Patents by Inventor Francis X. McKeen

Francis X. McKeen has filed for patents to protect the following inventions. This listing includes patent applications that are pending as well as patents that have already been granted by the United States Patent and Trademark Office (USPTO).

  • Publication number: 20160378664
    Abstract: A processor implementing techniques to supporting fault information delivery is disclosed. In one embodiment, the processor includes a memory controller unit to access an enclave page cache (EPC) and a processor core coupled to the memory controller unit. The processor core to detect a fault associated with accessing the EPC and generate an error code associated with the fault. The error code reflects an EPC-related fault cause. The processor core is further to encode the error code into a data structure associated with the processor core. The data structure is for monitoring a hardware state related to the processor core.
    Type: Application
    Filed: June 26, 2015
    Publication date: December 29, 2016
    Inventors: Rebekah M. Leslie-Hurd, Carlos V. Rozas, Francis X. McKeen, Ilya Alexandrovich, Vedvyas Shanbhogue, Bin Xing, Mark W. Shanahan, Simon P. Johnson
  • Publication number: 20160378688
    Abstract: A processor includes a decode unit to decode an instruction that is to indicate a page of a protected container memory, and a storage location outside of the protected container memory. An execution unit, in response to the instruction, is to ensure that there are no writable references to the page of the protected container memory while it has a write protected state. The execution unit is to encrypt a copy of the page of the protected container memory. The execution unit is to store the encrypted copy of the page to the storage location outside of the protected container memory, after it has been ensured that there are no writable references. The execution unit is to leave the page of the protected container memory in the write protected state, which is also valid and readable, after the encrypted copy has been stored to the storage location.
    Type: Application
    Filed: June 26, 2015
    Publication date: December 29, 2016
    Applicant: Intel Corporation
    Inventors: CARLOS V. ROZAS, MONA VIJ, REBEKAH M. LESLIE-HURD, KRYSTOF C. ZMUDZINSKI, SOMNATH CHAKRABARTI, FRANCIS X. MCKEEN, VINCENT R. SCARLATA, SIMON P. JOHNSON, ILYA ALEXANDROVICH, GILBERT NEIGER, VEDVYAS SHANBHOGUE, ITTAI ANATI
  • Publication number: 20160371191
    Abstract: Instructions and logic provide advanced paging capabilities for secure enclave page caches. Embodiments include multiple hardware threads or processing cores, a cache to store secure data for a shared page address allocated to a secure enclave accessible by the hardware threads. A decode stage decodes a first instruction specifying said shared page address as an operand, and execution units mark an entry corresponding to an enclave page cache mapping for the shared page address to block creation of a new translation for either of said first or second hardware threads to access the shared page. A second instruction is decoded for execution, the second instruction specifying said secure enclave as an operand, and execution units record hardware threads currently accessing secure data in the enclave page cache corresponding to the secure enclave, and decrement the recorded number of hardware threads when any of the hardware threads exits the secure enclave.
    Type: Application
    Filed: August 29, 2016
    Publication date: December 22, 2016
    Inventors: CARLOS V. ROZAS, ILYA ALEXANDROVICH, ITTAI ANATI, ALEX BERENZON, MICHAEL A. GOLDSMITH, BARRY E. HUNTLEY, ANTON IVANOV, SIMON P. JOHNSON, REBEKAH M. LESLIE-HURD, FRANCIS X. MCKEEN, GILBERT NEIGER, RINAT RAPPOPORT, SCOTT D. RODGERS, UDAY R. SAVAGAONKAR, VINCENT R. SCARLATA, VEDVYAS SHANBHOGUE, WESLEY H. SMITH, WILLIAM C. WOOD
  • Publication number: 20160364338
    Abstract: A processor for supporting secure memory intent is disclosed. The processor of the disclosure includes a memory execution unit to access memory and a processor core coupled to the memory execution unit. The processor core is to receive a request to access a convertible page of the memory. In response to the request, the processor core to determine an intent for the convertible page in view of a page table entry (PTE) corresponding to the convertible page. The intent indicates whether the convertible page is to be accessed as at least one of a secure page or a non-secure page.
    Type: Application
    Filed: June 12, 2015
    Publication date: December 15, 2016
    Inventors: Krystof C. Zmudzinski, Siddhartha Chhabra, Uday R. Savagaonkar, Simon P. Johnson, Rebekah M. Leslie-Hurd, Francis X. McKeen, Gilbert Neiger, Raghunandan Makaram, Carlos V. Rozas, Amy L. Santoni, Vincent R. Scarlata, Vedvyas Shanbhogue, Ilya Alexandrovich, Ittai Anati, Wesley H. Smith, Michael Goldsmith
  • Patent number: 9519803
    Abstract: In accordance with some embodiments, a protected execution environment may be defined for a graphics processing unit. This framework not only protects the workloads from malware running on the graphics processing unit but also protects those workloads from malware running on the central processing unit. In addition, the trust framework may facilitate proof of secure execution by measuring the code and data structures used to execute the workload. If a part of the trusted computing base of this framework or protected execution environment is compromised, that part can be patched remotely and the patching can be proven remotely throughout attestation in some embodiments.
    Type: Grant
    Filed: November 30, 2012
    Date of Patent: December 13, 2016
    Assignee: Intel Corporation
    Inventors: Prashant Dewan, Uday R. Savagaonkar, David M. Durham, Paul S. Schmitz, Jason Martin, Michael Goldsmith, Ravi L. Sahita, Francis X. McKeen, Carlos Rozas, Balaji Vembu, Scott Janus, Geoffrey S. Strongin, Xiaozhu Kang, Karanvir S. Grewal, Siddhartha Chhabra, Alpha T. Narendra Trivedi
  • Publication number: 20160328335
    Abstract: Systems and methods for memory protection for implementing trusted execution environment. An example processing system comprises: an on-package memory; a memory encryption engine (MEE) comprising a MEE cache, the MEE to: responsive to failing to locate, within the MEE cache, an encryption metadata associated with a data item loaded from an external memory, retrieve at least part of the encryption metadata from the OPM, and validate the data item using the encryption metadata.
    Type: Application
    Filed: May 4, 2015
    Publication date: November 10, 2016
    Inventors: BINATA BHATTACHARYYA, AMY L. SANTONI, RAGHUNANDAN MAKARAM, FRANCIS X. MCKEEN, SIMON P. JOHNSON, GEORGE Z. CHRYSOS, SIDDHARTHA CHHABRA
  • Patent number: 9448950
    Abstract: Systems and methods for secure delivery of output surface bitmaps to a display engine. An example processing system comprises: an architecturally protected memory; and a plurality of processing devices communicatively coupled to the architecturally protected memory, each processing device comprising a first processing logic to implement an architecturally-protected execution environment by performing at least one of: executing instructions residing in the architecturally protected memory, or preventing an unauthorized access to the architecturally protected memory; wherein each processing device further comprises a second processing logic to establish a secure communication channel with a second processing device of the processing system, employ the secure communication channel to synchronize a platform identity key representing the processing system, and transmit a platform manifest comprising the platform identity key to a certification system.
    Type: Grant
    Filed: December 24, 2013
    Date of Patent: September 20, 2016
    Assignee: Intel Corporation
    Inventors: Vincent R. Scarlata, Simon P. Johnson, Vladimir Beker, Jesse Walker, Carlos V. Rozas, Amy L. Santoni, Ittai Anati, Raghunandan Makaram, Francis X. McKeen, Uday R. Savagaonkar
  • Patent number: 9430384
    Abstract: Instructions and logic provide advanced paging capabilities for secure enclave page caches. Embodiments include multiple hardware threads or processing cores, a cache to store secure data for a shared page address allocated to a secure enclave accessible by the hardware threads. A decode stage decodes a first instruction specifying said shared page address as an operand, and execution units mark an entry corresponding to an enclave page cache mapping for the shared page address to block creation of a new translation for either of said first or second hardware threads to access the shared page. A second instruction is decoded for execution, the second instruction specifying said secure enclave as an operand, and execution units record hardware threads currently accessing secure data in the enclave page cache corresponding to the secure enclave, and decrement the recorded number of hardware threads when any of the hardware threads exits the secure enclave.
    Type: Grant
    Filed: March 31, 2013
    Date of Patent: August 30, 2016
    Assignee: Intel Corporation
    Inventors: Carlos V Rozas, Ilya Alexandrovich, Ittai Anati, Alex Berenzon, Michael A Goldsmith, Barry E Huntley, Anton Ivanov, Simon P Johnson, Rebekah M. Leslie-Hurd, Francis X. McKeen, Gilbert Neiger, Rinat Rappoport, Scott Dion Rodgers, Uday R. Savagaonkar, Vincent R. Scarlata, Vedvyas Shanbhogue, Wesley H Smith, William Colin Wood
  • Publication number: 20160203340
    Abstract: An apparatus and method for securely suspending and resuming the state of a processor. For example, one embodiment of a method comprises: generating a data structure including at least the monotonic counter value; generating a message authentication code (MAC) over the data structure using a first key; securely providing the data structure and the MAC to a module executed on the processor; the module verifying the MAC, comparing the monotonic counter value with a counter value stored during a previous suspend operation and, if the counter values match, then loading processor state required for the resume operation to complete. Another embodiment of a method comprises: generating a first key by a processor; securely sharing the first key with an off-processor component; and using the first key to generate a pairing ID usable to identify a pairing between the processor and the off-processor component.
    Type: Application
    Filed: March 24, 2016
    Publication date: July 14, 2016
    Inventors: VINCENT R. SCARLATA, SIMON P. JOHNSON, CARLOS V. ROZAS, FRANCIS X. MCKEEN, ITTAI ANATII, ILYA ALEXANDROVICH, REBEKAH M. LESLIE-HURD
  • Publication number: 20160202976
    Abstract: Embodiments of an invention for memory management in secure enclaves are disclosed. In one embodiment, a processor includes an instruction unit and an execution unit. The instruction unit is to receive a first instruction and a second instruction. The execution unit is to execute the first instruction, wherein execution of the first instruction includes allocating a page in an enclave page cache to a secure enclave. The execution unit is also to execute the second instruction, wherein execution of the second instruction includes confirming the allocation of the page.
    Type: Application
    Filed: March 18, 2016
    Publication date: July 14, 2016
    Applicant: Intel Corporation
    Inventors: Rebekah Leslie-Hurd, Carlos V. Rozas, Vincent R. Scarlata, Simon P. Johnson, Uday R. Savagaonkar, Barry E. Huntley, Vedvyas Shanbhogue, Ittai Anati, Francis X. Mckeen, Michael A. Goldsmith, Ilya Alexandrovich, Alex Berenzon, Wesley H. Smith, Gilbert Neiger
  • Publication number: 20160117265
    Abstract: Embodiments of an invention for maintaining a secure processing environment across power cycles are disclosed. In one embodiment, a processor includes an instruction unit and an execution unit. The instruction unit is to receive an instruction to evict a root version array page entry from a secure cache. The execution unit is to execute the instruction. Execution of the instruction includes generating a blob to contain information to maintain a secure processing environment across a power cycle and storing the blob in a non-volatile memory.
    Type: Application
    Filed: October 28, 2014
    Publication date: April 28, 2016
    Inventors: Francis X. MCKEEN, Vincent Scarlata, Carlos Rozas, Ittai Anati, Vedvyas Shanbhogue
  • Patent number: 9323686
    Abstract: Embodiments of an invention for paging in secure enclaves are disclosed. In one embodiment, a processor includes an instruction unit and an execution unit. The instruction unit is to receive a first instruction. The execution unit is to execute the first instruction, wherein execution of the first instruction includes evicting a first page from an enclave page cache.
    Type: Grant
    Filed: December 28, 2012
    Date of Patent: April 26, 2016
    Assignee: Intel Corporation
    Inventors: Francis X. Mckeen, Michael A. Goldsmith, Barry E. Huntley, Simon P. Johnson, Rebekah Leslie, Carlos V. Rozas, Uday R. Savagaonkar, Vincent R. Scarlata, Vedvyas Shanbhogue, Wesley H. Smith, Ittai Anati, Ilya Alexandrovich, Alex Berenzon, Gilbert Neiger
  • Publication number: 20160085695
    Abstract: Secure memory allocation technologies are described. A processor includes a processor core and a memory controller that is coupled between the processor core and main memory. The main memory comprises a protected region including secured pages. The processor, in response to a content copy instruction, is to initialize a target page in the protected region of an application address space. The processor, in response to the content copy instruction, is also to select content of a source page in the protected region to be copied. The processor, in response to the content copy instruction, is also to copy the selected content to the target page in the protected region of the application address space.
    Type: Application
    Filed: September 24, 2014
    Publication date: March 24, 2016
    Inventors: REBEKAH M. LESLIE-HURD, FRANCIS X. MCKEEN, CARLOS V. ROZAS, KRYSTOF C. ZMUDZINSKI
  • Publication number: 20160042184
    Abstract: Embodiments of an invention for logging in secure enclaves are disclosed. In one embodiment, a processor includes an instruction unit and an execution unit. The instruction unit is to receive an instruction having an associated enclave page cache address. The execution unit is to execute the instruction without causing a virtual machine exit, wherein execution of the instruction includes logging the instruction and the associated enclave page cache address.
    Type: Application
    Filed: October 21, 2015
    Publication date: February 11, 2016
    Applicant: Intel Corporation
    Inventors: Francis X. Mckeen, Michael A. Goldsmith, Barrey E. Huntley, Simon P. Johnson, Rebekah M. Leslie-Hurd, Carlos V. Rozas, Uday R. Savagaonkar, Vincent R. Scarlata, Vedvyas Shanbhogue, Wesley H. Smith, Gilbert Neiger
  • Publication number: 20150378941
    Abstract: Instructions and logic interrupt and resume paging in secure enclaves. Embodiments include instructions, specify page addresses allocated to a secure enclave, the instructions are decoded for execution by a processor. The processor includes an enclave page cache to store secure data in a first cache line and in a last cache line for a page corresponding to the page address. A page state is read from the first or last cache line for the page when an entry in an enclave page cache mapping for the page indicates only a partial page is stored in the enclave page cache. The entry for a partial page may be set, and a new page state may be recorded in the first cache line when writing-back, or in the last cache line when loading the page when the instruction's execution is being interrupted. Thus the writing-back, or loading can be resumed.
    Type: Application
    Filed: June 27, 2014
    Publication date: December 31, 2015
    Inventors: Carlos V. Rozas, Ilya Alexandrovich, Gilbert Neiger, Francis X. McKeen, Ittai Anati, Vedvyas Shanbhogue, Shay Gueron
  • Patent number: 9189411
    Abstract: Embodiments of an invention for logging in secure enclaves are disclosed. In one embodiment, a processor includes an instruction unit and an execution unit. The instruction unit is to receive an instruction having an associated enclave page cache address. The execution unit is to execute the instruction without causing a virtual machine exit, wherein execution of the instruction includes logging the instruction and the associated enclave page cache address.
    Type: Grant
    Filed: December 28, 2012
    Date of Patent: November 17, 2015
    Assignee: Intel Corporation
    Inventors: Francis X. Mckeen, Michael A. Goldsmith, Barrey E. Huntley, Simon P. Johnson, Rebekah Leslie, Carlos V. Rozas, Uday R. Savagaonkar, Vincent R. Scarlata, Vedvyas Shanbhogue, Wesley H. Smith
  • Patent number: 9183161
    Abstract: An apparatus and method for managing a protection table by a processor. For example, a processor according to one embodiment of the invention comprises: protection table management logic to manage a protection table, the protection table having an entry for each protected page or each group of protected pages in memory; wherein the protection table management logic prevents direct access to the protection table by user application program code and operating system program code but permits direct access by the processor.
    Type: Grant
    Filed: December 28, 2012
    Date of Patent: November 10, 2015
    Assignee: INTEL CORPORATION
    Inventors: Gur Hildesheim, Ittai Anati, Hisham Shafi, Shlomo Raikin, Gideon Gerzon, Uday R Savagaonkar, Carlos V Rozas, Francis X McKeen, Michael A Goldsmith, Dewan Prashant
  • Patent number: 9087200
    Abstract: A technique to enable secure application and data integrity within a computer system. In one embodiment, one or more secure enclaves are established in which an application and data may be stored and executed.
    Type: Grant
    Filed: June 19, 2012
    Date of Patent: July 21, 2015
    Assignee: Intel Corporation
    Inventors: Francis X. McKeen, Carlos V. Rozas, Uday R. Savagaonkar, Simon P. Johnson, Vincent Scarlata, Michael A. Goldsmith, Ernie Brickell, Jiang Tao Li, Howard C. Herbert, Prashant Dewan, Stephen J. Tolopka, Gilbert Neiger, David Durham, Gary Graunke, Bernard Lint, Don A. Van Dyke, Joseph Cihula, Stalinselvaraj Jeyasingh, Stephen R. Van Doren, Dion Rodgers, John Garney, Asher Altman
  • Patent number: 9076019
    Abstract: A method and apparatus to provide cryptographic integrity checks and replay protection to protect against hardware attacks on system memory is provided. A mode of operation for block ciphers enhances the standard XTS-AES mode of operation to perform memory encryption by extending a tweak to include a “time stamp” indicator. A tree-based replay protection scheme uses standard XTS-AES to encrypt contents of a cache line in the system memory. A Message-Authentication Code (MAC) for the cache line is encrypted using enhanced XTS-AES and a “time stamp” indicator associated with the cache line. The “time stamp indicator” is stored in a processor.
    Type: Grant
    Filed: June 29, 2011
    Date of Patent: July 7, 2015
    Assignee: Intel Corporation
    Inventors: Shay Gueron, Uday Savagaonkar, Francis X. McKeen, Carlos V. Rozas, David M. Durham, Jacob Doweck, Ofir Mulla, Ittai Anati, Zvika Greenfield, Moshe Maor
  • Publication number: 20150178226
    Abstract: Systems and methods for secure delivery of output surface bitmaps to a display engine. An example processing system comprises: an architecturally protected memory; and a plurality of processing devices communicatively coupled to the architecturally protected memory, each processing device comprising a first processing logic to implement an architecturally-protected execution environment by performing at least one of: executing instructions residing in the architecturally protected memory, or preventing an unauthorized access to the architecturally protected memory; wherein each processing device further comprises a second processing logic to establish a secure communication channel with a second processing device of the processing system, employ the secure communication channel to synchronize a platform identity key representing the processing system, and transmit a platform manifest comprising the platform identity key to a certification system.
    Type: Application
    Filed: December 24, 2013
    Publication date: June 25, 2015
    Inventors: Vincent R. Scarlata, Simon P. Johnson, Vladimir Beker, Jesse Walker, Carlos V. Rozas, Amy L. Santoni, Ittai Anati, Raghunandan Makaram, Francis X. McKeen, Uday R. Savagaonkar