Systems and methods for providing secure platform services
OwnerDavid Konetski, Richard W. Schuckle +1inventors
InventorsDavid Konetski, Richard W. Schuckle, Frank H. Molsberry
Life of this patent
Estimating the term…
Abstract
Systems and methods for providing secure platform services using an information handling system, and which may be implemented to sequester or otherwise isolate sensitive cryptographic processes, as well as the keys used during such decryption and encryption processes. The systems and methods may be implemented as a set of secure services that are available to an operating system or to a Hypervisor executing on an information handling system, and the processing environment may be provided as a closed environment, thus preventing malicious code from infiltrating the processing environment. Dedicated and secure memory space may be employed to prevent key detection through memory scans.
Claims18
An information handling system, comprising:
- a first processing device, at least one operating system executing on said first processing device;
- a second processing device configured to perform secure platform services that include at least one cryptographic task or at least one cryptographic key management task, said second processing device being inaccessible to said operating system;
- and
- dedicated memory coupled to said second processing device, said dedicated memory being inaccessible to said operating system;
- wherein said first processing device is configured to be coupled to said second processing device by a secure communication path that comprises at least one of a secure authenticated channel, an encrypted channel, or a secure session.
A method of providing secure services for an information handling system, comprising:
- providing an information handling system comprising first and second processing devices, and dedicated memory coupled to said second processing device;
- providing at least one operating system executing on said first processing device;
- and
- performing secure platform services that include at least one decryption or encryption task or at least one cryptographic key management task using said second processing device;
- wherein said second processing device and said dedicated memory are inaccessible to said operating system, and
- wherein said first processing device is coupled to said second processing device by a secure communication path that comprises at least one of a secure authenticated channel, an encrypted channel, or a secure session.
An information handling system, comprising:
- a first processing device, at least one operating system and a virtual machine environment executing on said first processing device, said virtual machine environment being inaccessible to said operating system;
- and
- dedicated memory coupled to said first processing device, said dedicated memory being accessible to said virtual machine environment and being inaccessible to said operating system;
- wherein said virtual machine environment is configured to perform secure platform services that include at least one decryption or encryption task or at least one cryptographic key management task;
- and
- wherein said virtual machine environment is configured to communicate with said operating system by a secure communication path that includes a virtualization layer and that comprises at least one of a secure authenticated channel, an encrypted channel, or a secure session.
A method of providing secure services for an information handling system, comprising:
- providing an information handling system comprising a first processing device;
- providing at least one operating system and a virtual machine environment executing on said first processing device, said virtual machine environment being inaccessible to said operating system;
- providing dedicated memory coupled to said first processing device, said dedicated memory being accessible to said virtual machine environment and being inaccessible to said operating system;
- and
- performing secure platform services using said virtual machine environment, said secure platform services including at least one decryption or encryption task or at least one cryptographic key management task;
- wherein said virtual machine environment is configured to communicate with said operating system by a secure communication path that includes a virtualization layer and that comprises at least one of a secure authenticated channel, an encrypted channel, or a secure session.
Dependencies are inferred from the claim text.