Protecting software environment in isolated execution

• US 20060206943A1
• Filed: 03/21/2006
• Published: 09/14/2006
• Est. Priority Date: 03/31/2000
• Status: Active Grant

• Current Assignee: Carl M. Ellison, Derrick C. Lin, Francis X. Mckeen, Gilbert Neiger, Howard C. Herbert, James A. Sutton, Ken Reneris, Millind Mittal, Roger A. Golliver, Shreekant S. Thakkar
• Original Assignee: Carl M. Ellison, Derrick C. Lin, Francis X. Mckeen, Gilbert Neiger, Howard C. Herbert, James A. Sutton, Ken Reneris, Millind Mittal, Roger A. Golliver, Shreekant S. Thakkar
• Inventors: Thakkar, Shreekant S., Neiger, Gilbert, Ellison, Carl M., Mittal, Millind, Reneris, Ken, Lin, Derrick C., McKeen, Francis X., Sutton, James A., Herbert, Howard C., Golliver, Roger A.
• Granted Patent: US 7,380,278 B2
• Time in Patent Office: Days
• US Class Current: 726/26
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/74 operating in dual or compartmented mode, i.e. at least one secure mode
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register

Abstract

A processing system has a processor that can operate in a normal ring 0 operating mode and one or more higher ring operating modes above the normal ring 0 operating mode. In addition, the processor can operate in an isolated execution mode. A memory in the processing system may include an ordinary memory area that can be accessed from the normal ring 0 operating mode, as well as an isolated memory area that can be accessed from the isolated execution mode but not from the normal ring 0 operating mode. The processing system may also include an operating system (OS) nub, as well as a key generator. The key generator may generate an OS nub key (OSNK) based at least in part on an identification of the OS nub and a master binding key (BK0) of the platform. Other embodiments are described and claimed.

Claims

1. A processing system, comprising:

a processor capable of operating in (a) a normal ring 0 operating mode, (b) one or more higher ring operating modes above the normal ring 0 operating mode, and (c) an isolated execution mode;

memory responsive to the processor, the memory to include (a) an ordinary memory area that can be accessed from the normal ring 0 operating mode, and (b) an isolated memory area that can be accessed from the isolated execution mode but not from the normal ring 0 operating mode;

an operating system (OS) nub in the processing system; and

a key generator to generate an OS nub key (OSNK) based at least in part on an identification of the OS nub and a master binding key (BK0) of the platform.

2. A processing system according to claim 1, further comprising:

a usage protector to perform at least one operation selected from the group consisting of;

encrypting data from the isolated memory area; and

decrypting data from the isolated memory area.

3. A processing system according to claim 1, wherein the OS nub comprises part of an OS to run on the processing system.

4. A processing system according to claim 1, comprising:

the isolated execution mode to have higher privilege than the normal ring 0 operating mode.

5. A processing system according to claim 1, comprising:

the OS nub to reside in the isolated memory area of the processing system.

6. A processing system according to claim 1, comprising:

the OSNK to reside in the isolated memory area of the processing system.

7. A processing system according to claim 1, wherein the OSNK is unique to the OS nub.

8. A processing system according to claim 1, further comprising:

a usage protector to utilize the OSNK to provide trust information pertaining to a software environment in the processing system.

9. A processing system according to claim 1, further comprising:

a software environment to include the OS nub; and

a usage protector to utilize the OSNK to provide trust information pertaining to the software environment.

10. A method to be performed by a processing system having a processor capable of operating in (a) a normal ring 0 operating mode, (b) one or more higher ring operating modes above the normal ring 0 operating mode, and (c) an isolated execution mode, the method comprising:

establishing an ordinary memory area in a memory responsive to the processor, the ordinary memory area to be accessible from the normal ring 0 operating mode;

establishing an isolated memory area in the memory, the isolated memory area to be accessible from the isolated execution mode and inaccessible from the normal ring 0 operating mode; and

generating an operating system (OS) nub key (OSNK) based at least in part on (a) an identification of an OS nub in the processing system and (b) a master binding key (BK0) of the platform.

11. A method according to claim 10, further comprising:

loading the OS nub into the isolated memory area during a boot process for the processing system.

12. A method according to claim 10, further comprising at least one operation from the group consisting of:

encrypting data from the isolated memory area; and

decrypting data from the isolated memory area.

13. A method according to claim 10, wherein:

when the processing system is performing at least part of the method, the isolated execution mode has higher privilege than the normal ring 0 operating mode.

14. A method according to claim 10, further comprising:

utilizing the OSNK to provide trust information pertaining to a software environment in the processing system.

15. A manufacture comprising:

a machine-accessible medium; and

instructions in the machine-accessible medium, wherein the instructions, when executed in a processing system with a processor capable of operating in (a) a normal ring 0 operating mode, (b) one or more higher ring operating modes above the normal ring 0 operating mode, and (c) an isolated execution mode, cause the processing system to perform operations comprising;

establishing an ordinary memory area in a memory responsive to the processor, the ordinary memory area to be accessible from the normal ring 0 operating mode;

establishing an isolated memory area in the memory, the isolated memory area to be accessible from the isolated execution mode and inaccessible from the normal ring 0 operating mode; and

generating an operating system (OS) nub key (OSNK) based at least in part on (a) an identification of an OS nub in the processing system and (b) a master binding key (BK0) of the platform.

16. A manufacture according to claim 15, the instructions to cause the processing system to load the OS nub into the isolated memory area during a boot process for the processing system.

17. A manufacture according to claim 15, the instructions to cause the processing system to perform at least one operation from the group consisting of:

encrypting data from the isolated memory area; and

decrypting data from the isolated memory area.

18. A manufacture according to claim 15, the instructions to cause the processing system to utilize the OSNK to provide trust information pertaining to a software environment in the processing system.