Patents by Inventor Joseph F. Cihula
Joseph F. Cihula has filed for patents to protect the following inventions. This listing includes patent applications that are pending as well as patents that have already been granted by the United States Patent and Trademark Office (USPTO).
-
Patent number: 11436161Abstract: This disclosure is directed to a system for address mapping and translation protection. In one embodiment, processing circuitry may include a virtual machine manager (VMM) to control specific guest linear address (GLA) translations. Control may be implemented in a performance sensitive and secure manner, and may be capable of improving performance for critical linear address page walks over legacy operation by removing some or all of the cost of page walking extended page tables (EPTs) for critical mappings. Alone or in combination with the above, certain portions of a page table structure may be selectively made immutable by a VMM or early boot process using a sub-page policy (SPP). For example, SPP may enable non-volatile kernel and/or user space code and data virtual-to-physical memory mappings to be made immutable (e.g., non-writable) while allowing for modifications to non-protected portions of the OS paging structures and particularly the user space.Type: GrantFiled: November 18, 2019Date of Patent: September 6, 2022Assignee: Intel CorporationInventors: Ravi L. Sahita, Gilbert Neiger, Vedvyas Shanbhogue, David M. Durham, Andrew V. Anderson, David A. Koufaty, Asit K. Mallick, Arumugam Thiyagarajah, Barry E. Huntley, Deepak K. Gupta, Michael Lemay, Joseph F. Cihula, Baiju V. Patel
-
Publication number: 20220027287Abstract: This disclosure is directed to a system for address mapping and translation protection. In one embodiment, processing circuitry may include a virtual machine manager (VMM) to control specific guest linear address (GLA) translations. Control may be implemented in a performance sensitive and secure manner, and may be capable of improving performance for critical linear address page walks over legacy operation by removing some or all of the cost of page walking extended page tables (EPTs) for critical mappings. Alone or in combination with the above, certain portions of a page table structure may be selectively made immutable by a VMM or early boot process using a sub-page policy (SPP). For example, SPP may enable non-volatile kernel and/or user space code and data virtual-to-physical memory mappings to be made immutable (e.g., non-writable) while allowing for modifications to non-protected portions of the OS paging structures and particularly the user space.Type: ApplicationFiled: October 7, 2021Publication date: January 27, 2022Applicant: Intel CorporationInventors: Ravi L. SAHITA, Gilbert NEIGER, Vedvyas SHANBHOGUE, David M. DURHAM, Andrew V. ANDERSON, David A. KOUFATY, Asit K. MALLICK, Arumugam THIYAGARAJAH, Barry E. HUNTLEY, Deepak K. GUPTA, Michael LEMAY, Joseph F. CIHULA, Baiju V. PATEL
-
Patent number: 11144479Abstract: This disclosure is directed to a system for address mapping and translation protection. In one embodiment, processing circuitry may include a virtual machine manager (VMM) to control specific guest linear address (GLA) translations. Control may be implemented in a performance sensitive and secure manner, and may be capable of improving performance for critical linear address page walks over legacy operation by removing some or all of the cost of page walking extended page tables (EPTs) for critical mappings. Alone or in combination with the above, certain portions of a page table structure may be selectively made immutable by a VMM or early boot process using a sub-page policy (SPP). For example, SPP may enable non-volatile kernel and/or user space code and data virtual-to-physical memory mappings to be made immutable (e.g., non-writable) while allowing for modifications to non-protected portions of the OS paging structures and particularly the user space.Type: GrantFiled: November 18, 2019Date of Patent: October 12, 2021Assignee: Intel CorporationInventors: Ravi L. Sahita, Gilbert Neiger, Vedvyas Shanbhogue, David M. Durham, Andrew V. Anderson, David A. Koufaty, Asit K. Mallick, Arumugam Thiyagarajah, Barry E. Huntley, Deepak K. Gupta, Michael Lemay, Joseph F. Cihula, Baiju V. Patel
-
Patent number: 11010310Abstract: Apparatus, systems, computer readable storage mediums and/or methods may provide memory integrity by using unused physical address bits (or other metadata passed through cache) to manipulate cryptographic memory integrity values, allowing software memory allocation routines to control the assignment of pointers (e.g., implement one or more access control policies). Unused address bits (e.g., because of insufficient external memory) passed through cache, may encode key domain information in the address so that different key domain addresses alias to the same physical memory location. Accordingly, by mixing virtual memory mappings and cache line granularity aliasing, any page in memory may contain a different set of aliases at the cache line level and be non-deterministic to an adversary.Type: GrantFiled: January 30, 2020Date of Patent: May 18, 2021Assignee: Intel CorporationInventors: David M. Durham, Siddhartha Chhabra, Michael E. Kounavis, Sergej Deutsch, Karanvir S. Grewal, Joseph F. Cihula, Saeedeh Komijani
-
Publication number: 20200278937Abstract: Apparatus, systems, computer readable storage mediums and/or methods may provide memory integrity by using unused physical address bits (or other metadata passed through cache) to manipulate cryptographic memory integrity values, allowing software memory allocation routines to control the assignment of pointers (e.g., implement one or more access control policies). Unused address bits (e.g., because of insufficient external memory) passed through cache, may encode key domain information in the address so that different key domain addresses alias to the same physical memory location. Accordingly, by mixing virtual memory mappings and cache line granularity aliasing, any page in memory may contain a different set of aliases at the cache line level and be non-deterministic to an adversary.Type: ApplicationFiled: January 30, 2020Publication date: September 3, 2020Applicant: Intel CorporationInventors: David M. Durham, Siddhartha Chhabra, Michael E. Kounavis, Sergej Deutsch, Karanvir S. Grewal, Joseph F. Cihula, Saeedeh Komijani
-
Publication number: 20200159673Abstract: This disclosure is directed to a system for address mapping and translation protection. In one embodiment, processing circuitry may include a virtual machine manager (VMM) to control specific guest linear address (GLA) translations. Control may be implemented in a performance sensitive and secure manner, and may be capable of improving performance for critical linear address page walks over legacy operation by removing some or all of the cost of page walking extended page tables (EPTs) for critical mappings. Alone or in combination with the above, certain portions of a page table structure may be selectively made immutable by a VMM or early boot process using a sub-page policy (SPP). For example, SPP may enable non-volatile kernel and/or user space code and data virtual-to-physical memory mappings to be made immutable (e.g., non-writable) while allowing for modifications to non-protected portions of the OS paging structures and particularly the user space.Type: ApplicationFiled: November 18, 2019Publication date: May 21, 2020Applicant: Intel CorporationInventors: RAVI L. SAHITA, GILBERT NEIGER, VEDVYAS SHANBHOGUE, DAVID M. DURHAM, ANDREW V. ANDERSON, DAVID A. KOUFATY, ASIT K. MALLICK, ARUMUGAM THIYAGARAJAH, BARRY E. HUNTLEY, DEEPAK K. GUPTA, MICHAEL LEMAY, JOSEPH F. CIHULA, BAIJU V. PATEL
-
Patent number: 10585809Abstract: Apparatus, systems, computer readable storage mediums and/or methods may provide memory integrity by using unused physical address bits (or other metadata passed through cache) to manipulate cryptographic memory integrity values, allowing software memory allocation routines to control the assignment of pointers (e.g., implement one or more access control policies). Unused address bits (e.g., because of insufficient external memory) passed through cache, may encode key domain information in the address so that different key domain addresses alias to the same physical memory location. Accordingly, by mixing virtual memory mappings and cache line granularity aliasing, any page in memory may contain a different set of aliases at the cache line level and be non-deterministic to an adversary.Type: GrantFiled: April 1, 2016Date of Patent: March 10, 2020Assignee: Intel CorporationInventors: David M. Durham, Siddhartha Chhabra, Michael E. Kounavis, Sergej Deutsch, Karanvir S. Grewal, Joseph F. Cihula, Saeedeh Komijani
-
Patent number: 10515023Abstract: This disclosure is directed to a system for address mapping and translation protection. In one embodiment, processing circuitry may include a virtual machine manager (VMM) to control specific guest linear address (GLA) translations. Control may be implemented in a performance sensitive and secure manner, and may be capable of improving performance for critical linear address page walks over legacy operation by removing some or all of the cost of page walking extended page tables (EPTs) for critical mappings. Alone or in combination with the above, certain portions of a page table structure may be selectively made immutable by a VMM or early boot process using a sub-page policy (SPP). For example, SPP may enable non-volatile kernel and/or user space code and data virtual-to-physical memory mappings to be made immutable (e.g., non-writable) while allowing for modifications to non-protected portions of the OS paging structures and particularly the user space.Type: GrantFiled: April 1, 2016Date of Patent: December 24, 2019Assignee: Intel CorporationInventors: Ravi L. Sahita, Gilbert Neiger, Vedvyas Shanbhogue, David M. Durham, Andrew V. Anderson, David A. Koufaty, Asit K. Mallick, Arumugam Thiyagarajah, Barry E. Huntley, Deepak K. Gupta, Michael Lemay, Joseph F. Cihula, Baiju V. Patel
-
Patent number: 10503664Abstract: This disclosure is directed to a system for address mapping and translation protection. In one embodiment, processing circuitry may include a virtual machine manager (VMM) to control specific guest linear address (GLA) translations. Control may be implemented in a performance sensitive and secure manner, and may be capable of improving performance for critical linear address page walks over legacy operation by removing some or all of the cost of page walking extended page tables (EPTs) for critical mappings. Alone or in combination with the above, certain portions of a page table structure may be selectively made immutable by a VMM or early boot process using a sub-page policy (SPP). For example, SPP may enable non-volatile kernel and/or user space code and data virtual-to-physical memory mappings to be made immutable (e.g., non-writable) while allowing for modifications to non-protected portions of the OS paging structures and particularly the user space.Type: GrantFiled: June 7, 2016Date of Patent: December 10, 2019Assignee: INTEL CORPORATIONInventors: David M. Durham, Ravi L. Sahita, Gilbert Neiger, Vedvyas Shanbhogue, Andrew V. Anderson, Michael Lemay, Joseph F. Cihula, Arumugam Thiyagarajah, Asit K. Mallick, Barry E. Huntley, David A. Koufaty, Deepak K. Gupta, Baiju V. Patel
-
Patent number: 10394595Abstract: A processor comprises a register to store a first reference to a context data structure specifying a virtual machine context, the context data structure comprising a second reference to a target array and an execution unit comprising a logic circuit to execute a virtual machine (VM) based on the virtual machine context, wherein the VM comprises a guest operating system (OS) associated with a page table comprising a first memory address mapping between a guest virtual address (GVA) space and a guest physical address (GPA) space, receive a request by the guest OS to switch from the first memory address mapping to a second memory address mapping, the request comprising an index value and a first root value, retrieve an entry, identified by the index value, from the target array, the entry comprising a second root value, and responsive to determining that the first root value matches the second root value, cause a switch from the first memory address mapping to the second memory address mapping.Type: GrantFiled: August 23, 2017Date of Patent: August 27, 2019Assignee: Intel CorporationInventors: Gilbert Neiger, Deepak K. Gupta, Ravi L. Sahita, Barry E. Huntley, Vedvyas Shanbhogue, Joseph F. Cihula
-
Publication number: 20190065226Abstract: A processor comprises a register to store a first reference to a context data structure specifying a virtual machine context, the context data structure comprising a second reference to a target array and an execution unit comprising a logic circuit to execute a virtual machine (VM) based on the virtual machine context, wherein the VM comprises a guest operating system (OS) associated with a page table comprising a first memory address mapping between a guest virtual address (GVA) space and a guest physical address (GPA) space, receive a request by the guest OS to switch from the first memory address mapping to a second memory address mapping, the request comprising an index value and a first root value, retrieve an entry, identified by the index value, from the target array, the entry comprising a second root value, and responsive to determining that the first root value matches the second root value, cause a switch from the first memory address mapping to the second memory address mapping.Type: ApplicationFiled: August 23, 2017Publication date: February 28, 2019Inventors: Gilbert Neiger, Deepak K. Gupta, Ravi L. Sahita, Barry E. Huntley, Vedvyas Shanbhogue, Joseph F. Cihula
-
Publication number: 20190035201Abstract: A method for managing a smart card system includes testing a smart card reader for trustworthiness. An indication of the trustworthiness is provided via a smart card.Type: ApplicationFiled: October 3, 2018Publication date: January 31, 2019Inventor: Joseph F. CIHULA
-
Patent number: 10109141Abstract: A method for managing a smart card system includes testing a smart card reader for trustworthiness. An indication of the trustworthiness is provided via a smart card.Type: GrantFiled: December 24, 2003Date of Patent: October 23, 2018Assignee: Intel CorporationInventor: Joseph F. Cihula
-
Patent number: 10089247Abstract: One embodiment provides an apparatus. The apparatus includes an input output memory management unit (I/O MMU), a non-secure operating system (OS) driver, a secure OS driver and a virtual machine monitor (VMM). The I/OMMU is to couple an I/O Controller to a memory. The I/O Controller is coupled to a secure device and a non-secure device and has one I/O Controller identifier. The non-secure OS driver is associated with the non-secure device. The secure OS driver is associated with the secure device. The VMM is to allocate a secure address space to a secure OS and a non-secure address space to a non-secure OS. The secure address space is non-overlapping with the non-secure address space.Type: GrantFiled: September 30, 2016Date of Patent: October 2, 2018Assignee: Intel CorporationInventors: Nitin V. Sarangdhar, Baiju V. Patel, Tin-Cheung Kung, Joseph F. Cihula, Prashant Sethi, Vinay Kumar Rangineni
-
Publication number: 20180095900Abstract: One embodiment provides an apparatus. The apparatus includes an input output memory management unit (I/O MMU), a non-secure operating system (OS) driver, a secure OS driver and a virtual machine monitor (VMM). The I/OMMU is to couple an I/O Controller to a memory. The I/O Controller is coupled to a secure device and a non-secure device and has one I/O Controller identifier. The non-secure OS driver is associated with the non-secure device. The secure OS driver is associated with the secure device. The VMM is to allocate a secure address space to a secure OS and a non-secure address space to a non-secure OS. The secure address space is non-overlapping with the non-secure address space.Type: ApplicationFiled: September 30, 2016Publication date: April 5, 2018Applicant: INTEL CORPORATIONInventors: Nitin V. Sarangdhar, Baiju V. Patel, Tin-Cheung Kung, Joseph F. Cihula, Prashant Sethi, Vinay Kumar Rangineni
-
Publication number: 20170285976Abstract: Apparatus, systems, computer readable storage mediums and/or methods may provide memory integrity by using unused physical address bits (or other metadata passed through cache) to manipulate cryptographic memory integrity values, allowing software memory allocation routines to control the assignment of pointers (e.g., implement one or more access control policies). Unused address bits (e.g., because of insufficient external memory) passed through cache, may encode key domain information in the address so that different key domain addresses alias to the same physical memory location. Accordingly, by mixing virtual memory mappings and cache line granularity aliasing, any page in memory may contain a different set of aliases at the cache line level and be non-deterministic to an adversary.Type: ApplicationFiled: April 1, 2016Publication date: October 5, 2017Inventors: David M. Durham, Siddhartha Chhabra, Michael E. Kounavis, Sergej Deutsch, Karanvir S. Grewal, Joseph F. Cihula, Saeedeh Komijani
-
Publication number: 20170249260Abstract: This disclosure is directed to a system for address mapping and translation protection. In one embodiment, processing circuitry may include a virtual machine manager (VMM) to control specific guest linear address (GLA) translations. Control may be implemented in a performance sensitive and secure manner, and may be capable of improving performance for critical linear address page walks over legacy operation by removing some or all of the cost of page walking extended page tables (EPTs) for critical mappings. Alone or in combination with the above, certain portions of a page table structure may be selectively made immutable by a VMM or early boot process using a sub-page policy (SPP). For example, SPP may enable non-volatile kernel and/or user space code and data virtual-to-physical memory mappings to be made immutable (e.g., non-writable) while allowing for modifications to non-protected portions of the OS paging structures and particularly the user space.Type: ApplicationFiled: April 1, 2016Publication date: August 31, 2017Inventors: RAVI L. SAHITA, GILBERT NEIGER, VEDVYAS SHANBHOGUE, DAVID M. DURHAM, ANDREW V. ANDERSON, DAVID A. KOUFATY, ASIT K. MALLICK, ARUMUGAM THIYAGARAJAH, BARRY E. HUNTLEY, DEEPAK K. GUPTA, MICHAEL LEMAY, JOSEPH F. CIHULA, BAIJU V. PATEL
-
Publication number: 20170249261Abstract: This disclosure is directed to a system for address mapping and translation protection. In one embodiment, processing circuitry may include a virtual machine manager (VMM) to control specific guest linear address (GLA) translations. Control may be implemented in a performance sensitive and secure manner, and may be capable of improving performance for critical linear address page walks over legacy operation by removing some or all of the cost of page walking extended page tables (EPTs) for critical mappings. Alone or in combination with the above, certain portions of a page table structure may be selectively made immutable by a VMM or early boot process using a sub-page policy (SPP). For example, SPP may enable non-volatile kernel and/or user space code and data virtual-to-physical memory mappings to be made immutable (e.g., non-writable) while allowing for modifications to non-protected portions of the OS paging structures and particularly the user space.Type: ApplicationFiled: June 7, 2016Publication date: August 31, 2017Applicant: Intel CorporationInventors: DAVID M. DURHAM, RAVI L. SAHITA, GILBERT NEIGER, VEDVYAS SHANBHOGUE, ANDREW V. ANDERSON, MICHAEL LEMAY, JOSEPH F. CIHULA, ARUMUGAM THIYAGARAJAH, ASIT K. MALLICK, BARRY E. HUNTLEY, DAVID A. KOUFATY, DEEPAK K. GUPTA, BAIJU V. PATEL
-
Patent number: 7908653Abstract: Improving security of a processing system may be accomplished by at least one of executing and accessing a suspect file in a sandbox virtual machine.Type: GrantFiled: June 29, 2004Date of Patent: March 15, 2011Assignee: Intel CorporationInventors: Ernie F. Brickell, Clifford D. Hall, Joseph F. Cihula, Richard Uhlig
-
Patent number: 7765544Abstract: A method, apparatus and system for improving security on a virtual machines host is described. A shared file system on the host may include annotations usable by a service module to access files across VMs and to enforce security policies. The service module may additionally enable a unified user interface to improve usability of the host.Type: GrantFiled: December 17, 2004Date of Patent: July 27, 2010Assignee: Intel CorporationInventors: Ernie F. Brickell, Clifford D. Hall, Joseph F. Cihula, Richard A. Uhlig