Secure machine platform that interfaces to operating systems and customized control programs

• US 20020194389A1
• Filed: 04/08/2002
• Published: 12/19/2002
• Est. Priority Date: 06/08/2001
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Gardner, Robert, Magenheimer, Daniel J., McKee, Bret, Hyser, Chris D., Worley, William S. Jr., Worley, John S., Christian, Tom
• Granted Patent: US 7,073,059 B2
• Time in Patent Office: Days
• US Class Current: 719/310
• CPC Class Codes: G06F 12/1491 in a hierarchical protection system, e.g. privilege levels, memory rings
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 9/4812 by interrupt, e.g. masked

Abstract

A combined-hardware-and-software secure-platform interface to which operating systems and customized control programs interface within a computer system. The combined-hardware-and-software secure-platform interface employs a hardware platform that provides at least four privilege levels, non-privileged instructions, non-privileged registers, privileged instructions, privileged registers, and firmware interfaces. The combined-hardware-and-software secure-platform interface conceals all privileged instructions, privileged registers, and firmware interfaces and privileged registers from direct access by operating systems and custom control programs, providing to the operating systems and custom control programs the non-privileged instructions and non-privileged registers provided by the hardware platform as well as a set of callable software services. The callable services provide a set of secure-platform management services for operational control of hardware resources that neither exposes privileged instructions, privileged registers, nor firmware interfaces of the hardware nor simulates privileged instructions and privileged registers. The callable services also provide a set of security-management services that employ internally generated secret data, each compartmentalized security-management service managing internal secret data without exposing the internal secret data to computational entities other than the security-management service itself.

Claims

1. A combined-hardware-and-software secure-platform interface, the hardware providing a number of privilege levels, non-privileged instructions, non-privileged registers, privileged instructions, and privileged registers, the combined-hardware-and-software secure-platform interface comprising:

non-privileged instructions and non-privileged registers provided by the hardware instruction-set architecture; and

a set of callable software services that, when invoked, can execute at a privilege level that is more privileged than the privilege levels of calling programs, and that provide for operational control of hardware resources without exposing privileged instructions and privileged registers of the hardware and without simulating privileged instructions and privileged registers.

2. The combined-hardware-and-software secure-platform interface of claim 1, wherein the hardware provides firmware interfaces and at least four privilege levels in addition to non-privileged instructions, non-privileged registers, privileged instructions, and privileged registers, and also provides a means to restrict the physical memory addresses that can be accessed by I/O operations.

3. The combined-hardware-and-software secure-platform interface of claim 1, wherein the set of callable software services include:

a set of secure-platform management services that provide a caller with operational control of hardware resources that do not expose privileged instructions and registers of the hardware and that do not simulate privileged instructions and privileged registers, and

a set of security-management services that employ internally generated secret data, each security-management service managing internal secret data without exposing the internal secret data to computational entities other than the security-management service.

4. The combined-hardware-and-software secure-platform interface of claim 1 wherein secure-platform management services include:

platform services invoked by an operating system or custom control program to perform functions that use privileged operations, that involve SP resources, or that are security-sensitive;

domain-control services that provide for creation, configuration, reinitialization, and shutdown of domains;

processor-control services that provide for configuration and scheduling of logical and physical CPUs;

platform-policy-control services that provide for specification, retention, and application of platform policy, such as, for example, allocation of system resources; and

inter-and-intra-domain services that provide for signaling events between logical CPUs within and between domains, sharing resources among domains, and providing data transfer for fast networking or data exchange among domains.

5. The combined-hardware-and-software secure-platform interface of claim 1 wherein security-management services include:

secure repository services, invoked by an operating system, custom control program, or a user-application program, that provide functions that use secrets available only to certain processes executing at the highest privilege level of the system; and

caller authentication services that provide means for domains to associate a secure tag with specific users, application programs, operating system components, directories, files, dispatchable objects, or other system objects, including specific users, application programs, operating-system components, directories, files, and dispatchable objects, and to use that tag to authenticate access to platform services and secure-repository services.

6. The combined-hardware-and-software secure-platform interface of claim 5 wherein secure repository services include:

cryptographic services that provide for encrypting and decrypting data using one or more cryptographic functions, including functions that compute one-way hash functions, message authentication codes, digital signatures, and random numbers; and

secure data services, including secure logs, policy data bases, and other forms of services that use secret data that needs to be compartmentalized and isolated from all other system components.

7. Computer instructions that implement a software portion of the combined-hardware-and-software secure-platform interface of claim 1 encoded in a computer-readable medium.

8. A computer system comprising at least one user-level program, at least one operating system, a hardware platform, and the combined-hardware-and-software secure-platform interface of claim 1.

9. A computer system that hosts a control program, the control program one of an operating system or customized control program, the computer system comprising:

a hardware platform providing a number of execution privilege levels, non-privileged instructions and non-privileged registers, and privileged instructions and privileged registers;

a set of software services callable by the control program for performing operations requiring one or both of the privileged instructions and privileged registers and that, when invoked, can execute at a privilege level that is more privileged than a privilege level at which the control program executes, the calling programs neither simulating privileged instructions and privileged registers nor exposing privileged instructions and privileged registers to the control program; and

a secure platform kernel that executes at a most privileged level.

10. The computer system of claim 9 wherein the secure platform kernel authenticates calls to the software services before launching execution of the software services.

11. The computer system of claim 9 further comprising:

a combined-hardware-and-software secure-platform interface that conceals the privileged instructions and privileged registers, providing an interface to the non-privileged instructions and non-privileged registers provided by the hardware instruction-set architecture and to the set of callable software services.

12. The computer system of claim 9 wherein the hardware provides firmware interfaces and at least four privilege levels in addition to non-privileged instructions, non-privileged registers, privileged instructions, and privileged registers, and also provides a means to restrict the physical memory addresses that can be accessed by I/O operations.

13. The computer system of claim 9 wherein the set of callable software services include:

a set of secure-platform management services for operational control of hardware resources that do not expose privileged instructions and privileged registers of the hardware and that do not simulate privileged instructions and privileged registers; and

a set of security-management services that employ internally generated secret data, each security-management service managing internal secret data without exposing the internal secret data to computational entities other than the security-management service.

14. The computer system of claim 13 wherein secure-platform management services include:

platform services invoked by an operating system or custom control program to perform functions that use privileged operations, that involve SP resources, or that are security-sensitive;

domain-control services that provide for creation, configuration, reinitialization, and shutdown of domains;

processor-control services that provide for configuration and scheduling of logical and physical CPUs;

platform-policy-control services that provide for specification, retention, and application of platform policy, such as, for example, allocation of system resources; and

inter-and-intra-domain services that provide for signaling events between logical CPUs within and between domains, sharing resources among domains, and providing data transfer for fast networking or data exchange among domains.

15. The computer system of claim 13 wherein security-management services include:

secure repository services, invoked by an operating system, custom control program, or a user-application program, that provide functions that use secrets available only to certain processes executing at the highest privilege level of the system; and

caller authentication services that provide means for domains to associate a secure tag with specific users, application programs, operating system components, directories, files, dispatchable objects, or other system objects, including specific users, application programs, operating-system components, directories, files, and dispatchable objects, and to use that tag to authenticate access to platform services and secure-repository services.

16. The computer system of claim 15 wherein secure repository services include:

cryptographic services that provide for encrypting and decrypting data using one or more cryptographic functions, including functions that compute one-way hash functions, message authentication codes, digital signatures, and random numbers; and

secure data services, including secure logs, policy data bases, and other forms of services that use secret data that needs to be compartmentalized and isolated from all other system components.

17. The computer system of claim 9 further including an internal interface that provides various secure-platform-kernel mechanisms, including:

memory management mechanisms;

dispatch mechanisms;

exception mechanisms;

interrupt mechanisms;

debug and monitoring mechanisms;

cryptographic mechanisms;

cryptographic storage mechanisms;

secure repository mechanisms; and

secure repository storage mechanisms.

18. The computer system of claim 9 further including a secure boot process incorporated within hardware, software, firmware, or a combination of two or more of hardware, software, and firmware, that authenticates and validates each firmware and software routine executed to initialize the system up to execution of an operating system

19. The computer system of claim 18 wherein the secure boot process validates each firmware and software routine prior to execution of the firmware or software routine, including operating-system routines and user-application programs.

20. A method for securing a computer system, the method comprising:

providing a hardware platform with a number of privilege levels, memory compartmentalization facilities that control access by an entity to a unit of memory, and memory partitioning facilities that partition memory into sets of regions, each region comprising a number of memory units;

providing a set of callable software services that, when invoked, can execute at a privilege level that is more privileged than the privilege levels of calling programs, that provide for operational control of hardware resources without exposing privileged instructions and privileged registers of the hardware and without simulating privileged instructions and privileged registers, and that, together with the hardware platform, comprise a combined-hardware-and-software secure platform;

;

providing a combined-hardware-and-software secure-platform interface that exposes non-privileged instructions and non-privileged registers to operating systems and custom control programs, that provides interfaces to the callable software routines, and that conceals the privileged instructions and privileged registers; and

launching an operating system or control program that interfaces to the combined-hardware-and-software secure-platform interface.

21. The method of claim 20, wherein the hardware platform provides firmware interfaces and at least four privilege levels in addition to non-privileged instructions, non-privileged registers, privileged instructions, and privileged registers, and also provides a means to restrict the physical memory addresses that can be accessed by I/O operations.

22. The method of claim 20, wherein the set of callable software services include:

a set of secure-platform management services that provide a caller with operational control of hardware resources without exposing privileged instructions and registers of the hardware and without simulating privileged instructions and privileged registers, and

a set of security-management services that employ internally generated secret data, each security-management service managing internal secret data without exposing the internal secret data to computational entities other than the security-management service.

23. The method of claim 22 wherein secure-platform management services include:

platform services invoked by the operating system or custom control program to perform functions that use privileged operations, that involve SP resources, or that are security-sensitive;

domain-control services that provide for creation, configuration, reinitialization, and shutdown of domains;

processor-control services that provide for configuration and scheduling of logical and physical CPUs;

platform-policy-control services that provide for specification, retention, and application of platform policy, such as, for example, allocation of system resources; and

inter-and-intra-domain services that provide for signaling events between logical CPUs within and between domains, sharing resources among domains, and providing data transfer for fast networking or data exchange among domains.

24. The method of claim 22 wherein security-management services include:

secure repository services, invoked by an operating system, custom control program, or user-application program, that provide functions that use secrets available only to certain processes executing at the highest privilege level of the system; and

caller authentication services that provide means for domains to associate a secure tag with specific users, application programs, operating system components, directories, files, dispatchable objects, or other system objects, including specific users, application programs, operating system components, directories, files, and dispatchable objects, and to use that tag to authenticate access to platform services and secure-repository services.

25. The method of claim 24 wherein secure repository services include:

cryptographic services that provide for encrypting and decrypting data using one or more cryptographic functions, including functions that compute one-way hash functions, message authentication codes, digital signatures, and random numbers; and

secure data services such as secure logs, policy data bases, and other forms of services that use secret data that needs to be compartmentalized and isolated from all other system components.

26. The method of claim 20 further including providing an internal interface that provides various secure-platform-kernel mechanisms, including:

memory management mechanisms;

dispatch mechanisms;

exception mechanisms;

interrupt mechanisms;

debug and monitoring mechanisms;

cryptographic mechanisms;

cryptographic storage mechanisms;

secure repository mechanisms; and

secure repository storage mechanisms.

27. The method of claim 20 further including providing a secure boot process incorporated within hardware, software, and firmware that authenticates and validates each firmware and software routine executed to initialize the system up to execution of an operating system.

28. The method of claim 27 wherein the secure boot process validates each firmware and software routine prior to execution of the firmware or software routine, including operating-system routines and user-application programs.

29. Computer instructions that implement a software portion of the combined-hardware-and-software secure platform provided by the method of claim 20.

30. A computer system comprising at least one user-level program, at least one operating system, a hardware platform, and the combined-hardware-and-software secure-platform provided by the method of claim 20.

31. A method for securing a computer system that includes a hardware platform with a number of privilege levels, privileged instructions and privileged registers, non-privileged instructions and non-privileged registers, memory compartmentalization facilities that control access by an entity to a unit of memory, and memory partitioning facilities that partition memory into sets of regions, each region comprising a number of memory units, the method comprising:

providing a software layer that includes

a set of secure-platform management services for operational control of hardware resources that do not expose privileged instructions and registers of the hardware and that do not simulate privileged instructions and privileged registers, and

a set of security-management services that employ internally generated secret data, each security-management service managing internal secret data without exposing the internal secret data to computational entities other than the security-management service; and

providing a combined-hardware-and-software secure-platform interface that exposes non-privileged instructions and non-privileged registers to operating systems and custom control programs, that provides interfaces to the callable software routines, and that conceals the privileged instructions and privileged registers.

32. The method of claim 31, wherein the hardware provides firmware interfaces and at least four privilege levels in addition to non-privileged instructions, non-privileged registers, privileged instructions, and privileged registers, and a means to restrict the physical memory addresses that can be accessed by I/O operations.

33. The method of claim 31 wherein the set of callable software routines, when invoked, can execute at at least two privilege levels that are more privileged than the privilege levels of calling programs.

34. The method of claim 31 wherein secure-platform management services include:

platform services invoked by an operating system or custom control program to perform functions that use privileged operations, that involve SP resources, or that are security-sensitive;

domain-control services that provide for creation, configuration, reinitialization, and shutdown of domains;

processor-control services that provide for configuration and scheduling of logical and physical CPUs;

platform-policy-control services that provide for specification, retention, and application of platform policy, such as, for example, allocation of system resources; and

inter-and-intra-domain services that provide for signaling events between logical CPUs within and between domains, sharing resources among domains, and providing data transfer for fast networking or data exchange among domains.

35. The method of claim 31 wherein security-management services include:

secure repository services, invoked by an operating system, custom control program, or user-application program, provide functions that use secrets available only to processes executing at the highest privilege level of the system; and

caller authentication services that provide means for domains to associate a secure tag with specific users, application programs, operating system components, directories, files, dispatchable objects, or other system objects, including specific users, application programs, operating system components, directories, files, and dispatchable objects, and to use that tag to authenticate access to platform services and secure-repository services.

36. The method of claim 35 wherein secure repository services include:

cryptographic services that provide for encrypting and decrypting data using one or more cryptographic functions, including functions that compute one-way hash functions, message authentication codes, digital signatures, and random numbers; and

secure data services such as secure logs, policy data bases, and other forms of services that use secret data that needs to be compartmentalized and isolated from all other system components.

37. The method of claim 31 further including an internal interface that provides various secure-platform-kernel mechanisms, including:

memory management mechanisms;

dispatch mechanisms;

exception mechanisms;

interrupt mechanisms;

debug and monitoring mechanisms;

cryptographic mechanisms;

cryptographic storage mechanisms;

secure repository mechanisms; and

secure repository storage mechanisms.

38. The method of claim 31 further including providing a secure boot process incorporated within hardware, software, and firmware that authenticates and validates each firmware and software routine executed to initialize the system up to execution of an operating system.

39. The method of claim 38 wherein the secure boot process validates each firmware and software routine prior to execution of the firmware or software routine, including operating-system routines and user-application programs.

40. Computer instructions that implement a software portion of the combined-hardware-and-software secure-platform interface provided by the method of claim 31.

41. A computer system comprising at least one user-level program, at least one operating system, a hardware platform, and the combined-hardware-and-software secure-platform provided by the method of claim 31.

42. A combined-hardware-and-software secure platform comprising:

a hardware layer providing a means for executing a process or routine at one of a number of privilege levels, privileged instructions and privileged registers, non-privileged instructions and non-privileged registers, a means for compartmentalizing memory to control access by a process or routine to a unit of memory, and a means for partitioning memory into sets of regions, each region comprising a number of memory units;

a means for providingsecure-platform management services for operational control of hardware resources that do not expose privileged instructions and privileged registers of the hardware and that do not simulate privileged instructions and privileged registers and security-management services that employ internally generated secret data, each security-management service managing internal secret data without exposing the internal secret data to computational entities other than the security-management service; and

an interface means that conceals the privileged instructions and privileged registers while providing, to calling operating-system or customized-control-access routines, access to the non-privileged instructions and non-privileged registers provided by the hardware instruction-set architecture and to the secure-platform management services and security-management services.