# US 10,769,269 B2 · Method and apparatus to gather platform configuration profile in a trustworthy manner

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,769,269 B2
- Document ID: US10769269B2
- Status: Granted
- Kind: B2
- Application number: 16/024,781
- Filed: 2018-06-30
- Published: 2019-02-14
- Granted: 2020-09-08
- Earliest claimed: 2017-07-10
- Assignees: Intel Corporation
- Applicants: Intel Corporation
- Inventors: Kirk D. Brannock
- Web page: https://patentgrep.com/patent/US10769269B2

## CPC

- G06F 21/44: Program or device authentication
- G06F 9/4401: Bootstrapping (security arrangements therefor G06F21/57)
- G06F 9/45533: {Hypervisors; Virtual machine monitors}
- G06F 13/24: using interrupt (G06F13/32 takes precedence)
- G06F 21/30: Authentication, i.e. establishing the identity or authorisation of security principals
- G06F 21/70: Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
- G06F 2009/45575: {Starting, stopping, suspending or resuming virtual machine instances}
- G06F 2009/45579: {I/O management, e.g. providing access to device drivers or storage}
- G06F 2213/24: Interrupt
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Various embodiments are generally directed to an apparatus, method and other techniques for gathering configuration information of a computer system during a system management mode of the computer system and exposing the gathered configuration information to securely attest to the configuration of the system.

## Claims

### Claim 1

An apparatus, comprising:
memory; and
logic, at least a portion of which is implemented in processing circuitry coupled to the memory, the logic to:
store, responsive to a system management interrupt (SMI), an indication of the SMI in the memory;
store a dynamically signed portion of a system management mode (SMM) called by the SMI in the memory;
initialize at least one configuration register;
add a hash of the dynamically signed portion of the SMM to a one of the at least one configuration registers;
update an event log with an indication that the hash of the dynamically signed portion of the SMM has been added to the one of the at least one configuration registers;
load instructions corresponding to the SMM into the memory;
derive a hash of the instructions corresponding to the SMM loaded into the memory; and
verify the SMM based at least in part on the derived hash and the hash of the dynamically signed portion of the SMM in the one of the at least one configuration registers to attest to an authenticity of the SMM.

### Claim 2 (depends on 1)

The apparatus of claim 1, the logic to store a signature block of the SMI in the memory.

### Claim 3 (depends on 1)

The apparatus of claim 1, the logic to:
load the dynamically signed portion of the SMM into a secure memory partition; and
cryptographically verify the authenticity of the dynamically signed portion of the SMM.

### Claim 4 (depends on 3)

The apparatus of claim 3, the logic to initialize the secure memory partition from at least one of the memory or a trusted memory location.

### Claim 5 (depends on 1)

The apparatus of claim 1, the memory comprising an application queue including indications of a plurality of threads to be executed by the processing circuitry, the logic to:
determine a plurality of resources associated with the apparatus; and
determine resource requirements of at least one thread of the plurality of threads.

### Claim 6 (depends on 5)

The apparatus of claim 5, the logic to rendezvous at least one of the plurality of threads.

### Claim 7 (depends on 6)

The apparatus of claim 6, wherein the at least one threads is not associated with the SMI.

### Claim 8 (depends on 5)

The apparatus of claim 5, the logic to:
determine whether the plurality of resources support the determined resource requirements; and
execute the SMM based on a determination that the plurality of resources support the determined resource requirements.

### Claim 9

A method, comprising:
storing, via a processing circuit responsive to a system management interrupt (SMI) asserted against the processing circuit, an indication of the SMI in memory of a computing platform;
storing a dynamically signed portion of a system management mode (SMM) called by the SMI in the memory;
initializing at least one configuration register of the computing platform;
adding a hash of the dynamically signed portion of the SMM to a one of the at least one configuration registers;
updating an event log with an indication that the hash of the dynamically signed portion of the SMM has been added to the one of the at least one configuration registers;
loading instructions corresponding to the SMM into the memory;
deriving a hash of the instructions corresponding to the SMM loaded into the memory; and
verifying the SMM based at least in part on the derived hash and the hash of the dynamically signed portion of the SMM in the one of the at least one configuration registers to attest to an authenticity of a system management mode (SMM) called by the SMI.

### Claim 10 (depends on 9)

The method of claim 9, comprising:
storing a signature block of the SMI in the memory.

### Claim 11 (depends on 10)

The method of claim 10, comprising:
loading the dynamically signed portion of the SMM into a secure memory partition; and
cryptographically verifying the authenticity of the dynamically signed portion of the SMM.

### Claim 12 (depends on 11)

The method of claim 11, comprising:
initializing the secure memory partition from at least one of the memory or a trusted memory location.

### Claim 13 (depends on 9)

The method of claim 9, comprising:
loading instructions corresponding to the SMM into the memory;
deriving a hash of the instructions corresponding to the SMM loaded into the memory; and
verifying the SMM based at least in part on the derived hash and the hash of the dynamically signed portion of the SMM in the one of the at least one configuration registers.

### Claim 14 (depends on 9)

The method of claim 9, the memory comprising an application queue including indications of a plurality of threads to be executed by the processing circuit, the method comprising:
determining a plurality of resources associated with the computing platform; and
determining resource requirements of at least one thread of the plurality of threads.

### Claim 15 (depends on 14)

The method of claim 14, comprising:
determining whether the plurality of resources support the determined resource requirements; and
executing the SMM based on a determination that the plurality of resources support the determined resource requirements.

### Claim 16

At least one non-transitory machine-readable storage medium comprising instructions that when executed by a processor at a computing platform, cause the processor to:
store, responsive to a system management interrupt (SMI) asserted against the processor, an indication of the SMI in memory of the computing platform;
store a dynamically signed portion of a system management mode (SMM) called by the SMI in the memory;
initialize at least one configuration register of the computing platform;
add a hash of the dynamically signed portion of the SMM to a one of the at least one configuration registers;
update an event log with an indication that the hash of the dynamically signed portion of the SMM has been added to the one of the at least one configuration registers;
load instructions corresponding to the SMM into the memory;
derive a hash of the instructions corresponding to the SMM loaded into the memory; and
verify the SMM based at least in part on the derived hash and the hash of the dynamically signed portion of the SMM in the one of the at least one configuration registers to attest to an authenticity of a system management mode (SMM) called by the SMI.

### Claim 17 (depends on 16)

The at least one non-transitory machine-readable storage medium of claim 16, comprising instructions that further cause the processor to:
store a signature block of the SMI in a memory of the computing platform;
load the dynamically signed portion of the SMM into a secure memory partition; and
cryptographically verify the authenticity of the dynamically signed portion of the SMM.

### Claim 18 (depends on 16)

The at least one non-transitory machine-readable storage medium of claim 16, a memory of the computing platform comprising an application queue including indications of a plurality of threads to be executed by the processor, the medium comprising instructions that further cause the processor to:
determine a plurality of resources associated with the computing platform; and
determine resource requirements of at least one thread of the plurality of threads;
determine whether the plurality of resources support the determined resource requirements; and
execute the SMM based on a determination that the plurality of resources supports the determined resource requirement.