SYSTEM AND METHOD FOR EXECUTION OF A SECURED ENVIRONMENT INITIALIZATION INSTRUCTION

• US 20120216025A1
• Filed: 04/11/2012
• Published: 08/23/2012
• Est. Priority Date: 03/29/2002
• Status: Active Grant

• Current Assignee: Tahoe Research Limited (f/k/a Learndale Limited) (Vector Capital Corporation)
• Original Assignee: David W. Grawrock, James A. Sutton II
• Inventors: Sutton, James A. II, Grawrock, David W.
• Granted Patent: US 8,645,688 B2
• Time in Patent Office: Days
• US Class Current: 713/1
• CPC Class Codes: G01N 2223/076 X-ray fluorescence
• CPC Class Codes: G01N 23/223 by irradiating the sample with X-rays or gamma-rays and by measuring X-ray fluorescence
• CPC Class Codes: G01N 33/502 for testing non-proliferative effects
• CPC Class Codes: G01N 33/6872 Intracellular protein regulatory factors and their receptors, e.g. including ion channels
• CPC Class Codes: G06F 12/0802 Addressing of a memory level in which the access to the desired data or data block requires associative addressing means, e.g. caches
• CPC Class Codes: G06F 12/145 the protection being virtual, e.g. for virtual blocks or segments before a translation mechanism
• CPC Class Codes: G06F 12/1458 by checking the subject access rights
• CPC Class Codes: G06F 13/4282 on a serial bus, e.g. I2C bus, SPI bus on daisy chain buses G06F13/4247
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/572 Secure firmware programming, e.g. of basic input output system [BIOS]
• CPC Class Codes: G06F 2212/1052 Security improvement
• CPC Class Codes: G06F 2212/60 Details of cache memory
• CPC Class Codes: G06F 2213/0026 PCI express
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: G06F 9/4403 Processor initialisation
• CPC Class Codes: G06F 9/44505 Configuring for program initiating, e.g. using registry, configuration files
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

A method and apparatus for initiating secure operations in a microprocessor system is described. In one embodiment, one initiating logical processor initiates the process by halting the execution of the other logical processors, and then loading initialization and secure virtual machine monitor software into memory. The initiating processor then loads the initialization software into secure memory for authentication and execution. The initialization software then authenticates and registers the secure virtual machine monitor software prior to secure system operations.

Claims

1. A processor comprising:

logic to, in response to a secure environment initialization instruction,

copy secure initialization software into a secure memory, and

begin execution of the secure initialization software in the secure memory.

2. The processor of claim 1, wherein the logic is to copy the secure initialization software into the secure memory for validation.

3. The processor of claim 1, wherein the logic is to begin execution of the secure initialization software by transferring control to the secure initialization software.

4. The processor of claim 1, wherein the logic is also to confirm that an other processor has entered a wait state before copying the secure initialization software into the secure memory.

5. The processor of claim 4, wherein the logic is also to provide a location at which the other processor is to begin execution in the secure environment.

6. A processor comprising:

bus transaction logic to cause the processor to issue special bus transactions, only in response to a security instruction, to support initialization of a secure system environment,

wherein the initialization includes verification of a secure virtual machine monitor and beginning of secure virtual machine monitor operations.

7. The processor of claim 6, wherein the special bus transactions are to transfer information to support initialization of the secure system environment.

8. The processor of claim 7, wherein the information includes a key.

9. A method comprising:

executing, by a first processor, a secure environment initialization instruction, including copying secure initialization software into a secure memory, and

executing, by the first processor, the secure initialization software in the secure memory in response to the secure environment initialization instruction.

10. The method of claim 9, further comprising validating the secure initialization software in the secure memory in response to the secure environment initialization instruction.

11. The method of claim 10, wherein validating the secure initialization software in the secure memory in response to the secure environment initialization instruction includes using a digital signature of the secure initialization software.

12. The method of claim 11, wherein the digital signature of the secure initialization software is produced by a hash of the secure initialization software.

13. The method of claim 12, wherein the digital signature of the secure initialization software is produced by a hash of the secure initialization software.

14. The method of claim 9, further comprising executing, after execution of the secure initialization software, a secure virtual machine monitor.

15. The method of claim 9, further comprising confirming that a second processor has entered a wait state before copying the secure initialization software into the secure memory.

16. The method of claim 15, further comprising providing a location at which the second processor is to begin execution in the secure environment.

17. A system comprising:

a first processor to, in response to a secure environment initialization instruction, copy secure initialization software into a secure memory, and begin execution of the secure initialization software in the secure memory; and

a second processor to begin execution in the secure environment at a location provided by the first processor after validation of the secure initialization software in the secure memory.

18. The system of claim 17, wherein the first processor is also to confirm that the second processor has entered a wait state before copying the secure initialization software into the secure memory.

19. The system of claim 17, further comprising a secure virtual machine monitor to be executed after execution of the secure initialization software.

20. A machine-readable medium storing a secure environment initialization instruction that, when executed by a processor, causes the processor to:

copy secure initialization software into a secure memory, and

begin execution of the secure initialization software in the secure memory.