Communications between modules of a computing apparatus

• US 7,236,455 B1
• Filed: 02/15/2000
• Issued: 06/26/2007
• Est. Priority Date: 02/15/1999
• Status: Expired due to Fees

• Current Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Proudler, Graeme John, Chan, David
• Primary Examiner(s): Pham; Chi
• Assistant Examiner(s): Phan; Tri H.
• Application Number:
  US09/913,453
• Time in Patent Office: 2,688 Days
• Field of Search: 370229-230, 370400-410, 370/338, 709208-219, 709249-252, 709/200, 380255-287, 713150-171, 713189-202, 713/182
• US Class Current: 370/230
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: G06F 2207/7219 Countermeasures against side channel or fault attacks
• CPC Class Codes: G06F 2211/008 Public Key, Asymmetric Key, Asymmetric Encryption
• CPC Class Codes: G06F 2211/009 Trust
• CPC Class Codes: G06F 2211/1097 Boot, Start, Initialise, Power
• CPC Class Codes: G06F 2221/2103 Challenge-response

Abstract

A computing apparatus comprises a plurality of hardware modules (102,104,106) and a shared communication infrastructure (110) by which the modules can communicate with each other in the usual way. In order to increase the level of trust and security in the apparatus, a trusted hardware module (120) is also provided and is connected to the other modules by respective communication paths (122a;122b;122c), distinct from the communication infrastructure, by which each of those modules can communicate directly with the trusted module but cannot communicate directly with any other of the modules. The trusted module can therefore have secure communications, for example of “unsafe” data, with each of the other modules without any of the remaining modules eavesdropping, and the trusted module can route unsafe data between any pair of the other modules, or decline to provide such routing, for example in dependence on policy stored in the trusted module.

Claims

1. A computing apparatus comprising:

a trusted hardware module;

a plurality of further hardware modules;

a shared communication infrastructure by which the hardware modules can communicate with each other; and

a first communication path, distinct from the shared communication infrastructure, by which a first one of the further hardware modules can communicate directly with the trusted hardware module but cannot communicate directly with any other of the further hardware modules.

2. An apparatus as claimed in claim 1, wherein the trusted hardware module and the first further hardware module each include a respective computing engine which partakes in the direct communication via the first communication path.

3. An apparatus as claimed in claim 2, wherein:

the first further hardware module is operable to supply to the trusted hardware module a request for operation on data; and

in response to such a request, the trusted hardware module is operable to generate a response and to supply the response to the first further hardware module via the first communication path and not via the shared communication infrastructure.

4. An apparatus as claimed in claim 3, wherein the trusted hardware module includes means for storing policy information regarding such operations which can or cannot be permitted, and is operable to generate the response with reference to the policy information.

5. An apparatus as claimed in claim 1, wherein the trusted hardware module is operable to generate an encryption and/or decryption key and to supply that key to the first further hardware module via the first communication path and not via the shared communication infrastructure.

6. An apparatus as claimed in claim 5, wherein the first further hardware module is operable to use the key for encryption and/or decryption of data communicated via the shared communication infrastructure.

7. An apparatus as claimed in claim 1, wherein the trusted hardware module is operable to generate a challenge and to supply the challenge to the first further hardware module via the first communication path or via the shared communication infrastructure using encryption set up using the first communication path.

8. An apparatus as claimed in claim 7, wherein:

in response to the challenge, the first further hardware module is operable to generate a response and to supply the response to the trusted hardware module via the first communication path or via the shared communication infrastructure using encryption set up using the first communication path; and

the trusted hardware module is operable to use the response in generating an integrity metric of the apparatus.

9. An apparatus as claimed in claim 1, wherein:

the first further hardware module has a zone for private data and a zone for non-private data; and

the first further hardware module is operable to supply and/or receive data from/for the private data zone via the first communication path and not via the shared communication infrastructure.

10. An apparatus as claimed in claim 9, wherein the first further hardware module is operable to supply and/or receive data from/for the non-private data zone via the shared communication infrastructure.

11. An apparatus as claimed in claim 10, wherein the first further hardware module has an interface between the private and non-private data zones which is operable to inhibit the passing of data from the private data zone to the non-private data zone.

12. An apparatus as claimed in claim 1, wherein the first further hardware module is a network interface module.

13. An apparatus as claimed in claim 1, and including a second communication path, distinct from the shared communication infrastructure and the first communication path, by which a second one of the further hardware modules can communicate directly with the trusted hardware module but cannot communicate directly with any other of the further hardware modules.

14. An apparatus as claimed in claim 13, wherein:

the first further hardware module is operable to supply to the trusted hardware module a request for a transfer of data between the first and second further hardware modules; and

in response to such a request, the trusted hardware module is operable to generate a response and to supply the response to the first or second further hardware module via the first or second communication path, respectively, and not via the shared communication infrastructure.

15. An apparatus as claimed in claim 14, wherein the trusted hardware module includes means for storing policy information regarding such transfers which can or cannot be permitted, and is operable to generate the response with reference to the policy information.

16. An apparatus as claimed in claim 14, wherein:

in response to an appropriate such transfer response, the first or second further hardware module is operable to supply the data to the trusted hardware module via the first or second communication path, respectively; and

in response to the receipt of such data, the trusted hardware module is operable to relay the data to the second or first further hardware module, respectively, via the second or first communication path, as the case may be.

17. An apparatus as claimed in claim 13, wherein the second further hardware module is a main processor unit of the apparatus or a non-volatile data storage module.

18. An apparatus as claimed in claim 13, and including at least a third communication path, distinct from the shared communication infrastructure and the other communication paths, by which at least a third one of the further hardware modules can communicate directly with the trusted hardware module but cannot communicate directly with any other of the further hardware modules.

19. An apparatus as claimed in claim 18, wherein the second further hardware module is a main processor unit of the apparatus and the third further hardware module is a non-volatile data storage module.

20. An apparatus as claimed in claim 1, wherein the trusted hardware module is adapted to measure an integrity metric of the computing apparatus.

21. A computing apparatus comprising:

a trusted hardware module resistant to unauthorized modification;

a plurality of further hardware modules;

a shared communication infrastructure by which the hardware modules can communicate with each other; and

a first communication path distinct from the shared communication infrastructure by which a first one of the further hardware modules can communicate directly with the trusted hardware module but which is inaccessible to the other further hardware modules.

22. An apparatus as claimed in claim 21, wherein the trusted hardware module and the first further hardware module each include a respective computing engine which partakes in the direct communication via the first communication path.

23. An apparatus as claimed in claim 22, wherein:

the first further hardware module is operable to supply to the trusted hardware module a request for operation on data; and

in response to such a request, the trusted hardware module is operable to generate a response and to supply the response to the first further hardware module via the first communication path and not via the shared communication infrastructure.

24. An apparatus as claimed in claim 23, wherein the trusted hardware module includes means for storing policy information regarding such operations which can or cannot be permitted, and is operable to generate the response with reference to the policy information.

25. An apparatus as claimed in claim 21, wherein the trusted hardware module is operable to generate an encryption and/or decryption key and to supply that key to the first further hardware module via the first communication path and not via the shared communication infrastructure.

26. An apparatus as claimed in claim 25, wherein the first further hardware module is operable to use the key for encryption and/or decryption of data communicated via the shared communication infrastructure.

27. An apparatus as claimed in claim 21, wherein the trusted hardware module is operable to generate a challenge and to supply the challenge to the first further hardware module via the first communication path or via the shared communication infrastructure using encryption set up using the first communication path.

28. An apparatus as claimed in claim 27, wherein:

in response to the challenge, the first further hardware module is operable to generate a response and to supply the response to the trusted hardware module via the first communication path or via the shared communication infrastructure using encryption set up using the first communication path; and

the trusted hardware module is operable to use the response in generating an integrity metric of the apparatus.

29. An apparatus as claimed in claim 21, wherein the first further hardware module is a network interface module.

30. An apparatus as claimed in claim 21, wherein the trusted hardware module is adapted to measure an integrity metric of the computing apparatus.