US 12,712,856 B2 · Techniques for a trusted execution environment at a compute server to use a remote accelerator

Abstract

Examples include techniques for a trusted execution environment (TEE) at a compute server to request a service to be performed by an accelerator that is located at or with a service server. Examples are described of the TEE at the compute server authenticating the remote accelerator to enable establishment of one or more secure communication sessions for the accelerator to decrypt encrypted data, perform a transformation on the decrypted data and then re-encrypt the transformed data. Examples are also described of the TEE at the compute server authenticating a service TEE at the service server as well as the accelerator to enable the service TEE and the accelerator to collaboratively decrypt encrypted data, perform a transformation on the decrypted data and then re-encrypt the transformed data.

Claims31

Dependent claims

An apparatus to be configured at a compute server, the apparatus comprising:

a processor;
a memory;
and
circuitry of a trusted execution environment (TEE), the TEE to include a trusted computing base that includes at least one core of the processor and at least a portion of the memory, wherein the circuitry is configured to:
authenticate an accelerator at a service server that is to be coupled with the compute server via a communication link routed through a fabric;
and
cause a key table to be programmed and maintained at the accelerator, the key table for use by the accelerator to identify at least one session key to use to decrypt encrypted data sent from or destined to the TEE, wherein the key table is to be programmed based on a session key programming request to configure each entry in the key table associated with an indicated key index value as a positive integer value (>=2), which is to be used to decrypt and encrypt data associated with an active communication session of a given established secure session.

4 more elements

A method comprising:

authenticating, by circuitry of a trusted execution environment (TEE) at a compute server, an accelerator at a service server that is to be coupled with the compute server via a communication link routed through a fabric;
and
causing a key table to be programmed and maintained at the accelerator, the key table for use by the accelerator to identify at least one session key to use to decrypt encrypted data sent from or destined to the TEE, wherein the key table is programmed based on a session key programming request to configure each entry in the key table associated with an indicated key index value as a positive integer value (>=2), which is to be used to decrypt and encrypt data associated with an active communication session of a given established secure session.

At least one non-transitory computer-readable storage medium, comprising a plurality of instructions, that when executed by circuitry of a trusted execution environment (TEE) at a compute server, cause the circuitry to:

authenticate an accelerator at a service server that is to be coupled with the compute server via a communication link routed through a fabric;
and
cause a key table to be programmed and maintained at the accelerator, the key table for use by the accelerator to identify at least one session key to use to decrypt encrypted data sent from or destined to the TEE, wherein the key table is to be programmed based on a session key programming request to configure each entry in the key table ated with an indicated key index value as a positive integer value (>=2), which is used to decrypt and encrypt data associated with an active communication session of a given established secure session.

An accelerator device configured to be coupled with a service server, the accelerator device comprising:

a memory;
and
circuitry to be configured to:
exchange information with a trusted execution environment (TEE) at a compute server to be coupled with the service server via a communication link routed through a fabric, the exchanged information to authenticate the accelerator device to the TEE;
and
receive a session key programming request from the TEE to program a key table for use to identify at least one session key to use to decrypt encrypted data sent from or destined to the TEE;
and
program the key table based on the session key programming request and cause the key table to be stored to the memory, wherein each entry of the key table is associated with an indicated key index value as a positive integer value (>=2), which is to be used to decrypt and encrypt data associated with an active communication session of a given established secure session.

5 more elements

A service server comprising:

an accelerator device to include circuitry configured to:
exchange information with trusted execution environment (TEE) at a compute server to be coupled with the service server via a communication link routed through a fabric, the exchanged information to authenticate the accelerator device to the TEE at the compute server;
and
securely share one or more session keys with the TEE at the compute server to use to decrypt encrypted data sent from or destined to the TEE at the compute server or to encrypt transformed data generated using decrypted encrypted data;
and
a service TEE, the service TEE to include a trusted computing base that includes at least one core of a processor hosted by the service server and at least a portion of a memory hosted by the service server, wherein the service TEE includes circuitry, the circuitry of the service TEE is configured to:
exchange information with a TEE at the compute server via the communication link routed through the fabric, the exchanged information to authenticate the service TEE to the TEE at the compute server;
and
securely share the one or more session keys based on a key table, with the TEE at the compute server to use to decrypt encrypted data sent from or destined to the TEE at the compute server or to encrypt transformed data generated by the accelerator device using decrypted encrypted data, wherein the key table is to be programmed based on a session key programming request to configure each entry in the key table associated with an indicated key index value as a positive integer value (>=2), which is to be used to decrypt and encrypt data associated with an active communication session of a given established secure session.

6 more elements

Dependencies are inferred from the claim text.

Techniques for a trusted execution environment at a compute server to use a remote accelerator

Life of this patent

Techniques for a trusted execution environment at a compute server to use a remote accelerator

Life of this patent

Abstract

Claims31