US 2007/0192577 A1 · Apparatus and method for unilaterally loading a secure operating system within a multiprocessor environment

Abstract

An apparatus and method for unilaterally loading a secure operating system within a multiprocessor environment are described. The method includes disregarding a received load secure region instruction when a currently active load secure region operation is detected. Otherwise, a memory protection element is directed, in response to the received load secure region instruction, to form a secure memory environment. Once directed, unauthorized read/write access to one or more protected memory regions are prohibited. Finally, a cryptographic hash value of the one or more protected memory regions is stored within a digest information repository as a secure software identification value. Once stored, outside agents may request access to a digitally signed software identification value to establish security verification of secure software within the secure memory environment.

Claims20

Dependent claims

A method for loading secure software within a multiprocessor system, comprising:

disregarding a load secure region instruction received from security initiation software if a currently active load secure region operation is detected, the load secure region instruction to indicate one or more memory regions loaded with software code selected by the security initiation software as the secure software;
otherwise, forming, according to the received load secure region instruction, a secure memory environment from the one or more memory regions including the software code, such that unauthorized read/write access to the one or more memory regions is prohibited to secure the software code to form the secure software;
and
storing, within a digest information repository, a cryptographic hash value of the one or more protected memory regions as a secure software identification value, to enable establishment of security verification of the secure software within the secure memory environment.

1 more element

A system comprises:

a memory controller including a memory protection element coupled to the memory controller, the memory protection element to block unauthorized memory access to one or more protected memory regions;
an I/O controller coupled to the memory controller including a non-volatile memory to store security initiation software, the security initiation software to load one or more memory regions with software code selected as secure software and to issue a load secure region instruction;
a plurality of processors, each coupled to the memory controller, a processor from the plurality of processors to direct, in accordance with a load secure region operation corresponding to the issued load secure region instruction, the memory protection element to form a secure memory environment from the one or more memory regions including the software code as the one or more protected memory regions to secure the software code to form the secure software;
a verification unit coupled to the I/O controller and including a digest information repository to store a secure software identification value for the secure software and to provide security verification of the secure software to an outside agent.

1 more element

An article of manufacture having a machine accessible medium including associated data, wherein the data, when accessed, results in the machine performing:

forming, according to a load secure region instruction received from security initiation software, a secure memory environment from one or more memory regions loaded with software code selected by the security initiation software, such that unauthorized read/write access to the one or more memory regions is prohibited to secure the software code to form secure software;
and
storing, within a digest information repository, a cryptographic hash value of the one or more protected memory regions as a secure software identification value, to enable establishment of security verification of the secure software within the secure memory environment.

Dependencies are inferred from the claim text.

Apparatus and method for unilaterally loading a secure operating system within a multiprocessor environment

Life of this patent

Apparatus and method for unilaterally loading a secure operating system within a multiprocessor environment

Life of this patent

Abstract

Claims20