Secure vault service for software components within an execution environment

• US 9,361,471 B2
• Filed: 12/01/2014
• Issued: 06/07/2016
• Est. Priority Date: 06/30/2005
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Durham, David M., Khosravi, Hormuzd M., Blumenthal, Uri, Long, Men
• Primary Examiner(s): Traore, Fatoumata
• Application Number:
  US14/557,079
• Publication Number:
  US 20150134952A1
• Time in Patent Office: 554 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 12/1466 Key-lock mechanism
• CPC Class Codes: G06F 12/1475 in a virtual system, e.g. with translation means
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself

Abstract

Embodiments of apparatuses, articles, methods, and systems for secure vault service for software components within an execution environment are generally described herein. An embodiment includes the ability for a Virtual Machine Monitor, Operating System Monitor, or other underlying platform capability to restrict memory regions for access only by specifically authenticated, authorized and verified software components, even when part of an otherwise compromised operating system environment. The underlying platform to lock and unlock secrets on behalf of the authenticated/authorized/verified software component provided in protected memory regions only accessible to the authenticated/authorized/verified software component. Other embodiments may be described and claimed.

Claims

1. A computing platform comprising:

at least one processor capable of executing at least one operating system of the computing platform;

the computing platform being capable of executing, at least in part, at least one virtual machine monitor (VMM), the computing platform also comprising at least one module;

the at least one VMM being capable of providing, at least in part, multiple execution environments of the platform, the at least one VMM also being capable of controlling, at least in part, access by at least one component to at least one other component, the at least one component to be executed in at least one of the multiple execution environments, the at least one other component to be executed in at least one other of the multiple execution environments, the controlling of the access being based at least in part upon policy;

the at least one module being implemented, at least in part, by hardware;

the at least one module being associated, at least in part, with periodic verification of integrity of at least one kernel component during execution of the at least one kernel component in the platform, the verification being for detecting, at least in part, unauthorized modification of the at least one kernel component, the verification being capable of resulting in a verification result that reflects a degree of integrity verification between pass and fail, a failure of the verification resulting, at least in part, in an alert; and

the platform also being capable, at least in part, of encrypting, based at least in part upon at least one encryption key, data stored in the platform and associated with at least one of the multiple execution environments.

2. The computing platform of claim 1, wherein:

the verification is implemented, by the hardware, independently of the at least one operating system.

3. The computing platform of claim 1, wherein:

the multiple execution environments correspond to multiple virtual machines.

4. The computing platform of claim 1, wherein:

the verification is based at least in part upon cryptographic information that is associable, at least in part, with an expected state associated with the at least one kernel component at time of manufacture of the at least one kernel component.

5. The computing platform of claim 1, wherein:

the at least one VMM and the at least one module are implemented, at least in part, by a combination of the hardware and firmware.

6. The computing platform of claim 1, wherein:

the computing platform comprises storage;

the storage comprises flash storage; and

the verification is based at least in part upon cryptographic-related information that is associated at least in part with a signature.

7. The computing platform of claim 1, wherein:

the multiple execution environments correspond, at least in part, to secure partitions of the platform.

8. The computing platform of claim 1, wherein:

the at least one component and the at least one other component comprise software components.

9. The computing platform of claim 1, wherein:

the at least one processor comprises at least one multicore processor.

10. At least one machine-readable memory storing instructions that when executed by at least one machine result in performance of operations comprising:

executing, at least in part, by a computing platform, at least one virtual machine monitor (VMM);

the at least one computing platform to be associated, at least in part, with at least one module;

the at least one VMM being capable of providing, at least in part, multiple execution environments of the platform, the at least one VMM also being capable of controlling, at least in part, access by at least one component to at least one other component, the at least one component to be executed in at least one of the multiple execution environments, the at least one other component to be executed in at least one other of the multiple execution environments, the controlling of the access being based at least in part upon policy;

the at least one module being implemented, at least in part, by hardware;

the at least one module being associated, at least in part, with periodic verification of integrity of at least one kernel component during execution of the at least one kernel component in the platform, the verification being for detecting, at least in part, unauthorized modification of the at least one kernel component, the verification being capable of resulting in a verification result that reflects a degree of integrity verification between pass and fail, a failure of the verification resulting, at least in part, in an alert; and

the platform also being capable, at least in part, of encrypting, based at least in part upon at least one encryption key, data stored in the platform and associated with at least one of the multiple execution environments.

11. The at least one memory of claim 10, wherein:

the verification is implemented, by the hardware, independently of at least one operating system of the platform.

12. The at least one memory of claim 10, wherein:

the multiple execution environments correspond to multiple virtual machines.

13. The at least one memory of claim 10, wherein:

the verification is based at least in part upon cryptographic information that is associable, at least in part, with an expected state associated with the at least one kernel component at time of manufacture of the at least one kernel component.

14. The at least one memory of claim 10, wherein:

the at least one VMM and the at least one module are implemented, at least in part, by a combination of the hardware and firmware.

15. The at least one memory of claim 10, wherein:

the computing platform comprises storage;

the storage comprises flash storage; and

the verification is based at least in part upon cryptographic-related information that is associated at least in part with a signature.

16. The at least one memory of claim 10, wherein:

the multiple execution environments correspond, at least in part, to secure partitions of the platform.

17. The at least one memory of claim 10, wherein:

the at least one component and the at least one other component comprise software components.