System and method for resetting a platform configuration register

• US 20030188113A1
• Filed: 03/29/2002
• Published: 10/02/2003
• Est. Priority Date: 03/29/2002
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Sutton, James A. II, Grawrock, David W.
• Granted Patent: US 7,028,149 B2
• Time in Patent Office: Days
• US Class Current: 711/156
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00

Abstract

A method and apparatus for resetting and modifying special registers in a security token is described. In one embodiment, a register may be reset when a reset flag is true when a special transmission on a bus demonstrates the mutual locality of the associated processor and chipset. A modify flag may also be used to indicate whether the register contents may be modified. Modifications may also be dependent upon demonstration of mutual locality.

Claims

1. A system, comprising:

a circuit including a first register; and

a first bus coupled to said circuit to convey a locality confirming message.

2. The system of claim 1, further comprising a first flag coupled to said first register.

3. The system of claim 2, wherein said first flag indicates permission to reset said first register.

4. The system of claim 3, wherein said first register is capable of being reset during execution of a privileged instruction by a processor.

5. The system of claim 3, further comprising a second flag coupled to said first register to indicate permission to modify a content of said first register.

6. The system of claim 1, further comprising a first flag coupled to said first register to indicate permission to modify a content of said first register.

7. The system of claim 6, wherein said content of said first register is capable of being modified during execution of a privileged instruction by a processor.

8. The system of claim 1, wherein said first register is capable of containing a first digest of a first code.

9. The system of claim 8, wherein said first register is capable of containing a second digest of a second code extended onto said first digest.

10. The system of claim 8, further comprising a second register to contain a second digest of a second code.

11. The system of claim 1, further comprising a chipset to transmit said locality confirming message across said first bus.

12. The system of claim 11, wherein said chipset transmits said locality confirming message responsively to a special bus message.

13. The system of claim 12, wherein said special bus message is conveyed on a second bus.

14. The system of claim 13, further comprising a processor to transmit said special bus message on said second bus.

15. The system of claim 14, wherein said processor transmits said special bus message during an execution of a privileged instruction.

16. An apparatus, comprising:

a first register to store a first digest; and

a first flag coupled to said first register to indicate whether to permit said first register to reset responsive to a locality confirming message.

17. The apparatus of claim 16, wherein said first flag may be set at manufacture.

18. The apparatus of claim 16, further comprising a second flag coupled to said first register to indicate whether to permit contents of said first register to change responsive to said locality confirming message.

19. The apparatus of claim 16, further comprising a second register to store a second digest.

20. The apparatus of claim 19, further comprising a third flag coupled to said second register to indicate whether to permit said second register to reset responsive to said locality confirming message.

21. The apparatus of claim 20, further comprising a fourth flag coupled to said second register to indicate whether to permit contents of said second register to change responsive to said locality confirming message.

22. The apparatus of claim 16, further comprising a circuitry supporting said first register responsive to a write instruction to extend said first digest with a second digest.

23. A chipset, comprising:

bus message logic to receive a special bus message from a processor; and

security bus logic to send a locality confirming message responsive to said special bus message.

24. The chipset of claim 23, when said special bus message is issued during the period of execution of a secured enter instruction.

25. The chipset of claim 23, wherein said locality confirming message includes instructions to reset a register.

26. The chipset of claim 23, wherein locality confirming message includes instructions to modify the contents of a register.

27. A method, comprising:

transmitting a first locality confirming message on a first bus; and

determining whether to reset a first register responsively to said first locality confirming message.

28. The method of claim 27, further comprising determining whether to reset said first register responsive to a first flag.

29. The method of claim 28, further comprising transmitting a second locality confirming message on said first bus;

and further comprising determining whether to modify a first content of said first register responsively to said second locality confirming message.

30. The method of claim 29, further comprising determining whether to modify said first content of said first register responsive to a second flag.

31. The method of claim 30, further comprising transmitting a third locality confirming message on said first bus;

and further comprising determining whether to reset a second register responsively to said third locality confirming message.

32. The method of claim 31, further comprising transmitting a fourth locality confirming message on said first bus;

and further comprising determining whether to modify a second content of said second register responsively to said fourth locality confirming message.

33. The method of claim 30, further comprising transmitting a third locality confirming message on said first bus;

and further comprising determining whether to modify a second content of said first register responsively to said third locality confirming message.

34. The method of claim 31, further comprising modifying said second content of said first register using a cryptological combination with a digest.

35. An apparatus, comprising:

a first register to store a first digest; and

a first flag coupled to said first register to indicate whether to permit contents of said first register to be modified responsive to a locality confirming message.

36. The apparatus of claim 35, wherein said first flag may be set at manufacture.

37. The apparatus of claim 35, further comprising a second flag coupled to said first register to indicate whether to permit said first register to reset responsive to said locality confirming message

38. A method, comprising:

transmitting a first locality confirming message on a first bus; and

determining whether to modify contents of a first register responsively to said first locality confirming message.

39. The method of claim 38, further comprising determining whether to modify contents of said first register responsive to a first flag.