# US 11,907,389 B2 · Data release control based on authentication and link protection > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,907,389 B2 - Document ID: US11907389B2 - Status: Granted - Kind: B2 - Application number: 17/745,740 - Filed: 2022-05-16 - Published: 2022-11-03 - Granted: 2024-02-20 - Earliest claimed: 2018-12-12 - Assignees: Intel Corporation - Applicants: Intel Corporation - Inventors: David J. Harriman; Ioannis T. Schoinas; Kapil Sood; Raghunandan Makaram; Yu-Yuan Chen - Web page: https://patentgrep.com/patent/US11907389B2 ## CPC - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G06F 21/64: Protecting data integrity, e.g. using checksums, certificates or signatures - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract First data is stored. A request for the first data is received from a communication device over a link established with a communication device. An access control engine comprising circuitry is to control access to the first data to the communication device based on an authentication state of the communication device and a protection state of the link. ## Claims ### Claim 1 An apparatus comprising: first circuitry to: authenticate a communication device based on authentication of immutable component information of the communication device and mutable component information of the communication device; communicate with the communication device to establish protection for a communication link, wherein establishing protection includes establishing confidentiality, replay, and integrity protections for the communication link; and block communication of at least one data packet over the communication link based on a power change effected by the apparatus; and second circuitry to encrypt a plurality of data packets prior to transmission of the data packets over the communication link. ### Claim 2 (depends on 1) The apparatus of claim 1, wherein a security engine comprises the first circuitry and wherein an encryption engine comprises the second circuitry. ### Claim 3 (depends on 1) The apparatus of claim 1, wherein the immutable component information comprises a Device ID and a Vendor ID of the communication device. ### Claim 4 (depends on 1) The apparatus of claim 1, wherein the immutable component information comprises information indicating one or more capabilities of hardware of the communication device. ### Claim 5 (depends on 1) The apparatus of claim 1, wherein the mutable component information comprises information indicating one or more capabilities of software of the communication device. ### Claim 6 (depends on 1) The apparatus of claim 1, wherein the mutable component information comprises a version number of firmware of the communication device. ### Claim 7 (depends on 1) The apparatus of claim 1, wherein the first circuitry is to initiate reauthentication of the communication device and reestablishment of protection of the communication link based on the power change of the apparatus. ### Claim 8 (depends on 1) The apparatus of claim 1, wherein the first circuitry is to block communication of at least one data packet over the communication link based on invalidity of a checksum. ### Claim 9 (depends on 1) The apparatus of claim 1, wherein establishing protection for the communication link between the apparatus and the communication device comprises setting up an encryption scheme based on Advanced Encryption Standard operating in Galois/Counter Mode (AES-GCM) with a 256-bit cryptographic key. ### Claim 10 (depends on 1) The apparatus of claim 1, wherein authenticating the communication device comprises utilization of an in-band register set. ### Claim 11 (depends on 1) The apparatus of claim 1, wherein the first circuitry is to perform key exchange to set up the protection for the communication link by using Management Component Transport Protocol (MCTP) tunneling messages. ### Claim 12 (depends on 1) The apparatus of claim 1, wherein authenticating the communication device comprises verifying at least one hash. ### Claim 13 (depends on 1) The apparatus of claim 1, further comprising the communication link and the communication device. ### Claim 14 (depends on 1) The apparatus of claim 1, wherein the first circuitry is further to provide authentication information associated with the apparatus over the communication link to allow the communication device to authenticate the apparatus. ### Claim 15 A method comprising: receiving immutable component information of a communication device and mutable component information of the communication device; establish a protected communication link by communicating with the communication device to establish confidentiality, replay, and integrity protections for a communication link to the communication device; communicating a plurality of data packets over the protected communication link; and blocking communication of at least one data packet over the communication link based on a power change. ### Claim 16 (depends on 15) The method of claim 15, wherein the immutable component information comprises information indicating one or more capabilities of hardware of the communication device. ### Claim 17 A server comprising: a first computing device comprising: a processor core; and a security engine comprising circuitry, the security engine to: authenticate a communication device based on immutable component information of the communication device and mutable component information of the communication device; communicate with the communication device to establish protection for a communication link, wherein establishing protection includes establishing confidentiality, replay, and integrity protections for the communication link; and block communication of at least one data packet over the communication link based on a power change effected by the first computing device. ### Claim 18 (depends on 17) The server of claim 17, further comprising a system memory coupled to the processor core. ### Claim 19 (depends on 17) The server of claim 17, further comprising the communication device. ### Claim 20 (depends on 19) The server of claim 19, wherein the communication device comprises a network interface controller, graphics processing unit accelerator, or an artificial intelligence accelerator. ### Claim 21 (depends on 19) The server of claim 19, wherein the communication device comprises an encrypted storage device.