Patents by Inventor Geoffrey Ndu

Geoffrey Ndu has filed for patents to protect the following inventions. This listing includes patent applications that are pending as well as patents that have already been granted by the United States Patent and Trademark Office (USPTO).

  • Publication number: 20210342162
    Abstract: A method comprising: generating, with a device, a nonce; writing, with the device, the nonce to a memory location accessible to a kernel; initializing the kernel; in response to an end of initialization, measuring a specified kernel space to produce a first result; writing the first result to a register of a second device; writing a location and size of the specified kernel space to a buffer; measuring the buffer; writing a result of buffer measurement to a second register of the second device; requesting a quote from the second device, the quote to include the nonce, the contents of the register, and the contents of the second register; and passing the quote to the device.
    Type: Application
    Filed: July 12, 2021
    Publication date: November 4, 2021
    Inventors: Geoffrey NDU, Nigel EDWARDS
  • Patent number: 11138315
    Abstract: A system comprising an inner kernel of an operating system (OS) running at a higher privilege level than an outer kernel of the OS, the inner kernel to measure a data structure in a memory; a device including a measurement engine to measure the data structure in the memory, wherein the device operates independently of the OS; and a trusted execution environment including an application to compare measurements from the inner kernel and the measurement engine.
    Type: Grant
    Filed: January 17, 2018
    Date of Patent: October 5, 2021
    Assignee: Hewlett Packard Enterprise Development LP
    Inventors: Geoffrey Ndu, Ludovic Emmanuel Paul Noel Jacquin, Nigel Edwards
  • Patent number: 11119789
    Abstract: A method comprising: generating, with a device, a nonce; writing, with the device, the nonce to a memory location accessible to a kernel; initializing the kernel; in response to an end of initialization, measuring a specified kernel space to produce a first result; writing the first result to a register of a second device; writing a location and size of the specified kernel space to a buffer; measuring the buffer; writing a result of buffer measurement to a second register of the second device; requesting a quote from the second device, the quote to include the nonce, the contents of the register, and the contents of the second register; and passing the quote to the device.
    Type: Grant
    Filed: April 25, 2018
    Date of Patent: September 14, 2021
    Assignee: Hewlett Packard Enterprise Development LP
    Inventors: Geoffrey Ndu, Nigel Edwards
  • Publication number: 20210256118
    Abstract: Examples disclosed herein relate to integrity monitoring of a computing system using a kernel that can update its own code. Trust of state information is verified. Kernel code and module code are loaded into memory that is accessible to a device separate from a processor that loads the kernel code and module code. A measurement module is verified and loaded into memory. The state information can correspond to multiple symbols. The measurement module can measure the state information corresponding to each of the respective symbols to generate a set of initial measurements. The set of initial measurements can be provided to a device for integrity monitoring. The device is to compare a current measurement with an initial measurement to determine if a potential violation occurred. The device is to use a representation of a jump table to determine whether the potential violation is a violation.
    Type: Application
    Filed: April 16, 2021
    Publication date: August 19, 2021
    Inventors: Geoffrey NDU, Theofrastos KOULOURIS, Nigel EDWARDS
  • Publication number: 20210232510
    Abstract: In some examples, a control device includes a controller to receive, from a requester device that is separate from the control device, a request to access a first memory region of a memory. The controller is to determine, based on occurrence of a systems initialization event and according to permissions information that identifies access permissions for respective memory regions of the memory, whether access of content in the first memory region is allowed.
    Type: Application
    Filed: January 28, 2020
    Publication date: July 29, 2021
    Inventors: Geoffrey Ndu, Ludovic Emmanuel Paul Noel Jacquin
  • Patent number: 11017080
    Abstract: Examples disclosed herein relate to integrity monitoring of a computing system using a kernel that can update its own code. Trust of state information is verified. Kernel code and module code are loaded into memory that is accessible to a device separate from a processor that loads the kernel code and module code. A measurement module is verified and loaded into memory. The state information can correspond to multiple symbols. The measurement module can measure the state information corresponding to each of the respective symbols to generate a set of initial measurements. The set of initial measurements can be provided to a device for integrity monitoring. The device is to compare a current measurement with an initial measurement to determine if a potential violation occurred. The device is to use a representation of a jump table to determine whether the potential violation is a violation.
    Type: Grant
    Filed: June 13, 2018
    Date of Patent: May 25, 2021
    Assignee: Hewlett Packard Enterprise Development LP
    Inventors: Geoffrey Ndu, Theofrastos Koulouris, Nigel Edwards
  • Publication number: 20210026948
    Abstract: In some examples, a system executes a monitor separate from an operating system (OS) that uses mapping information in accessing data in a physical memory. The monitor identifies, using the mapping information, invariant information, that comprises program code, of the OS without suspending execution of the OS, the identifying comprising the monitor accessing the physical memory independently of the OS. The monitor determines, based on monitoring the invariant information of the OS, whether a security issue is present.
    Type: Application
    Filed: July 26, 2019
    Publication date: January 28, 2021
    Inventors: Geoffrey Ndu, Nigel Edwards
  • Patent number: 10896267
    Abstract: Examples relate to Input/Output (I/O) data encryption and decryption. In an example, an encryption/decryption engine on an Integrated Circuit (IC) of a computing device obtains at least one plaintext data. Some examples determine, by the encryption/decryption engine, whether the at least one plaintext data is to be sent to a memory in the computing device or to an I/O device. Some examples apply, when the at least one plaintext data is to be sent to the I/O device and by the encryption/decryption engine, an encryption primitive of a block cipher encryption algorithm to the at least one plaintext data to create output encrypted data, wherein an initialization vector that comprises a random number is applied to the encryption primitive.
    Type: Grant
    Filed: January 31, 2017
    Date of Patent: January 19, 2021
    Assignee: Hewlett Packard Enterprise Development LP
    Inventors: Geoffrey Ndu, Pratyusa K Manadhata, Christopher L. Dalton, Adrian Shaw, Stuart Haber
  • Patent number: 10740125
    Abstract: An example system includes at least one memristive dot product engine (DPE) having at least one resource, the DPE further having a physical interface and a controller, the controller being communicatively coupled to the physical interface, the physical interface to communicate with the controller to access the DPE, and at least one replicated interface, each replicated interface being associated with a virtual DPE, the replicated interface with communicatively coupled to the controller. The controller is to allocate timeslots to the virtual DPE through the associated replicated interface to allow the virtual DPE access to the at least one resource.
    Type: Grant
    Filed: January 30, 2018
    Date of Patent: August 11, 2020
    Assignee: Hewlett Packard Enterprise Development LP
    Inventors: Geoffrey Ndu, Dejan Milojicic, Sai Rahul Chalamalasetti
  • Patent number: 10726132
    Abstract: A method comprising: launching, by a pre-boot environment, a pre-boot launch enclave (LE); creating, by the pre-boot LE, a launch token for a pre-boot quoting enclave (QE); authenticating, by the pre-boot LE, the launch token; launching, by the pre-boot environment with the launch token in response to the authentication, the pre-boot QE; generating, by the pre-boot QE, a public provisioning key, a private provisioning key, and an attestation key; verifying, by the pre-boot QE with a public key, authenticity of a device; securing, by the pre-boot QE with the public provisioning key, private provisioning key, and the public key, a communication channel with the device; encrypting, by the pre-boot QE with a system specific seal key, the public provisioning key, the private provisioning key, and the attestation key; and storing, by the pre-boot QE, the encrypted public provisioning key, the encrypted private provisioning key, and the encrypted attestation key in the device.
    Type: Grant
    Filed: March 8, 2018
    Date of Patent: July 28, 2020
    Assignee: HEWLETT PACKARD ENTERPRISE DEVELOPMENT LP
    Inventors: Geoffrey Ndu, Ludovic Emmanuel Paul Noel Jacquin, Nigel Edwards
  • Patent number: 10592437
    Abstract: Memory blocks are associated with each memory level of a hierarchy of memory levels. Each memory block has a matching key capability (MaKC). The MaKC of a memory block governs access to the memory block, in accordance with permissions specified by the MaKC. The MaKC of a memory block can uniquely identify the memory block across the hierarchy of memory levels, and can be globally unique across the memory blocks. An MaKC of a memory block includes a block protection key (BPK) stored with the memory block, and an execution protection key (EPK). If a provided EPK for a memory block matches the memory block's BPK upon comparison, access to the memory block is allowed according to the permissions specified by the MaKC.
    Type: Grant
    Filed: July 31, 2017
    Date of Patent: March 17, 2020
    Assignee: Hewlett Packard Enterprise Development LP
    Inventors: Geoffrey Ndu, Dejan S. Milojicic, Paolo Faraboschi, Chris I. Dalton
  • Publication number: 20190384909
    Abstract: Examples disclosed herein relate to integrity monitoring of a computing system using a kernel that can update its own code. Trust of state information is verified. Kernel code and module code are loaded into memory that is accessible to a device separate from a processor that loads the kernel code and module code. A measurement module is verified and loaded into memory. The state information can correspond to multiple symbols. The measurement module can measure the state information corresponding to each of the respective symbols to generate a set of initial measurements. The set of initial measurements can be provided to a device for integrity monitoring. The device is to compare a current measurement with an initial measurement to determine if a potential violation occurred. The device is to use a representation of a jump table to determine whether the potential violation is a violation.
    Type: Application
    Filed: June 13, 2018
    Publication date: December 19, 2019
    Inventors: Geoffrey Ndu, Theofrastos Koulouris, Nigel Edwards
  • Publication number: 20190384918
    Abstract: Examples disclosed herein relate to integrity monitoring of a computing system. Trust of state information is verified. Kernel code and module code are loaded into memory that is accessible to a device separate from a processor that loads the kernel code and module code. A measurement module is verified and loaded into memory. The state information can correspond to multiple symbols. The measurement module can measure the state information corresponding to each of the respective symbols to generate a set of initial measurements. The set of initial measurements can be provided to a device for integrity monitoring.
    Type: Application
    Filed: June 13, 2018
    Publication date: December 19, 2019
    Inventors: Geoffrey Ndu, David Altobelli, Nigel Edwards, Luis Luciani, JR.
  • Publication number: 20190332391
    Abstract: A method comprising: generating, with a device, a nonce; writing, with the device, the nonce to a memory location accessible to a kernel; initializing the kernel; in response to an end of initialization, measuring a specified kernel space to produce a first result; writing the first result to a register of a second device; writing a location and size of the specified kernel space to a buffer; measuring the buffer; writing a result of buffer measurement to a second register of the second device; requesting a quote from the second device, the quote to include the nonce, the contents of the register, and the contents of the second register; and passing the quote to the device.
    Type: Application
    Filed: April 25, 2018
    Publication date: October 31, 2019
    Inventors: Geoffrey Ndu, Nigel Edwards
  • Publication number: 20190278913
    Abstract: A method comprising: launching, by a pre-boot environment, a pre-boot launch enclave (LE); creating, by the pre-boot LE, a launch token for a pre-boot quoting enclave (QE); authenticating, by the pre-boot LE, the launch token; launching, by the pre-boot environment with the launch token in response to the authentication, the pre-boot QE; generating, by the pre-boot QE, a public provisioning key, a private provisioning key, and an attestation key; verifying, by the pre-boot QE with a public key, authenticity of a device; securing, by the pre-boot QE with the public provisioning key, private provisioning key, and the public key, a communication channel with the device; encrypting, by the pre-boot QE with a system specific seal key, the public provisioning key, the private provisioning key, and the attestation key; and storing, by the pre-boot QE, the encrypted public provisioning key, the encrypted private provisioning key, and the encrypted attestation key in the device.
    Type: Application
    Filed: March 8, 2018
    Publication date: September 12, 2019
    Inventors: Geoffrey Ndu, Ludovic Emmanuel Paul Noel Jacquin, Nigel Edwards
  • Publication number: 20190235889
    Abstract: An example system includes at least one memristive dot product engine (DPE) having at least one resource, the DPE further having a physical interface and a controller, the controller being communicatively coupled to the physical interface, the physical interface to communicate with the controller to access the DPE, and at least one replicated interface, each replicated interface being associated with a virtual DPE, the replicated interface with communicatively coupled to the controller. The controller is to allocate timeslots to the virtual DPE through the associated replicated interface to allow the virtual DPE access to the at least one resource.
    Type: Application
    Filed: January 30, 2018
    Publication date: August 1, 2019
    Inventors: Geoffrey NDU, Dejan MILOJICIC, Sai Rahul CHALAMALASETTI
  • Publication number: 20190220599
    Abstract: A system comprising an inner kernel of an operating system (OS) running at a higher privilege level than an outer kernel of the OS, the inner kernel to measure a data structure in a memory; a device including a measurement engine to measure the data structure in the memory, wherein the device operates independently of the OS; and a trusted execution environment including an application to compare measurements from the inner kernel and the measurement engine.
    Type: Application
    Filed: January 17, 2018
    Publication date: July 18, 2019
    Inventors: Geoffrey Ndu, Ludovic Emmanuel Paul Noel Jacquin, Nigel Edwards
  • Patent number: 10310990
    Abstract: In one example in accordance with the present disclosure, a method may include retrieving, at a memory management unit (MMU), encrypted data from a memory via direct memory access and determining, at the MMU, a peripheral that is the intended recipient of the encrypted data. The method may also include accessing an application key used for transmission between an application and the peripheral, wherein the application key originates from the application and decrypting, at the MMU, the encrypted data using the application key and transmitting the decrypted data to the peripheral.
    Type: Grant
    Filed: June 24, 2016
    Date of Patent: June 4, 2019
    Assignee: HEWLETT PACKARD ENTERPRISE DEVELOPMENT LP
    Inventors: Adrian Shaw, Geoffrey Ndu, Fraser John Dickin
  • Patent number: 10261919
    Abstract: In one example in accordance with the present disclosure, a method may include receiving, by a processor on a system on a chip (SoC), a request to encrypt a subset of data accessed by a process. The method may also include receiving, at a page encryption hardware unit of the SoC, a system call from an operating system on behalf of the process, to generate an encrypted memory page corresponding to the subset of data. The method may also include generating, by the page encryption hardware unit, an encryption/decryption key for the first physical memory address. The encryption/decryption key may not be accessible by the operating system. The method may also include encrypting, by the page encryption hardware unit, the subset of data to the physical memory address using the encryption/decryption key and storing, by the page encryption hardware unit, the encryption/decryption key in a key store.
    Type: Grant
    Filed: July 8, 2016
    Date of Patent: April 16, 2019
    Assignee: HEWLETT PACKARD ENTERPRISE DEVELOPMENT LP
    Inventors: Geoffrey Ndu, Fraser John Dickin
  • Patent number: 10248814
    Abstract: In one example in accordance with the present disclosure, a system comprises a first memory module and a first memory integrity monitoring processor, embedded to the first memory module, to receive a second hash corresponding to a second memory module. The second hash includes a second sequence number for reconstruction of a final hash value and the second hash is not sequentially a first number in a sequence for reconstruction of the final hash value. The first processor may receive a third hash corresponding to a third memory module. The third hash includes a third sequence number for reconstruction of the final hash value and the third hash is received after the second hash. The first processor may determine if the second hash can be combined with the third hash, combine the second hash and third hash into a partial hash reconstruct the final hash value using the partial hash.
    Type: Grant
    Filed: January 25, 2017
    Date of Patent: April 2, 2019
    Assignee: HEWLETT PACKARD ENTERPRISE DEVELOPMENT LP
    Inventors: Geoffrey Ndu, Adrian Shaw, Brian Quentin Monahan