# US 2017/0288874 A1 · Cryptographic protection for trusted operating systems

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2017/0288874 A1
- Document ID: US20170288874A1
- Status: Published application
- Kind: A1
- Application number: 15/087,144
- Filed: 2016-03-31
- Published: 2017-10-05
- Earliest claimed: 2016-03-31
- Assignees: Intel Corporation
- Applicants: Intel Corporation
- Inventors: ALPA T. NARENDRA TRIVEDI; SIDDHARTHA CHHABRA; DAVID M. DURHAM
- Web page: https://patentgrep.com/patent/US20170288874A1

## CPC

- G06F 9/45533: {Hypervisors; Virtual machine monitors}
- H04L 9/3234: {involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853)}
- G06F 9/45558: {Hypervisor-specific management and integration aspects}
- G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
- G06F 21/575: {Secure boot}
- H04L 9/0897: {involving additional devices, e.g. trusted platform module [TPM], smartcard or USB}
- H04L 63/061: {for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838)}
- G06F 2009/45583: {Memory management, e.g. access or allocation}
- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- H04L 2209/127: Trusted platform modules [TPM]
- H04L 2209/805: Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

This disclosure is directed to cryptographic protection for trusted operating systems. In general, a device may comprise for example, at least processing circuitry and memory circuitry. The device may be virtualized in that the processing circuitry may load virtual machines (VMs) and a virtual machine manager (VMM) into the memory circuitry during operation. At least one of the VMs may operate as a trusted execution environment (TEE) including a trusted operating system (TOS). The processing circuitry may comprise encryption circuitry to cryptographically protect the TOS. For example, the VMM may determine a first memory range in which the TOS will be loaded and store data regarding the first memory range in a register within the encryption circuitry. The register configures the encryption circuitry to cryptographically protect the TOS.

## Claims

### Claim 1

A device equipped with protection for a trusted operating system, comprising:
memory circuitry into which virtual machines are loaded during operation of the device, at least one of the virtual machines operating as a trusted execution environment including at least a trusted operating system; and
processing circuitry to at least load the virtual machines into the memory circuitry, the processing circuitry including encryption circuitry to cryptographically protect a first range of memory in the memory circuitry in which the trusted operating system is loaded.

### Claim 2 (depends on 1)

The device of claim 1, wherein the encryption circuitry is a memory encryption engine included in processing circuitry based on Secure Guard Extensions (SGX) technology.

### Claim 3 (depends on 1)

The device of claim 1, wherein hardware reserved security metadata is also loaded in the first range of memory during operation of the device.

### Claim 4 (depends on 1)

The device of claim 1, wherein the encryption circuitry comprises at least one register to identify ranges of memory to cryptographically protect.

### Claim 5 (depends on 4)

The device of claim 4, wherein the at least one register includes a base address, a size of memory to protect and at least one cryptographic key corresponding to the range of memory.

### Claim 6 (depends on 4)

The device of claim 4, wherein the encryption circuitry is to cryptographically protect a second range of memory in the memory circuitry in which data associated with the virtual machine operating as a trusted execution environment will be loaded.

### Claim 7 (depends on 4)

The device of claim 4, wherein the encryption circuitry is to cryptographically protect a third range of memory in the memory circuitry in which a virtual machine manager is loaded.

### Claim 8 (depends on 7)

The device of claim 7, wherein the memory circuitry comprises boot circuitry including at least boot code to be executed by the processing circuitry during device initialization, the boot code causing the processing circuitry to select the third range of memory and to write data to the at least one register based on the selected third range of memory.

### Claim 9 (depends on 7)

The device of claim 7, wherein the virtual machine manager is to select the first range of memory in which the trusted operating system is to be loaded and write data based on the selected first range of memory to the at least one register.

### Claim 10 (depends on 1)

The device of claim 1, wherein the processing circuitry is to receive a request to read from or write to a memory address, determine whether the memory address is in the first memory range or second memory range and set an indicator based on whether the memory address falls within the first memory range or the second memory range.

### Claim 11 (depends on 10)

The device of claim 10, wherein the processing circuitry comprises a memory controller and the encryption circuitry is to process the request based on the indicator prior to forwarding the request to the memory controller.

### Claim 12

A method for protecting a trusted operating system, comprising:
initializing a device;
loading a virtual machine manager into memory circuitry in the device;
selecting, using the virtual machine manager, a first range of memory in the memory circuitry in which to cryptographically protect a trusted operating system; and
updating processing circuitry in the device based on the selected first memory range.

### Claim 13 (depends on 12)

The method of claim 12, wherein the trusted operating system is associated with a virtual machine operating as a trusted execution environment to be loaded in the memory circuitry.

### Claim 14 (depends on 12)

The method of claim 12, further comprising:
selecting, utilizing the virtual machine manager, a second range of memory in the memory circuitry in which to cryptographically protect data associated with the virtual machine operating as a trusted execution environment; and
updating processing circuitry in the device based on the selected second memory range.

### Claim 15 (depends on 14)

The method of claim 14, wherein loading the virtual machine manager comprises:
executing boot code using the processing circuitry;
selecting a third memory range in which to cryptographically protect the virtual machine manager;
loading the virtual machine manager;
authenticating the virtual machine manager; and
updating the processing circuitry based on the selected third memory range.

### Claim 16 (depends on 14)

The method of claim 14, wherein updating the processing circuitry comprises writing data regarding to a register associated with encryption circuitry in the processing circuitry.

### Claim 17 (depends on 16)

The method of claim 16, further comprising:
receiving a request to read from or write to a memory address;
determining whether the memory address is in the first memory range or second memory range; and
setting an indicator based on whether the memory address falls within the first memory range or the second memory range.

### Claim 18 (depends on 17)

The method of claim 17, further comprising:
processing, using the encryption circuitry, the request based on the indicator prior to forwarding the request to a memory controller in the processing circuitry.

### Claim 19

At least one machine-readable storage medium having stored thereon, individually or in combination, instructions for protecting a trusted operating system that, when executed by one or more processors, cause the one or more processors to:
initialize a device;
load a virtual machine manager into memory circuitry in the device;
select, using the virtual machine manager, a first range of memory in the memory circuitry in which to cryptographically protect a trusted operating system; and
update processing circuitry in the device based on the selected first memory range.

### Claim 20 (depends on 19)

The storage medium of claim 19, wherein the trusted operating system is associated with a virtual machine operating as a trusted execution environment to be loaded in the memory circuitry.

### Claim 21 (depends on 19)

The storage medium of claim 19, further comprising instructions that, when executed by one or more processors, cause the one or more processors to:
select, utilizing the virtual machine manager, a second range of memory in the memory circuitry in which to cryptographically protect data associated with the virtual machine operating as a trusted execution environment; and
update processing circuitry in the device based on the selected second memory range.

### Claim 22 (depends on 21)

The storage medium of claim 21, wherein the instructions to load the virtual machine manager comprise instructions to:
execute boot code using the processing circuitry;
select a third memory range in which to cryptographically protect the virtual machine manager;
load the virtual machine manager;
authenticate the virtual machine manager; and
update the processing circuitry based on the selected third memory range.

### Claim 23 (depends on 21)

The storage medium of claim 21, wherein the instructions to update the processing circuitry comprise instructions to write data regarding to a register associated with encryption circuitry in the processing circuitry.

### Claim 24 (depends on 23)

The storage medium of claim 23, further comprising instructions that, when executed by one or more processors, cause the one or more processors to:
receive a request to read from or write to a memory address;
determine whether the memory address is in the first memory range or second memory range; and
set an indicator based on whether the memory address falls within the first memory range or the second memory range.

### Claim 25 (depends on 24)

The storage medium of claim 24, further comprising instructions that, when executed by one or more processors, cause the one or more processors to:
process, using the encryption circuitry, the request based on the indicator prior to forwarding the request to a memory controller in the processing circuitry.