Systems and methods for providing secure platform services
Systems and methods for providing secure platform services using an information handling system, and which may be implemented to sequester or otherwise isolate sensitive cryptographic processes, as well as the keys used during such decryption and encryption processes. The systems and methods may be implemented as a set of secure services that are available to an operating system or to a Hypervisor executing on an information handling system, and the processing environment may be provided as a closed environment, thus preventing malicious code from infiltrating the processing environment. Dedicated and secure memory space may be employed to prevent key detection through memory scans.
1 . An information handling system, comprising:
a first processing device, at least one operating system executing on said first processing device;
a second processing device configured to perform secure platform services that include at least one cryptographic task or at least one cryptographic key management task, said second processing device being inaccessible to said operating system; and
dedicated memory coupled to said second processing device, said dedicated memory being inaccessible to said operating system;
wherein said first processing device is configured to be coupled to said second processing device by a secure communication path that comprises at least one of a secure authenticated channel, an encrypted channel, or a secure session.
2 . The information handling system of claim 1 , further comprising secure storage that is available to a cryptographic processor; wherein said first processing device comprises a central processing unit (CPU); and wherein said second processing device comprises said cryptographic processor.
3 . The information handling system of claim 1 , wherein said dedicated memory comprises embedded firmware or secure memory.
4 . The information handling system of claim 1 , wherein said first processing device comprises a security driver executing thereon; wherein said second processing device comprises an application programming interface (API) executing thereon that is configured to perform bidirectional authentication between said operating system and said secure platform services; and wherein said security driver communicates with said API across said secure communication path.
5 . The information handling system of claim 1 , wherein two or more guest operating systems are executing on said at least one first processing device; wherein a hypervisor is executing on said at least one first processing device; and wherein said first processing device is configured to communicate with said second processing device across aid secure communication path and through said hypervisor.
6 . The information handling system of claim 5 , wherein said first processing device comprises a respective security driver executing thereon that corresponds to each of said two or more operating systems; wherein said second processing device comprises an application programming interface (API) executing thereon that is configured to perform bidirectional authentication between said operating system and said secure platform services; and wherein each of said security drivers communicates with said API across said secure communication path.
7 . A method of providing secure services for an information handling system, comprising:
providing an information handling system comprising first and second processing devices, and dedicated memory coupled to said second processing device;
providing at least one operating system executing on said first processing device; and
performing secure platform services that include at least one decryption or encryption task or at least one cryptographic key management task using said second processing device;
wherein said second processing device and said dedicated memory are inaccessible to said operating system, and
wherein said first processing device is coupled to said second processing device by a secure communication path that comprises at least one of a secure authenticated channel, an encrypted channel, or a secure session.
8 . The method of claim 7 , wherein said information handling system further comprises secure storage available to a cryptographic processor; wherein said first processing device comprises a central processing unit (CPU); and wherein said second processing device comprises said cryptographic processor.
9 . The method of claim 7 , wherein said dedicated memory comprises embedded firmware.
10 . The method of claim 7 , further comprising providing a security driver executing on said first processing device; and providing an application programming interface (API) executing on said second processing device that is configured to perform bidirectional authentication between said operating system and said secure platform services; wherein said security driver communicates with said API across said secure communication path.
11 . The method of claim 7 , further comprising providing two or more guest operating systems executing on said first processing device; providing a hypervisor executing on said first processing device; and wherein said first processing device is configured to communicate with said second processing device across said secure communication path and through said hypervisor.
12 . The method of claim 11 , further comprising providing a separate respective security driver executing on said first processing device that corresponds to each of said two or more operating systems; providing an application programming interface (API) executing on said second processing device that is configured to perform bidirectional authentication between said operating system and said secure platform services; and wherein each of said security drivers communicates with said API across said secure communication path.
13 . An information handling system, comprising:
a first processing device, at least one operating system and a virtual machine environment executing on said first processing device, said virtual machine environment being inaccessible to said operating system; and
dedicated memory coupled to said first processing device, said dedicated memory being accessible to said virtual machine environment and being inaccessible to said operating system;
wherein said virtual machine environment is configured to perform secure platform services that include at least one decryption or encryption task or at least one cryptographic key management task; and
wherein said virtual machine environment is configured to communicate with said operating system by a secure communication path that includes a virtualization layer and that comprises at least one of a secure authenticated channel, an encrypted channel, or a secure session.
14 . The information handling system of claim 13 , wherein said dedicated memory comprises embedded firmware.
15 . The information handling system of claim 13 , wherein said first processing device comprises a security driver executing thereon; wherein said virtual machine environment comprises an application programming interface (API) executing therein that is configured to perform bidirectional authentication between said operating system and said secure platform services; and wherein said security driver communicates with said API across said secure communication path.
16 . A method of providing secure services for an information handling system, comprising:
providing an information handling system comprising a first processing device;
providing at least one operating system and a virtual machine environment executing on said first processing device, said virtual machine environment being inaccessible to said operating system;
providing dedicated memory coupled to said first processing device, said dedicated memory being accessible to said virtual machine environment and being inaccessible to said operating system; and
performing secure platform services using said virtual machine environment, said secure platform services including at least one decryption or encryption task or at least one cryptographic key management task;
wherein said virtual machine environment is configured to communicate with said operating system by a secure communication path that includes a virtualization layer and that comprises at least one of a secure authenticated channel, an encrypted channel, or a secure session.
17 . The method of claim 16 , wherein said dedicated memory comprises embedded firmware.
18 . The method of claim 16 , further comprising providing a security driver executing on said first processing device; and providing an application programming interface (API) executing in said virtual machine environment, said API being configured to perform bidirectional authentication between said operating system and said secure platform services; wherein said security driver communicates with said API across said secure communication path.