Validating hardware processors using signed enclave images
AssigneeHewlett Packard Enterprise Development LP
InventorsLee A Preimesberger, Grant OConnor, Jonathan R. Mooty, Vartan Yosef Kasheshian
Life of this patent
Estimating the term…
Abstract
A technique includes, responsive to a boot of a computer platform, selecting a signed enclave image based on a socket identifier associated with the hardware processor. The signed enclave image corresponds to a hardware processor identity. The technique includes, responsive to the boot of the computer platform, validating the hardware processor. The validation includes providing a request for the hardware processor to create an enclave based on the signed enclave image. The validation includes, based on a response of the hardware processor to the request, determining whether the hardware processor identity corresponds to the hardware processor.
Claims20
A method comprising:
- responsive to a boot of a computer platform:
- selecting, by a firmware agent, a signed enclave image based on a socket identifier associated with a hardware processor, wherein the signed enclave image corresponds to a hardware processor identity;
- and
- validating the hardware processor, comprising:
- providing, by the firmware agent and to the hardware processor, a request for the hardware processor to create an enclave based on the signed enclave image;
- and
- based on a response of the hardware processor to the request, determining whether the hardware processor identity corresponds to the hardware processor.
A computer platform comprising:
- a CPU having an associated CPU socket identifier;
- a non-volatile memory to store a signed enclave image, wherein the signed enclave image corresponds to a CPU identity;
- a firmware agent comprising a hardware processor to:
- based on the CPU socket identifier, select the signed enclave image file;
- and
- request the CPU to create an enclave based on the signed enclave image, wherein the CPU provides a response to the request, and wherein the response indicates whether the CPU corresponds to the CPU identity;
- and
- a baseboard management controller to perform a remedial action responsive to the response indicating that the CPU does not correspond to the CPU identity.
A non-transitory storage medium to store instructions that, when executed by a hardware processor, cause a computer platform to:
- cause a first CPU to create an enclave, wherein the first CPU is associated with a CPU socket connector identifier;
- cause the first CPU to use a cryptographic key associated with the enclave to cryptographically sign an enclave image corresponding to the enclave to provide a signed enclave image;
- generate a CPU validation record corresponding to an identity for the first CPU, wherein the CPU validation record comprises data representing the signed enclave image;
- and
- responsive to a boot of the computer platform, validate a second CPU associated with the CPU socket identifier based on the CPU validation record.
Dependencies are inferred from the claim text.