Patents by Inventor Francis X. McKeen

Francis X. McKeen has filed for patents to protect the following inventions. This listing includes patent applications that are pending as well as patents that have already been granted by the United States Patent and Trademark Office (USPTO).

  • Publication number: 20170353319
    Abstract: A computing platform implements one or more secure enclaves including a first provisioning enclave to interface with a first provisioning service to obtain a first attestation key from the first provisioning service, a second provisioning enclave to interface with a different, second provisioning service to obtain a second attestation key from the second provisioning service, and a provisioning certification enclave to sign first data from the first provisioning enclave and second data from the second provisioning enclave using a hardware-based provisioning attestation key. The signed first data is used by the first provisioning enclave to authenticate to the first provisioning service to obtain the first attestation key and the signed second data is used by the second provisioning enclave to authenticate to the second provisioning service to obtain the second attestation key.
    Type: Application
    Filed: September 29, 2016
    Publication date: December 7, 2017
    Inventors: Vincent R. Scarlata, Francis X. McKeen, Carlos V. Rozas, Simon P. Johnson, Bo Zhang, James D. Beaney, JR., Piotr Zmijewski, Wesley H. Smith, Eduardo Cabre
  • Publication number: 20170351515
    Abstract: Embodiments of an invention for memory management in secure enclaves are disclosed. In one embodiment, a processor includes an instruction unit and an execution unit. The instruction unit is to receive a first instruction and a second instruction. The execution unit is to execute the first instruction, wherein execution of the first instruction includes allocating a page in an enclave page cache to a secure enclave. The execution unit is also to execute the second instruction, wherein execution of the second instruction includes confirming the allocation of the page.
    Type: Application
    Filed: August 22, 2017
    Publication date: December 7, 2017
    Inventors: Rebekah Leslie-Hurd, Carlos V. Rozas, Vincent R. Scarlata, Simon P. Johnson, Uday R. Savagaonkar, Barry E. Huntley, Vedvyas Shanbhogue, Ittai Anati, Francis X. Mckeen, Michael A. Goldsmith, Ilya Alexandrovich, Alex Berenzon, Wesley H. Smith, Gilbert Neiger
  • Publication number: 20170337145
    Abstract: Instructions and logic interrupt and resume paging in secure enclaves. Embodiments include instructions, specify page addresses allocated to a secure enclave, the instructions are decoded for execution by a processor. The processor includes an enclave page cache to store secure data in a first cache line and in a last cache line for a page corresponding to the page address. A page state is read from the first or last cache line for the page when an entry in an enclave page cache mapping for the page indicates only a partial page is stored in the enclave page cache. The entry for a partial page may be set, and a new page state may be recorded in the first cache line when writing-back, or in the last cache line when loading the page when the instruction's execution is being interrupted. Thus the writing-back, or loading can be resumed.
    Type: Application
    Filed: June 2, 2017
    Publication date: November 23, 2017
    Inventors: Carlos V. Rozas, Ilya Alexandrovich, Gilbert Neiger, Francis X. McKeen, Ittai Anati, Vedvyas Shanbhogue, Shay Gueron
  • Patent number: 9798666
    Abstract: A processor implementing techniques to supporting fault information delivery is disclosed. In one embodiment, the processor includes a memory controller unit to access an enclave page cache (EPC) and a processor core coupled to the memory controller unit. The processor core to detect a fault associated with accessing the EPC and generate an error code associated with the fault. The error code reflects an EPC-related fault cause. The processor core is further to encode the error code into a data structure associated with the processor core. The data structure is for monitoring a hardware state related to the processor core.
    Type: Grant
    Filed: June 26, 2015
    Date of Patent: October 24, 2017
    Assignee: Intel Corporation
    Inventors: Rebekah M. Leslie-Hurd, Carlos V. Rozas, Francis X. McKeen, Ilya Alexandrovich, Vedvyas Shanbhogue, Bin Xing, Mark W. Shanahan, Simon P. Johnson
  • Publication number: 20170270058
    Abstract: Embodiments of an invention for maintaining a secure processing environment across power cycles are disclosed. In one embodiment, a processor includes an instruction unit and an execution unit. The instruction unit is to receive an instruction to evict a root version array page entry from a secure cache. The execution unit is to execute the instruction. Execution of the instruction includes generating a blob to contain information to maintain a secure processing environment across a power cycle and storing the blob in a non-volatile memory.
    Type: Application
    Filed: June 2, 2017
    Publication date: September 21, 2017
    Inventors: Francis X. McKeen, Vincent R. Scarlata, Carlos V. Rozas, Ittai Anati, Vedvyas Shanbhogue
  • Patent number: 9766889
    Abstract: Embodiments of an invention for memory management in secure enclaves are disclosed. In one embodiment, a processor includes an instruction unit and an execution unit. The instruction unit is to receive a first instruction and a second instruction. The execution unit is to execute the first instruction, wherein execution of the first instruction includes allocating a page in an enclave page cache to a secure enclave. The execution unit is also to execute the second instruction, wherein execution of the second instruction includes confirming the allocation of the page.
    Type: Grant
    Filed: March 18, 2016
    Date of Patent: September 19, 2017
    Assignee: Intel Corporation
    Inventors: Rebekah Leslie-Hurd, Carlos V. Rozas, Vincent R. Scarlata, Simon P. Johnson, Uday R. Savagaonkar, Barry E. Huntley, Vedvyas Shanbhogue, Ittai Anati, Francis X. Mckeen, Michael A. Goldsmith, Ilya Alexandrovich, Alex Berenzon, Wesley H. Smith, Gilbert Neiger
  • Patent number: 9767044
    Abstract: Secure memory repartitioning technologies are described. A processor includes a processor core and a memory controller coupled between the processor core and main memory. The main memory includes a memory range including a section of convertible pages that are convertible to secure pages or non-secure pages. The processor core, in response to a page conversion instruction, is to determine from the instruction a convertible page in the memory range to be converted and convert the convertible page to be at least one of a secure page or a non-secure page. The memory range may also include a hardware reserved section that is convertible in response to a section conversion instruction.
    Type: Grant
    Filed: September 24, 2013
    Date of Patent: September 19, 2017
    Assignee: Intel Corporation
    Inventors: Siddhartha Chhabra, Uday R. Savagaonkar, Michael A. Goldsmith, Simon P. Johnson, Rebekah M. Leslie-Hurd, Francis X. McKeen, Gilbert Neiger, Raghunandan Makaram, Carlos V. Rozas, Amy L. Santoni, Vincent R. Scarlata, Vedvyas Shanbhogue, Wesley H. Smith, Ittai Anati, Ilya Alexandrovich
  • Patent number: 9747102
    Abstract: Embodiments of an invention for memory management in secure enclaves are disclosed. In one embodiment, a processor includes an instruction unit and an execution unit. The instruction unit is to receive a first instruction and a second instruction. The execution unit is to execute the first instruction, wherein execution of the first instruction includes allocating a page in an enclave page cache to a secure enclave. The execution unit is also to execute the second instruction, wherein execution of the second instruction includes confirming the allocation of the page.
    Type: Grant
    Filed: December 28, 2012
    Date of Patent: August 29, 2017
    Assignee: Intel Corporation
    Inventors: Rebekah Leslie, Carlos V. Rozas, Vincent R. Scarlata, Simon P. Johnson, Uday R. Savagaonkar, Barry E. Huntley, Vedvyas Shanbhogue, Ittai Anati, Francis X. Mckeen, Michael A. Goldsmith, Ilya Alexandrovich, Alex Berenzon, Wesley H. Smith, Gilbert G. Neiger
  • Patent number: 9716710
    Abstract: Technologies for secure access to platform security services include a computing device having a processor and a security engine. The computing device establishes a platform services enclave in a virtual machine of the computing device using secure enclave support of the processor. The platform services enclave receives a platform services request from an application enclave via a first authenticated session and transmits the platform services request to a virtual security engine established by a host environment via a second authenticated session. The first and second authenticated sessions may be authenticated by report-based attestation and quote-based attestation, respectively. The virtual security engine transmits the platform services request to the security engine via a long-term pairing session established by the virtual security engine with the security engine. The security engine performs the platform services request using hardware resources shared with other platform services enclaves.
    Type: Grant
    Filed: June 26, 2015
    Date of Patent: July 25, 2017
    Assignee: Intel Corporation
    Inventors: Mona Vij, Carlos V. Rozas, Vincent R. Scarlata, Francis X. McKeen, Bo Zhang
  • Patent number: 9710401
    Abstract: A processor includes a decode unit to decode an instruction that is to indicate a page of a protected container memory, and a storage location outside of the protected container memory. An execution unit, in response to the instruction, is to ensure that there are no writable references to the page of the protected container memory while it has a write protected state. The execution unit is to encrypt a copy of the page of the protected container memory. The execution unit is to store the encrypted copy of the page to the storage location outside of the protected container memory, after it has been ensured that there are no writable references. The execution unit is to leave the page of the protected container memory in the write protected state, which is also valid and readable, after the encrypted copy has been stored to the storage location.
    Type: Grant
    Filed: June 26, 2015
    Date of Patent: July 18, 2017
    Assignee: Intel Corporation
    Inventors: Carlos V. Rozas, Mona Vij, Rebekah M. Leslie-Hurd, Krystof C. Zmudzinski, Somnath Chakrabarti, Francis X. McKeen, Vincent R. Scarlata, Simon P. Johnson, Ilya Alexandrovich, Gilbert Neiger, Vedvyas Shanbhogue, Ittai Anati
  • Patent number: 9703733
    Abstract: Instructions and logic interrupt and resume paging in secure enclaves. Embodiments include instructions, specify page addresses allocated to a secure enclave, the instructions are decoded for execution by a processor. The processor includes an enclave page cache to store secure data in a first cache line and in a last cache line for a page corresponding to the page address. A page state is read from the first or last cache line for the page when an entry in an enclave page cache mapping for the page indicates only a partial page is stored in the enclave page cache. The entry for a partial page may be set, and a new page state may be recorded in the first cache line when writing-back, or in the last cache line when loading the page when the instruction's execution is being interrupted. Thus the writing-back, or loading can be resumed.
    Type: Grant
    Filed: June 27, 2014
    Date of Patent: July 11, 2017
    Assignee: Intel Corporation
    Inventors: Carlos V. Rozas, Ilya Alexandrovich, Gilbert Neiger, Francis X. McKeen, Ittai Anati, Vedvyas Shanbhogue, Shay Gueron
  • Publication number: 20170185533
    Abstract: Instructions and logic support suspending and resuming migration of enclaves in a secure enclave page cache (EPC). An EPC stores a secure domain control structure (SDCS) in storage accessible by an enclave for a management process, and by a domain of enclaves. A second processor checks if a corresponding version array (VA) page is bound to the SDCS, and if so: increments a version counter in the SDCS for the page, performs an authenticated encryption of the page from the EPC using the version counter in the SDCS, and writes the encrypted page to external memory. A second processor checks if a corresponding VA page is bound to a second SDCS of the second processor, and if so: performs an authenticated decryption of the page using a version counter in the second SDCS, and loads the decrypted page to the EPC in the second processor if authentication passes.
    Type: Application
    Filed: December 24, 2015
    Publication date: June 29, 2017
    Inventors: Carlos V. Rozas, Ilya Alexandrovich, Gilbert Neiger, Francis X. McKeen, Ittai Anati, Vedvyas Shanbhogue, Vij Mona, Leslie-Hurd M. Rebekah, Zmudzinski C. Krystof, Chakrabarti Somnath, Scarlata R. Vincent, Johnson P. Simon
  • Patent number: 9690704
    Abstract: Embodiments of an invention for paging in secure enclaves are disclosed. In one embodiment, a processor includes an instruction unit and an execution unit. The instruction unit is to receive a first instruction. The execution unit is to execute the first instruction, wherein execution of the first instruction includes evicting a first page from an enclave page cache.
    Type: Grant
    Filed: April 6, 2016
    Date of Patent: June 27, 2017
    Assignee: Intel Corporation
    Inventors: Francis X. Mckeen, Michael A. Goldsmith, Barry E. Huntley, Simon P. Johnson, Rebekah Leslie-Hurd, Carlos V. Rozas, Uday R. Savagaonkar, Vincent R. Scarlata, Vedvyas Shanbhogue, Wesley H. Smith, Ittai Anati, Ilya Alexandrovich, Alex Berenzon, Gilbert Neiger
  • Patent number: 9665724
    Abstract: Embodiments of an invention for logging in secure enclaves are disclosed. In one embodiment, a processor includes an instruction unit and an execution unit. The instruction unit is to receive an instruction having an associated enclave page cache address. The execution unit is to execute the instruction without causing a virtual machine exit, wherein execution of the instruction includes logging the instruction and the associated enclave page cache address.
    Type: Grant
    Filed: October 21, 2015
    Date of Patent: May 30, 2017
    Assignee: Intel Corporation
    Inventors: Francis X. McKeen, Michael A. Goldsmith, Barrey E. Huntley, Simon P. Johnson, Rebekah M. Leslie-Hurd, Carlos V. Rozas, Uday R. Savagaonkar, Vincent R. Scarlata, Vedvyas Shanbhogue, Wesley H. Smith, Gilbert Neiger
  • Publication number: 20170091445
    Abstract: Technologies for software attack detection include a computing device with a processor and a memory external to the processor. The processor originates a memory transaction with an associated secure enclave status bit that indicates whether the memory transaction originated in a secure execution mode, such as from a secure enclave. The processor computes an error-correcting code (ECC) based as a function of memory transaction data and the secure enclave status bit, and performs the memory transaction based on the ECC and the memory transaction data using the memory of the computing device. The processor may store the ECC and the memory transaction data to memory. The processor may load a stored ECC and data from the memory and compare the computed ECC to the stored ECC to detect memory transactions with an invalid secure enclave status bit. Other embodiments are described and claimed.
    Type: Application
    Filed: September 26, 2015
    Publication date: March 30, 2017
    Inventors: Bin Xing, Krystof C. Zmudzinski, Wei Wu, Shih-Lien L. Lu, Carlos V. Rozas, Francis X. McKeen, Siddhartha Chhabra, Mark W. Shanahan
  • Publication number: 20170083724
    Abstract: Memory security technologies are described. An example processing system includes a processor core and a memory controller coupled to the processor core and a memory. The processor core can receive a content read instruction from an application. The processor core can identify a cache line (CL) from a plurality of CLs of a cryptographic cache block (CCB) requested in the content read instruction. The processor core can load, from a cryptographic tree, tree nodes with security metadata. The processor core can retrieve, from the memory, the CCB. The processor core can generate a second MAC from the CCB. The processor core can compare the first MAC with the second MAC. The processor core can decrypt the CCB using security metadata when the first MAC matches the second MAC. The processor core can send at least the identified CL from the decrypted CCB to the application.
    Type: Application
    Filed: September 23, 2015
    Publication date: March 23, 2017
    Inventors: Siddhartha Chhabra, Francis X. Mckeen, Carlos V. Rozas, Saeedeh Komijani, Tamara S. Lehman
  • Publication number: 20170054557
    Abstract: A processor to support platform migration of secure enclaves is disclosed. In one embodiment, the processor includes a memory controller unit to access secure enclaves and a processor core coupled to the memory controller unit. The processor core to identify a control structure associated with a secure enclave. The control structure comprises a plurality of data slots and keys associated with a first platform comprising the memory controller unit and the processor core. A version of data from the secure enclave is associated with the plurality of data slots. Migratable keys are generated as a replacement for the keys associated with the control structure. The migratable keys control access to the secure enclave. Thereafter, the control structure is migrated to a second platform to enable access to the secure enclave on the second platform.
    Type: Application
    Filed: August 18, 2015
    Publication date: February 23, 2017
    Inventors: Carlos V. Rozas, Mona Vij, Rebekah M. Leslie-Hurd, Krystof C. Zmudzinski, Somnath Chakrabarti, Francis X. McKeen, Vincent R. Scarlata, Simon P. Johnson, Ilya Alexandrovich
  • Publication number: 20170024573
    Abstract: A processor implementing techniques for supporting configurable security levels for memory address ranges is disclosed. In one embodiment, the processor includes a processing core a memory controller, operatively coupled to the processing core, to access data in an off-chip memory and a memory encryption engine (MEE) operatively coupled to the memory controller. The MEE is to responsive to detecting a memory access operation with respect to a memory location identified by a memory address within a memory address range associated with the off-chip memory, identify a security level indicator associated with the memory location based on a value stored on a security range register. The MEE is further to access at least a portion of a data item associated with the memory address range of the off-chip memory in view of the security level indicator.
    Type: Application
    Filed: July 20, 2015
    Publication date: January 26, 2017
    Inventors: Binata Bhattacharyya, Raghunandan Makaram, Amy L. Santoni, George Z. Chrysos, Simon P. Johnson, Brian S. Morris, Francis X. McKeen
  • Publication number: 20170024317
    Abstract: Embodiments of an invention for paging in secure enclaves are disclosed. In one embodiment, a processor includes an instruction unit and an execution unit. The instruction unit is to receive a first instruction. The execution unit is to execute the first instruction, wherein execution of the first instruction includes evicting a first page from an enclave page cache.
    Type: Application
    Filed: April 6, 2016
    Publication date: January 26, 2017
    Applicant: Intel Corporation
    Inventors: Francis X. Mckeen, Michael A. Goldsmith, Barry E. Huntley, Simon P. Johnson, Rebekah Leslie-Hurd, Carlos V. Rozas, Uday R. Savagaonkar, Vincent R. Scarlata, Vedvyas Shanbhogue, Wesley H. Smith, Ittai Anati, Ilya Alexandrovich, Alex Berenzon, Gilbert Neiger
  • Publication number: 20160381005
    Abstract: Technologies for secure access to platform security services include a computing device having a processor and a security engine. The computing device establishes a platform services enclave in a virtual machine of the computing device using secure enclave support of the processor. The platform services enclave receives a platform services request from an application enclave via a first authenticated session and transmits the platform services request to a virtual security engine established by a host environment via a second authenticated session. The first and second authenticated sessions may be authenticated by report-based attestation and quote-based attestation, respectively. The virtual security engine transmits the platform services request to the security engine via a long-term pairing session established by the virtual security engine with the security engine. The security engine performs the platform services request using hardware resources shared with other platform services enclaves.
    Type: Application
    Filed: June 26, 2015
    Publication date: December 29, 2016
    Inventors: Mona Vij, Carlos V. Rozas, Vincent R. Scarlata, Francis X. McKeen, Bo Zhang