Low cost trusted platform
AssigneeIntel Corporation
InventorsMichael S. Richmond, Vincent J. Zimmer, Michael A. Rothman
Life of this patent
Estimating the term…
Abstract
A method and apparatus is described herein for emulating a physical trusted platform module (TPM) in a virtual monitor, such as a system management mode (SMM) or a system management interrupt (SMI) transfer monitor (STM). By allowing SMIs during a secure launch, SMM is allowed into the secure launch trust perimeter and a virtual monitor may emulate the structures, behaviors, and protected storage of a physical TMP, such as the storage of cryptographic keys, secure verification, attestation, and other TPM functions.
Claims18
A method comprising:
- generating a system management interrupt (SMI) during a secure launch of a computer system;
- and
- initializing, in response to the SMI, a stand-alone trusted platform module (TPM) emulator, which is to include at least one protected secret, in a virtual monitor during the secure launch;
- issuing a TPM ordinal;
- emulating a command stream of the TPM ordinal in the virtual monitor;
- and
- handling the command stream of the TPM ordinal in the virtual monitor.
A storage device including program code which, when executed by a machine, causes the machine to perform the operations of:
- initializing a machine state register (MSR) to generate a system management interrupt (SMI) in response to a secure instruction event;
- and
- emulating a stand-alone trusted platform module (TPM) in a protected range of system memory in response to generating the SMI, wherein the protected range of memory is at least partially overlapping with a range of memory associated with a virtual monitor, the virtual monitor being selected from a group consisting of a system management monitor (SMM), a SMI transfer monitor (STM), and a virtual machine monitor (VMM).
A system comprising:
- a nonvolatile memory to store boot-code, the nonvolatile memory having a secure portion to store cryptographic information;
- a system memory to include a range of memory associated with a virtual monitor, the range of memory further to hold stand-alone trusted platform module (TPM) emulator code to perform cryptographic operations on at least the cryptographic information;
- and
- a controller hub coupled to the nonvolatile memory, the system memory, and a microprocessor, wherein the microprocessor is adapted to operate in a virtual monitor mode to execute the stand-alone TPM emulator code from the protected range of memory, wherein the microprocessor is also to issue a TPM ordinal, wherein the TPM ordinal references the range of memory associated with the stand-alone trusted platform module (TPM) emulator code.
Dependencies are inferred from the claim text.