Initialization of protected system
OwnerAndrew F. Glew, James A. Sutton +4inventors
InventorsAndrew F. Glew, James A. Sutton, Lawrence O. Smith, David W. Grawrock, Gilbert Neiger, Michael A. Kozuch
Life of this patent
Estimating the term…
Abstract
A system is initialized for operation in a protected operating environment by executing authenticated code that prepares various portions of the hardware for protection from non-trusted software. In one embodiment, initialization includes identifying and locking down specified areas of memory for protected processing, then placing trusted software into the specified areas of memory and validating the trusted software. In a particular embodiment, initialization may also include deriving and protectively storing identifying characteristics of the trusted software.
Claims28
A method, comprising:
- preparing a computer system for a trusted operating environment by testing a memory configuration;
- checking at least one protected register for a content compatible with protected operation of the trusted operating environment;
- placing trusted software into at least one memory block defined as protected in the memory configuration;
- validating the trusted software;
- and
- aborting said preparing in response to an error detected by any of said testing, said checking, and said validating.
An apparatus, comprising:
- a logic circuit to be coupled between a processor and a memory to control access to the memory, the logic circuit including at least one register to enable controlled access to protected operations.
A system, comprising:
- a processor;
- a volatile memory;
- and
- a logic circuit coupled between the processor and the volatile memory to control access to the volatile memory, wherein the logic circuit in response to at least one command initiated by the processor is to lock a configuration of the volatile memory;
- enable testing of the configuration;
- write into a table indicators of protected address ranges in the volatile memory;
- and
- write trusted software into the protected address ranges.
A machine-readable medium that provides instructions, which when executed by a computing device, cause said computing device to perform operations comprising:
- retrieving trusted software;
- placing the trusted software into one or more memory blocks within a system memory, the one or more memory blocks designated as protected memory blocks by a table;
- and
- validating the trusted software.
Dependencies are inferred from the claim text.