System and method for execution of a secured environment initialization instruction

• US 9,990,208 B2
• Filed: 01/10/2017
• Issued: 06/05/2018
• Est. Priority Date: 03/29/2002
• Status: Expired due to Term

• Current Assignee: Tahoe Research Limited (f/k/a Learndale Limited) (Vector Capital Corporation)
• Original Assignee: Intel Corporation
• Inventors: Sutton, II, James A., Grawrock, David W.
• Primary Examiner(s): Smithers, Matthew
• Application Number:
  US15/402,663
• Publication Number:
  US 20170115993A1
• Time in Patent Office: 511 Days
• CPC Class Codes: G01N 2223/076 X-ray fluorescence
• CPC Class Codes: G01N 23/223 by irradiating the sample with X-rays or gamma-rays and by measuring X-ray fluorescence
• CPC Class Codes: G01N 33/502 for testing non-proliferative effects
• CPC Class Codes: G01N 33/6872 Intracellular protein regulatory factors and their receptors, e.g. including ion channels
• CPC Class Codes: G06F 12/0802 Addressing of a memory level in which the access to the desired data or data block requires associative addressing means, e.g. caches
• CPC Class Codes: G06F 12/145 the protection being virtual, e.g. for virtual blocks or segments before a translation mechanism
• CPC Class Codes: G06F 12/1458 by checking the subject access rights
• CPC Class Codes: G06F 13/4282 on a serial bus, e.g. I2C bus, SPI bus on daisy chain buses G06F13/4247
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/572 Secure firmware programming, e.g. of basic input output system [BIOS]
• CPC Class Codes: G06F 2212/1052 Security improvement
• CPC Class Codes: G06F 2212/60 Details of cache memory
• CPC Class Codes: G06F 2213/0026 PCI express
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: G06F 9/4403 Processor initialisation
• CPC Class Codes: G06F 9/44505 Configuring for program initiating, e.g. using registry, configuration files
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

A method and apparatus for initiating secure operations in a microprocessor system is described. In one embodiment, one initiating logical processor initiates the process by halting the execution of the other logical processors, and then loading initialization and secure virtual machine monitor software into memory. The initiating processor then loads the initialization software into secure memory for authentication and execution. The initialization software then authenticates and registers the secure virtual machine monitor software prior to secure system operations.

Claims

1. A system on a chip (SoC) comprising:

a processor including;

a trusted memory of the processor to support secure initialization operations,

secure initialization logic of the processor to establish a root of trust for a secure execution environment,

execution logic of the processor to execute secure initialization program code within the secure execution environment, at least a portion of the secure initialization program code to be copied into the trusted memory,

the execution logic to validate the secure initialization program code prior to execution,

the execution logic to validate a virtual machine monitor (VMM) and copy the VMM to a trusted system memory area within the secure execution environment, and

wherein the execution logic includes one or more cores to execute one or more threads; and

a memory controller to couple the processor to a system memory;

the processor and the memory controller on a single semiconductor die.

2. The SoC of claim 1, further comprising access logic to permit or deny access to memory pages within the system memory, the access logic on the single semiconductor die.

3. The SoC of claim 1, wherein validation of the VMM by the execution unit is to include cryptographic authentication of the VMM.

4. A system on a chip (SoC) comprising:

a processor including;

a trusted memory of the processor to support secure initialization operations,

execution logic of the processor, the execution logic including secure initialization logic to establish a root of trust for a secure execution environment,

the execution logic to execute secure initialization program code within the secure execution environment, at least a portion of the secure initialization program code to be copied into the trusted memory,

the execution logic to validate the secure initialization program code prior to execution,

the execution logic to validate a virtual machine monitor (VMM) and copy the VMM to a trusted system memory area within the secure execution environment, and

wherein the execution logic includes one or more cores to execute one or more threads; and

a memory controller to couple the processor to a system memory;

the processor and the memory controller on a single semiconductor die.

5. The SoC of claim 4, further comprising access logic to permit or deny access to memory pages within the system memory, the access logic on the single semiconductor die.

6. The SoC of claim 4, wherein validation of the VMM by the execution unit is to include cryptographic authentication of the VMM.