Abstract: Embodiments of the invention create an underlying infrastructure in a flash memory device (e.g., a serial peripheral interface (SPI) flash memory device) such that it may be protected against user attacks—e.g., replacing the SPI flash memory device or a man-in-the-middle (MITM) attack to modify the SPI flash memory contents on the fly. In the prior art, monotonic counters cannot be stored in SPI flash memory devices because said devices do not provide replay protection for the counters. A user may also remove the flash memory device and reprogram it. Host platforms alone cannot protect against such hardware attacks. Embodiments of the invention enable secure standard storage flash memory devices such as SPI flash memory devices to achieve replay protection for securely stored data. Embodiments of the invention utilize flash memory controllers, flash memory devices, unique device keys and HMAC key logic to create secure execution environments for various components.

Abstract: In one embodiment, a processor has at least one core to execute instructions, a security engine coupled to the at least one core, a first storage to store a first immutable key associated with a vendor of the processor, and a second storage to store a second immutable key associated with an original equipment manufacturer (OEM) of the system. A first portion of firmware is to be verified based at least in part on the first immutable key and a second portion of firmware is to be verified based at least in part on the second immutable key, the first portion of firmware associated with the vendor and the second portion of firmware associated with the OEM. Other embodiments are described and claimed.

Abstract: Provided are a system, memory controller, and method for using counters and a table to protect data in a storage device. Upon initiating operations to modify a file in the storage device, a storage write counter is incremented in response to initiating the operations to modify the file. In response to incrementing the storage write counter, write table operations are initiated including setting a table write counter to a storage write counter and setting a table commit counter to the storage commit counter plus a value. The operation to modify the file in response to completing the write table operations. The system commit counter is incremented by the value in response to completing the operation to modify the file.

Abstract: The present disclosure is generally related to embedding public key infrastructure information to a system-on-chip (SOC). The method includes generating a key pair including a public key and a private key. The method includes creating a digital certificate corresponding to the public key. The method includes signing the digital certificate with a unique signature. The method includes extracting the public key and the unique signature into a key file, wherein the key file is to be stored in a plurality of silicon fuses on the SOC.

Abstract: Technologies for secure offline activation of hardware features include a target computing device having a platform controller hub (PCH) including a converged security and manageability engine (CSME) and a number of in-field programmable fuses (IFPs). During assembly of the target computing device by an original equipment manufacturer (OEM), the CSME is provided a list of hardware features to be activated. The CSME configures the IFPs to enable the requested features, generates a digital receipt including the activated features and a unique device ID, and signs the receipt using a unique device key. Signed receipts may be periodically submitted to a vendor computing device, which verifies the signed receipts, extracts the active feature list, and bills the OEM for activated features of the PCHs. The vendor computing device may bill the OEM a maximum price for PCHs for which there is no associated signed receipt. Other embodiments are described and claimed.

Abstract: The present disclosure is generally related to embedding public key infrastructure information to a system-on-chip (SOC). The method includes generating a key pair including a public key and a private key. The method includes creating a digital certificate corresponding to the public key. The method includes signing the digital certificate with a unique signature. The method includes extracting the public key and the unique signature into a key file, wherein the key file is to be stored in a plurality of silicon fuses on the SOC.

Abstract: In some embodiments a secure permit request to change a hardware configuration is created. The secure permit request is sent to a remote location, and a permit sent from the remote location in response to the permit request is received. The hardware configuration is changed in response to the received permit. Other embodiments are described and claimed.

Abstract: Embodiments of the invention create an underlying infrastructure in a flash memory device (e.g., a serial peripheral interface (SPI) flash memory device) such that it may be protected against user attacks—e.g., replacing the SPI flash memory device or a man-in-the-middle (MITM) attack to modify the SPI flash memory contents on the fly. In the prior art, monotonic counters cannot be stored in SPI flash memory devices because said devices do not provide replay protection for the counters. A user may also remove the flash memory device and reprogram it. Host platforms alone cannot protect against such hardware attacks. Embodiments of the invention enable secure standard storage flash memory devices such as SPI flash memory devices to achieve replay protection for securely stored data. Embodiments of the invention utilize flash memory controllers, flash memory devices, unique device keys and HMAC key logic to create secure execution environments for various components.

Abstract: Embodiments of the invention create an underlying infrastructure in a flash memory device (e.g., a serial peripheral interface (SPI) flash memory device) such that it may be protected against user attacks—e.g., replacing the SPI flash memory device or a man-in-the-middle (MITM) attack to modify the SPI flash memory contents on the fly. In the prior art, monotonic counters cannot be stored in SPI flash memory devices because said devices do not provide replay protection for the counters. A user may also remove the flash memory device and reprogram it. Host platforms alone cannot protect against such hardware attacks. Embodiments of the invention enable secure standard storage flash memory devices such as SPI flash memory devices to achieve replay protection for securely stored data. Embodiments of the invention utilize flash memory controllers, flash memory devices, unique device keys and HMAC key logic to create secure execution environments for various components.

Abstract: Techniques for generating access information indicating a least recently used (LRU) memory region in a set of memory regions. In an embodiment, data is stored in an entry of an LRU tracking list (LTL) based on a touch message indicating when a memory group has been touched—e.g. read from, written to and/or associated with a memory region. The data stored in an LTL entry may include an identifier of a memory group and/or validity data specifying whether that LTL entry stores a set of default data. In another embodiment, access information may be generated based on the memory group identifier and the validity data.

Abstract: Techniques for generating access information indicating a least recently used (LRU) memory region in a set of memory regions. In an embodiment, data is stored in an entry of an LRU tracking list (LTL) based on a touch message indicating when a memory group has been touched—e.g. read from, written to and/or associated with a memory region. The data stored in an LTL entry may include an identifier of a memory group and/or validity data specifying whether that LTL entry stores a set of default data. In another embodiment, access information may be generated based on the memory group identifier and the validity data.

Abstract: A BIOS includes a core and multiple modules. The modules include both those that are platform specific and those that are not platform specific. Each module has a standard interface that allows the core (or other module) to call the module. A platform vendor constructs a BIOS by selecting modules from one or more vendors, which when executed can select modules that are suitable for the platform the BIOS resides in.

Abstract: In some embodiments a secure permit request to change a hardware configuration is created. The secure permit request is sent to a remote location, and a permit sent from the remote location in response to the permit request is received. The hardware configuration is changed in response to the received permit. Other embodiments are described and claimed.

Abstract: A BIOS includes a core and multiple modules. The modules include both those that are platform specific and those that are not platform specific. Each module has a standard interface that allows the core (or other module) to call the module. A platform vendor constructs a BIOS by selecting modules from one or more vendors, which when executed can select modules that are suitable for the platform the BIOS resides in.

Abstract: A technique that is usable with a computer system includes, in response to a startup phase of the computer system in which a system memory of the computer system is not initialized for data storage, detecting a resource of the computer system. Information about the resource reported in response to a second phase of the computer system in which the system memory is initialized.

Abstract: A Bus Driver implements an arbitration mechanism to allow both the system management interrupt (SMI) and the Bus Driver to cooperatively use a Bus host controller hardware. This mechanism employs a hardware-based semaphore (status bit) to allow either the SMI or the driver to claim ownership of the Bus host controller for an arbitrary period of time. While either the SMI or the driver may own the status bit, the other party must poll the bit until ownership is achieved. For the SMI, this involves scheduling a periodic SMI interrupt. The driver performs self arbitration of claiming the status bit to provide the periodic SMI interrupt the opportunity to claim the bit. The mechanism allows the SMI access to the Bus host controller in a “timely” manner, while minimizing impact to driver access to the Bus host controller, which could impact driver Bus transaction throughput.

Abstract: A protected boot sequence in a computer system. A reset vector directs the system to a boot program including a protected program. This protected program verifies the integrity of the BIOS contents before branching to the BIOS for execution of normal bootstrap functions. The protected program can also lock down various blocks of bootstrap code to prevent them from being changed after a certain point in the boot sequence. The protected boot sequence can proceed in layers, with each layer providing some level of validation or security for succeeding layers.

Abstract: A method of securing a boot process for a computer system enables a processor to boot from a location identified by a boot vector. The method includes the step of disabling masking of a maskable address line in response to a processor initialization event. In one embodiment, an apparatus includes a processor coupled to a memory by at least one maskable address line wherein the memory is storing a first initialization instruction. The apparatus includes a mask control wherein the mask control disables masking of the maskable address line before the processor attempts to access the first initialization instruction in response to an initialization event. In one embodiment a processor chipset gates a first address mask control with an inhibit bit to generate a second address mask control. The second address mask control is independent of the first address mask control when the inhibit bit is set to a first value.