Partitioned platform security mechanism
A computer platform is disclosed. The computer platform comprises a central processing unit (CPU) including at least one socket having a plurality of tiles and control circuitry to partition the socket into a plurality of sub-sockets and assign a unique identity to each of the plurality of sub-sockets for security verification, wherein each sub-socket comprises at least one of the plurality of tiles to operate as a cluster of resources.
1. A computer platform comprising:
a central processing unit (CPU) including:
at least one socket having a plurality of tiles; and
control circuitry to partition the socket into a plurality of sub-sockets and assign a unique identity to each of the plurality of sub-sockets for security verification, wherein each sub-socket comprises at least one of the plurality of tiles to operate as a cluster of resources.
2. The computer platform of claim 1 , wherein assigning the unique identity to each of the plurality of sub-sockets comprises generating a first active component root of trust (AC-ROT) Leaf associated with a first of the plurality of sub-sockets and generating a second active component AC-ROT Leaf associated with a second of the plurality of sub-sockets.
3. The computer platform of claim 2 , wherein the first AC-ROT Leaf and the second AC-ROT Leaf are generated using an AC-ROT Root.
4. The computer platform of claim 3 , wherein the AC-ROT Root comprises an AC-ROT associated with the CPU.
5. The computer platform of claim 4 , wherein the AC-ROT Root operates as a certificate of authority to generate a first certificate chain associated with the first AC-ROT Leaf and a second certificate chain associated with the second AC-ROT Leaf.
6. The computer platform of claim 5 , wherein the certificate chain comprises a leaf identity, an indication that an identified Leaf has been cryptographically signed by the AC-ROT Root and an on-device device signature authority associated with a manufacturer of the CPU.
7. The computer platform of claim 6 , wherein the AC-ROT Leaf receives a device identifier public key signed by the AC-ROT Root.
8. The computer platform of claim 7 , wherein the platform further comprises a security engine to operate is a root of trust for the platform.
9. The computer platform of claim 8 , wherein the security engine verifies the identity of the first sub-socket via the first AC-ROT Leaf and verifies the identity of the second sub-socket via the second AC-ROT Leaf.
10. A method comprising:
detecting a partitioning of a central processing unit (CPU) socket having a plurality of tiles into plurality of plurality of sub-sockets; and
assigning a unique identity to each of the plurality of sub-sockets for security verification, wherein each sub-socket comprises at least one of the plurality of tiles to operate as a cluster of resources.
11. The method of claim 10 , wherein assigning the unique identity to each of the plurality of sub-sockets comprises:
generating a first active component root of trust (AC-ROT) Leaf associated with a first of the plurality of sub-sockets; and
generating a second active component AC-ROT Leaf associated with a second of the plurality of sub-sockets.
12. The method of claim 11 , wherein the first AC-ROT Leaf and the second AC-ROT Leaf are generated using an AC-ROT Root.
13. The method of claim 12 , wherein the AC-ROT Root comprises a CPU AC-ROT associated with the CPU.
14. The method of claim 13 , wherein the AC-ROT Root operates as a certificate of authority to generate a first certificate chain associated with the first AC-ROT Leaf and a second certificate chain associated with the second AC-ROT Leaf.
15. The method of claim 13 , further comprising:
verifying the identity of the first sub-socket via the first AC-ROT Leaf at a platform root of trust; and
verifying the identity of the second sub-socket via the second AC-ROT Leaf at the platform root of trust.
16. A system on chip (SOC) comprising:
a central processing unit (CPU) including:
at least one socket having a plurality of tiles; and
control circuitry to partition the socket into a plurality of sub-sockets and assign a unique identity to each of the plurality of sub-sockets for security verification, wherein each sub-socket comprises at least one of the plurality of tiles to operate as a cluster of resources; and
a security engine to verify the identity of the plurality of sub-sockets.
17. The SOC of claim 16 , wherein assigning the unique identity to each of the plurality of sub-sockets comprises generating a first active component root of trust (AC-ROT) Leaf associated with a first of the plurality of sub-sockets and generating a second active component AC-ROT Leaf associated with a second of the plurality of sub-sockets.
18. The SOC of claim 17 , wherein the first AC-ROT Leaf and the second AC-ROT Leaf are generated using an AC-ROT Root.
19. The SOC of claim 18 , wherein the AC-ROT Root operates as a certificate of authority to generate a first certificate chain associated with the first AC-ROT Leaf and a second certificate chain associated with the second AC-ROT Leaf.
20. The SOC of claim 19 , wherein the security engine verifies the identity of the first sub-socket via the first AC-ROT Leaf and verifies the identity of the second sub-socket via the second AC-ROT Leaf.