# US 2014/0157404 A1 · Virtualizing a hardware monotonic counter

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2014/0157404 A1
- Document ID: US20140157404A1
- Status: Published application
- Kind: A1
- Application number: 13/690,111
- Filed: 2012-11-30
- Published: 2014-06-05
- Earliest claimed: 2012-11-30
- Assignees: Intel Corporation
- Inventors: Siddhartha Chhabra; Reshma Lal; Jason Martin; Daniel Nemiroff
- Web page: https://patentgrep.com/patent/US20140157404A1

## CPC

- G06F 21/50: Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F 21/54: by adding security routines or objects to programs
- G06F 21/71: to assure secure computing or processing of information
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Embodiments of an invention for virtualizing a hardware monotonic counter are disclosed. In one embodiment, an apparatus includes a hardware monotonic counter, virtualization logic, a first non-volatile storage location, and a second non-volatile storage location. The virtualization logic is to create a virtual monotonic counter from the hardware monotonic counter. The first non-volatile storage location is to store an indicator that the count of the hardware monotonic counter has changed. The second non-volatile storage location is to store an indicator that the count of the virtual monotonic counter has changed.

## Claims

### Claim 1

An apparatus comprising:
a hardware monotonic counter;
virtualization logic to create a virtual monotonic counter from the hardware monotonic counter;
a first non-volatile storage location to store a first indicator to indicate change to the hardware monotonic counter; and
a second non-volatile storage location to store a second indicator to indicate change to the virtual monotonic counter.

### Claim 2 (depends on 1)

The apparatus of claim 1, further comprising secure enclave logic to create a first secure enclave to store a count of the virtual monotonic counter count.

### Claim 3 (depends on 2)

The apparatus of claim 2, wherein the secure enclave logic is also to create a second secure enclave to use the count of the virtual monotonic counter.

### Claim 4

A method comprising:
storing a count of a virtual monotonic counter in a data structure;
sealing the data structure using a count of a hardware monotonic counter.

### Claim 5 (depends on 4)

The method of claim 4, further comprising storing a user identifier in the data structure to identify a user of the virtual monotonic counter.

### Claim 6 (depends on 5)

The method of claim 5, further comprising sealing a data blob using the count of the virtual monotonic counter.

### Claim 7 (depends on 6)

The method of claim 6, further comprising creating a service secure enclave to store the data structure.

### Claim 8 (depends on 7)

The method of claim 7, further comprising creating a user secure enclave to store the data blob.

### Claim 9 (depends on 8)

The method of claim 8, further comprising creating a first trusted path between the user secure enclave and the service secure enclave.

### Claim 10 (depends on 9)

The method of claim 9, further comprising creating a second trusted path between the service secure enclave and a session manager having access to the hardware monotonic counter.

### Claim 11 (depends on 10)

The method of claim 10, further comprising calling, by a user application running in the user secure enclave, a service application running in the service secure enclave to increment the virtual monotonic counter.

### Claim 12 (depends on 10)

The method of claim 10, further comprising calling, by the service application in response to receiving a request to increment the virtual monotonic counter, the session manager to increment the hardware monotonic counter.

### Claim 13 (depends on 12)

The method of claim 12, further comprising setting, in response to receiving a request to increment the hardware monotonic counter, a service application change indicator to indicate change to the hardware monotonic counter.

### Claim 14 (depends on 13)

The method of claim 13, further comprising incrementing the count of the virtual monotonic counter and setting a user application change indicator to indicate change to the virtual monotonic counter.

### Claim 15 (depends on 14)

The method of claim 14, further comprising clearing the service application change indicator after the hardware monotonic counter change has propagated to the service secure enclave.

### Claim 16 (depends on 14)

The method of claim 14, further comprising clearing the user application change indicator after the virtual monotonic counter change has propagated to the user secure enclave.

### Claim 17

A system comprising:
a management engine including
a hardware monotonic counter,
virtualization logic to create a virtual monotonic counter from the hardware monotonic counter,
a first non-volatile storage location to store a first indicator to indicate that the hardware monotonic counter has changed, and
a second non-volatile storage location to store a second indicator to indicate that the virtual monotonic counter has changed; and
a processor including secure enclave logic to create a first secure enclave to store a count of the virtual monotonic counter count and second secure enclave to use the count of the virtual monotonic counter count.

### Claim 18 (depends on 17)

The system of claim 17 wherein the secure enclave logic includes an encryption unit to encrypt information stored by a secure enclave.

### Claim 19 (depends on 17)

The system of claim 17 wherein the secure enclave logic includes secure enclave range registers for allocating a secure memory space to a secure enclave.

### Claim 20 (depends on 17)

The method of claim 17 wherein the secure enclave logic include access control logic to prevent access to unencrypted information cached by a secure enclave.