM, one or more allocation instructions on the at least one of the virtual processors to allocate at least one secure page of the plurality of secure pages, execution of the one or more allocation instructions to include determining whether the TLB is cleared of mappings to the at least one secure page prior to allocating the at least one secure page.
    Type: Application
    Filed: May 10, 2017
    Publication date: November 15, 2018
    Inventors: Krystof C. Zmudzinski, Carlos V. Rozas, Francis X. McKeen, Rebekah M. Leslie-Hurd, Meltem Ozsoy, Somnath Chakrabarti, Mona Vij
  • Patent number: 10120805
    Abstract: A processing device includes a conflict resolution logic circuit to initiate a tracking phase to track translation look aside buffer (TLB) mappings to an enclave memory cache (EPC) page of a secure enclave. The conflict resolution logic circuit is further to execute a tracking instruction as part of the tracking phase, wherein the tracking instruction takes any page in the secure enclave as an argument parameter to the tracking instruction.
    Type: Grant
    Filed: January 18, 2017
    Date of Patent: November 6, 2018
    Assignee: Intel Corporation
    Inventors: Rebekah M. Leslie-Hurd, Francis X. McKeen, Carlos V. Rozas, Gilbert Neiger, Asit Mallick, Ittai Anati, Ilya Alexandrovich, Vedvyas Shanbhogue, Somnath Chakrabarti
  • Patent number: 10102380
    Abstract: A technique to enable secure application and data integrity within a computer system. In one embodiment, one or more secure enclaves are established in which an application and data may be stored and executed.
    Type: Grant
    Filed: March 13, 2013
    Date of Patent: October 16, 2018
    Assignee: Intel Corporation
    Inventors: Francis X. McKeen, Carlos V. Rozas, Uday R. Savagaonkar, Simon P. Johnson, Vincent Scarlata, Michael A. Goldsmith, Ernie Brickell, Jiang Tao Li, Howard C. Herbert, Prashant Dewan, Stephen J. Tolopka, Gilbert Neiger, David Durham, Gary Graunke, Bernard Lint, Don A. Van Dyke, Joseph Cihula, Stalinselvaraj Jeyasingh, Stephen R. Van Doren, Dion Rodgers, John Garney, Asher Altman
  • Publication number: 20180239713
    Abstract: A processor for supporting secure memory intent is disclosed. The processor of the disclosure includes a memory execution unit to access memory and a processor core coupled to the memory execution unit. The processor core is to receive a request to access a convertible page of the memory. In response to the request, the processor core to determine an intent for the convertible page in view of a page table entry (PTE) corresponding to the convertible page. The intent indicates whether the convertible page is to be accessed as at least one of a secure page or a non-secure page.
    Type: Application
    Filed: January 3, 2018
    Publication date: August 23, 2018
    Inventors: Krystof C. Zmudzinski, Siddhartha Chhabra, Uday R. Savagaonkar, Simon P. Johnson, Rebekah M. Leslie-Hurd, Francis X. McKeen, Gilbert Neiger, Raghunandan Makaram, Carlos V. Rozas, Amy L. Santoni, Vincent R. Scarlata, Vedvyas Shanbhogue, Ilya Alexandrovich, Ittai Anati, Wesley H. Smith, Michael Goldsmith
  • Publication number: 20180203801
    Abstract: A processing device includes a conflict resolution logic circuit to initiate a tracking phase to track translation look aside buffer (TLB) mappings to an enclave memory cache (EPC) page of a secure enclave. The conflict resolution logic circuit is further to execute a tracking instruction as part of the tracking phase, wherein the tracking instruction takes any page in the secure enclave as an argument parameter to the tracking instruction.
    Type: Application
    Filed: January 18, 2017
    Publication date: July 19, 2018
    Inventors: Rebekah M. Leslie-Hurd, Francis X. McKeen, Carlos V. Rozas, Gilbert Neiger, Asit Mallick, Ittai Anati, Ilya Alexandrovich, Vedvyas Shanbhogue, Somnath Chakrabarti