Mechanism to determine trust of out-of-band management agents

• US 8,533,777 B2
• Filed: 12/29/2004
• Issued: 09/10/2013
• Est. Priority Date: 12/29/2004
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Fish, Andrew J.
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): BAYOU, YONAS A
• Application Number:
  US11/025,751
• Publication Number:
  US 20060236371A1
• Time in Patent Office: 3,177 Days
• Field of Search: 726/2
• US Class Current: 726/2
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/74 operating in dual or compartmented mode, i.e. at least one secure mode

Abstract

According to one embodiment, computer system is disclosed. The computer system includes a central processing unit (CPU) to simultaneously operate a trusted environment and an untrusted environment and a chipset coupled to the CPU. The chipset includes an interface to couple to a management agent, and protected registers having a bit to indicate if the management agent is provided access to resources within the trusted environment.

Claims

1. A computer system comprising:

a central processing unit (CPU) to simultaneously operate a trusted environment and an untrusted environment; and

a chipset, coupled to the CPU, including;

an interface to couple to an out-of-band management agent; and

protected registers having a bit to indicate if the out-of-band management agent is provided access to resources within the trusted environment.

2. The computer system of claim 1 wherein the out-of-band management agent is permitted to access the resources within the trusted environment if the bit is enabled.

3. The computer system of claim 2 wherein the out-of-band management agent is permitted to modify the resources within the trusted environment if the bit is enabled.

4. The computer system of claim 1 wherein the out-of-band management agent is not permitted to access the resources within the trusted environment if the bit is disabled.

5. The computer system of claim 4 wherein the out-of-band management agent is permitted to access resources within the untrusted environment if the bit is disabled.

6. A method comprising:

receiving a request from an out-of-band management agent to access a computer system simultaneously operating a trusted environment and an untrusted environment; and

determining if a bit within a protected register is enabled; and

permitting the out-of-band management agent to access resources within the trusted environment if the bit is enabled.

7. The method of claim 6 further comprising permitting the out-of-band management agent to modify the resources within the trusted environment if the bit is enabled.

8. The method of claim 6 further comprising preventing the out-of-band management agent from accessing the resources within the trusted environment if the bit is disabled.

9. The method of claim 6 further comprising permitting the out-of-band management agent to access resources within the untrusted environment if the bit is disabled.

10. A system comprising:

an out-of-band management agent; and

a computer system platform to simultaneously host a trusted environment and an untrusted environment, the computer system platform including an integrated circuit (IC) having;

an interface to couple to the out-of-band management agent; and

protected registers having a bit to indicate if the out-of-band management agent is provided access to resources within the trusted environment.

11. The system of claim 10 wherein the out-of-band management agent is permitted to access the resources within the trusted environment if the bit is enabled.

12. The system of claim 11 wherein the out-of-band management agent is permitted to modify the resources within the trusted environment if the bit is enabled.

13. The system of claim 10 wherein the out-of-band management agent is not permitted to access the resources within the trusted environment if the bit is disabled.

14. The system of claim 13 wherein the out-of-band management agent is permitted to access resources within the untrusted environment if the bit is disabled.

15. The system of claim 10 wherein the out-of-band management agent is a virtual machine of a second computer system platform.

16. A non-transient computer readable medium having stored thereon a program of instructions that, when executed by a processing unit, causes the processing unit to:

receive a request from an out-of-band management agent to access a computer system simultaneously operating a trusted environment and an untrusted environment; and

determine if a bit within a protected register is enabled; and

permit the out-of-band management agent to access resources within the trusted environment if the bit is enabled.

17. The non-transient computer readable medium of claim 16 wherein the program of instructions, when executed by a processing unit, further causes the processing unit to permit the management agent to modify the resources within the trusted environment if the bit is enabled.

18. The non-transient computer readable medium of claim 16 wherein the program of instructions, when executed by a processing unit, further causes the processing unit to prevent the management agent from accessing the resources within the trusted environment if the bit is disabled.

19. The non-transient computer readable medium of claim 16 wherein the program of instructions, when executed by a processing unit, further causes the processing unit to permit the management agent to access resources within the untrusted environment if the bit is disabled.