Back to results
US 8,510,569 B2Granted
Providing integrity verification and attestation in a hidden execution environment
AssigneeIntel Corporation
InventorsNed Smith, Vedvyas Shanbhogue, Arvind Kumar, Purushottam Goel
Life of this patent
Estimating the term…
Abstract
In one embodiment, a processor includes a microcode storage including processor instructions to create and execute a hidden resource manager (HRM) to execute in a hidden environment that is not visible to system software. The processor may further include an extend register to store security information including a measurement of at least one kernel code module of the hidden environment and a status of a verification of the at least one kernel code module. Other embodiments are described and claimed.
Claims21
An apparatus comprising:
- a processor to execute instructions, the processor including at least one core and a first microcode storage including first processor instructions to execute instructions of an instruction set architecture (ISA) of the processor, a second microcode storage including second processor instructions to create and execute a hidden resource manager (HRM) to execute in a hidden environment that is not visible to system software, and an extend register to store security information including a measurement of at least one kernel code module of the hidden environment and a status of a verification of the at least one kernel code module.
A method comprising:
- generating a cipher message authentication code (CMAC) of a plurality of pages of a hidden partition of a system memory of a system using a first private key and storing each of the CMACs in a corresponding entry of an integrity check value (ICV) array;
- encrypting the first private key and a value of a counter into an encrypted blob using a second private key;
- transitioning the system from a first power state to a low power state in which the system memory is unprotected by a processor of the system;
- and
- using the encrypted blob and the ICV array to validate the hidden partition when the system is transitioned from the low power state to the first power state.
2 more elements
A system comprising:
- a processor to execute instructions, the processor including at least one core and a microcode storage including processor instructions to create and execute a hidden resource manager (HRM) to execute in a hidden environment that is not visible to system software, and an extend register to store security information including a measurement of at least one kernel code module of the hidden environment and a status of a verification of the at least one kernel code module, wherein the HRM is to generate a cipher message authentication code (CMAC) for each of a plurality of pages of a hidden memory partition using a first private key and store each of the CMACs in a corresponding entry of an integrity check value (ICV) array, encrypt the first private key and a value of a counter into an encrypted blob using a second private key, and use the encrypted blob and each of the entries of the ICV array to validate pages of the hidden memory partition that are assigned by the HRM for use in the hidden environment, when the system is transitioned from a low power state;
- and
- a system memory coupled to the processor and including the hidden memory partition, the system memory to be in a self-refresh state when the processor is in the low power state.
Dependencies are inferred from the claim text.