System validation by hardware root of trust (HRoT) device and system management mode (SMM)
Techniques are disclosed for assessment and verification of processor configuration and settings using System Management Mode (SMM) in conjunction with a hardware root of trust (HRoT). A method may include receiving custom boot codes from a security device, the custom boot codes configured to install a security module to process a periodic System Management Interrupt (SMI), configure the periodic SMI for initiation, and configure at least one configuration register for validation in response to execution of the security module. The method may also include responsive to initiation of the configured periodic SMI, validating, using the security device, the at least one configuration register.
1. A computer-implemented method comprising:
receiving custom boot codes from a security device, the custom boot codes, when executed by a processor, configured to
install a security module to process a periodic System Management Interrupt (SMI);
configure the periodic SMI for initiation; and
configure at least one configuration register for validation in response to execution of the security module; and
responsive to initiation of the configured periodic SMI, validating, using the security device, the at least one configuration register.
2. The computer-implemented method of claim 1 , wherein the security device includes a hardware root of trust (HRoT) device.
3. The computer-implemented method of claim 1 , wherein the custom boot codes are received via a secure channel.
4. The computer-implemented method of claim 1 , wherein to install the security module includes to install the security module to execute in System Management Mode (SMM).
5. The computer-implemented method of claim 1 , wherein the at least one configuration register includes a dynamic random-access memory (DRAM) timing register.
6. The computer-implemented method of claim 1 , wherein the at least one configuration register includes a System Management Bus (SMBUS) control register.
7. The computer-implemented method of claim 1 , wherein validating the at least one configuration register comprises:
hashing a value of the at least one configuration register; and
sending a hash of the value of the at least one configuration register to the security device for validation.
8. The computer-implemented method of claim 7 , further comprising, responsive to receiving the hash of the value of the at least one configuration register, determining a state of the at least one configuration register based on the received hash.
9. The computer-implemented method of claim 7 , wherein the hash is sent via a secure channel.
10. The computer-implemented method of claim 1 , wherein the custom boot codes are included in a basic input/output system (BIOS) or a Unified Extensible Firmware Interface (UEFI).
11. The computer-implemented method of claim 1 , further comprising initiating the configured periodic SMI during a boot process of the processor.
12. The computer-implemented method of claim 1 , further comprising initiating the configured periodic SMI post system boot of the processor.
13. A secure system comprising:
a hardware root of trust (HRoT) device comprising at least one processor, the at least one processor of the HRoT device configured to authenticate custom boot codes, the custom boot codes comprising a security module, the custom boot codes configured to be loaded and executed on a host platform, the customer boot codes, when executed by a processor on the host platform, being configured to:
install the security module to process a periodic System Management Interrupt (SMI);
configure the periodic SMI for initiation; and
configure at least one configuration register for validation in response to execution of the security module;
such that, in response to initiation of the configured periodic SMI, the security module executes to validate the at least one configuration register using the HRoT device.
14. The system of claim 13 , the HRoT device is further configured to provide the custom boot codes to the host platform via a secure channel.
15. The system of claim 13 , wherein the at least one processor of the HRoT device is configured to decrypt the custom boot codes.
16. The system of claim 13 , wherein the at least one configuration register includes a dynamic random-access memory (DRAM) timing register or a System Management Bus (SMBUS) control register.
17. The system of claim 13 , wherein to install the security module includes to install the security module to execute in System Management Mode (SMM).
18. The system of claim 13 , wherein to validate the at least one configuration register comprises to send a hash of a value of the at least one configuration register to the HRoT device for validation.
19. The system of claim 18 , wherein the at least one processor of the HRoT device is further configured to, responsive to receipt of the hash, validate the received hash.
20. A computer-implemented method comprising:
loading, by a hardware root of trust (HRoT) device, custom boot codes, the custom boot codes comprising a security module;
authenticating, by the HRoT device, the custom boot codes; and
providing the authenticated custom boot codes to a host platform such that, when executed by a processor of the host platform, the custom boot codes
install the security module to execute in System Management Mode (SMM) to process a periodic System Management Interrupt (SMI);
configure the periodic SMI for initiation; and
configure at least one configuration register for validation using the HRoT device in response to execution of the security module.