Abstract: An apparatus and method for extending IO device security protocols to integrated processors. For example, an example processor package comprises: a plurality of cores to execute instructions; an interconnect fabric coupled to the plurality of cores; memory interface circuitry coupled to the interconnect fabric, the memory interface circuitry to couple the plurality of cores to one or more memories; a root complex comprising: security circuitry operable as a root of trust (ROT) and a bridge to the interconnect fabric, the security circuitry to establish secure communication with one or more Root Complex Integrated Endpoint (RCiEP) devices integral to the processor package; and a Security Protocol and Data Model (SPDM) engine of the security circuitry to provide RCiEP encryption and SPDM protocol services to establish secure communication channels with each RCiEP device.

Abstract: An apparatus of an aspect includes a cache coherency protocol controller to receive a first packet of a cache coherency protocol. The first packet is to have been transmitted from a device over a communication link. The first packet has one or more bits to indicate destination location where data from the device is to be routed. The apparatus also includes circuitry coupled with the cache coherency protocol controller to receive the first packet. The circuitry is to generate a second packet based on the first packet. The second packet is to indicate the destination location. The apparatus also includes a fabric coupled with the circuitry to receive the second packet. The fabric is to route the data to the destination location indicated by the second packet. In one aspect, the cache coherency protocol is a CXL.cache cache coherency protocol. Other apparatus, methods, and systems are also disclosed.

Abstract: Examples described herein relate to extending a first trust domain of a service to a service mesh interface executed in a network interface device and to at least one device coupled to the network interface device. In some examples, extending the first trust domain of the service to the service mesh interface executed in the network interface device and to the at least one device coupled to the network interface device includes causing execution of the service mesh interface in a second trust domain in the network interface device; providing a third trust domain for the at least one device, when connected to the network interface device; and extending the first trust domain into the second trust domain or the third trust domain.

Abstract: Various methods, systems, and use cases for securely managing, generating, and controlling access to keys in a service mesh are discussed herein. In various examples, key protection operations include service mesh signing key protection and service mesh communication key protection, for a secure transport session between services such as conducted with mutual transport layer security (mTLS). For instance, such key protection operations may be used to establish communications between the service host and another entity within the service mesh, in a secure transport session, based on use of a private key (secured using a confidential computing technology) in a secure enclave or other secure compute environment to sign one or more keys for the secure transport session.

Abstract: Various systems and methods for enabling derivation and distribution of an attestation manifest for a software update image are described. In an example, these systems and methods include orchestration functions and communications, providing functionality and components for a software update process which also provides verification and attestation among multiple devices and operators.

Abstract: Examples described herein relate to a chiplet comprising a circuitry to store a security policy, specific to the chiplet, and a second chiplet comprising a second circuitry to store a second security policy, specific to the second chiplet. In some examples, at least two of the multiple chiplets are from different chiplet manufacturers.

Abstract: Examples herein relate to an interface selectively providing access to a memory region for a work request from an entity by providing selective access to a physical address of the memory region and selective access to a cryptographic key for use by a memory controller to access the memory region. In some examples, providing selective access to a physical address conversion is based on one or more of: validation of a certificate received with the work request and an identifier of the entity being associated with a process with access to the memory region. Access to the memory region can be specified. A memory region can be a page or sub-page sized region. Different access rights can be associated with different sub-portions of the memory region, wherein the access rights comprise one or more of: create, read, update, delete, write, or notify.

Abstract: Various methods, systems, and use cases for securely managing, generating, and controlling access to keys in a service mesh are discussed herein. In various examples, key protection operations include service mesh signing key protection and service mesh communication key protection, for a secure transport session between services such as conducted with mutual transport layer security (mTLS). For instance, such key protection operations may be used to establish communications between the service host and another entity within the service mesh, in a secure transport session, based on use of a private key (secured using a confidential computing technology) in a secure enclave or other secure compute environment to sign one or more keys for the secure transport session.

Abstract: A network interface controller (NIC) to interact with virtual environments when they are within a trusted environment protected by a cryptography scheme. The NIC performs encryption of data in accordance with the cryptographic scheme of a target trusted environment prior to copying the data for access by the target trusted environment.

Abstract: Examples herein relate to an interface selectively providing access to a memory region for a work request from an entity by providing selective access to a physical address of the memory region and selective access to a cryptographic key for use by a memory controller to access the memory region. In some examples, providing selective access to a physical address conversion is based on one or more of: validation of a certificate received with the work request and an identifier of the entity being associated with a process with access to the memory region. Access to the memory region can be specified to be one or more of: create, read, update, delete, write, or notify. A memory region can be a page or sub-page sized region. Different access rights can be associated with different sub-portions of the memory region, wherein the access rights comprise one or more of: create, read, update, delete, write, or notify.

Abstract: Disclosed herein are embodiments related to security in cloudlet environments. In some embodiments, for example, a computing device (e.g., a cloudlet) may include: a trusted execution environment; a Basic Input/Output System (BIOS) to request a Key Encryption Key (KEK) from the trusted execution environment; and a Self-Encrypting Storage (SES) associated with the KEK; wherein the trusted execution environment is to verify the BIOS and provide the KEK to the BIOS subsequent to verification of the BIOS, and the BIOS is to provide the KEK to the SES to unlock the SES for access by the trusted execution environment.

Abstract: Technologies for providing secure utilization of tenant keys include a compute device. The compute device includes circuitry configured to obtain a tenant key. The circuitry is also configured to receive encrypted data associated with a tenant. The encrypted data defines an encrypted image that is executable by the compute device to perform a workload on behalf of the tenant in a virtualized environment. Further, the circuitry is configured to utilize the tenant key to decrypt the encrypted data and execute the workload without exposing the tenant key to a memory that is accessible to another workload associated with another tenant.

Abstract: Systems and techniques for intelligent data forwarding in edge networks are described herein. A request may be received from an edge user device for a service via a first endpoint. A time value may be calculated using a timestamp of the request. Motion characteristics may be determined for the edge user device using the time value. A response to the request may be transmitted to a second endpoint based on the motion characteristics.

Abstract: Various aspects of methods, systems, and use cases for multi-entity (e.g., multi-tenant) edge computing deployments are disclosed. Among other examples, various configurations and features enable the management of resources (e.g., controlling and orchestrating hardware, acceleration, network, processing resource usage), security (e.g., secure execution and communication, isolation, conflicts), and service management (e.g., orchestration, connectivity, workload coordination), in edge computing deployments, such as by a plurality of edge nodes of an edge computing environment configured for executing workloads from among multiple tenants.

Abstract: Technologies for providing secure utilization of tenant keys include a compute device. The compute device includes circuitry configured to obtain a tenant key. The circuitry is also configured to receive encrypted data associated with a tenant. The encrypted data defines an encrypted image that is executable by the compute device to perform a workload on behalf of the tenant in a virtualized environment. Further, the circuitry is configured to utilize the tenant key to decrypt the encrypted data and execute the workload without exposing the tenant key to a memory that is accessible to another workload associated with another tenant.

Abstract: Systems, apparatus, articles of manufacture, and methods are disclosed for confidential computing security management for a multi-chiplet, multi-accelerator system-in-package. An example multi-die System-In-Package (SiP) includes a first die including a circuit. Additionally, the example multi-die SiP includes a second die to authenticate the circuit to permit secure communication within the SiP.

Abstract: Systems, apparatus, articles of manufacture, and methods are disclosed for memory access for multi-chiplet system-in-package. Example instructions cause at least one circuit in a system-in-package (SiP) to reserve a region in a memory associated with the SiP for exclusive use by a first die of the SiP apart from a second die of the SiP. For example, the memory is for use by multiple, respective, dies of the SiP.

Abstract: Technologies for accelerated key caching in an edge hierarchy include multiple edge appliance devices organized in tiers. An edge appliance device receives a request for a key, such as a private key. The edge appliance device determines whether the key is included in a local key cache and, if not, requests the key from an edge appliance device included in an inner tier of the edge hierarchy. The edge appliance device may request the key from an edge appliance device included in a peer tier of the edge hierarchy. The edge appliance device may activate per-tenant accelerated logic to identify one or more keys in the key cache for eviction. The edge appliance device may activate per-tenant accelerated logic to identify one or more keys for pre-fetching. Those functions of the edge appliance device may be performed by an accelerator such as an FPGA. Other embodiments are described and claimed.

Abstract: Various systems and methods for enabling derivation and distribution of an attestation manifest for a software update image are described. In an example, these systems and methods include orchestration functions and communications, providing functionality and components for a software update process which also provides verification and attestation among multiple devices and operators.

Abstract: Technologies for providing secure utilization of tenant keys include a compute device. The compute device includes circuitry configured to obtain a tenant key. The circuitry is also configured to receive encrypted data associated with a tenant. The encrypted data defines an encrypted image that is executable by the compute device to perform a workload on behalf of the tenant in a virtualized environment. Further, the circuitry is configured to utilize the tenant key to decrypt the encrypted data and execute the workload without exposing the tenant key to a memory that is accessible to another workload associated with another tenant.