System and method for high performance secure access to a trusted platform module on a hardware virtualization platform
A system and method for high performance secure access to a trusted platform module on a hardware virtualization platform. The virtualization platform including Virtual Machine Monitor (VMM) managed components coupled to the VMM. One of the VMM managed components is a TPM (Trusted Platform Module). The virtualization platform also includes a plurality of Virtual Machines (VMs). Each of the virtual machines includes a guest Operating System (OS), a TPM device driver (TDD), and at least one security application. The VMM creates an intra-partition in memory for each TDD such that other code and information at a same or higher privilege level in the VM cannot access the memory contents of the TDD. The VMM also maps access only from the TDD to a TPM register space specifically designated for the VM requesting access. Contents of the TPM requested by the TDD are stored in an exclusively VMM-managed protected page table that provides hardware-based memory isolation for the TDD.
1. A startup method for a virtual platform comprising:
after power on of the platform, measuring a BIOS (Basic Input/Output System) and a Virtual Machine Monitor (VMM), wherein after being measured, the VMM to:
establish a plurality of Virtual Machines (VMs), each of the plurality of VMs identified by a Virtual Machine Identification (VMID);
load measured extension security services;
load a separate guest operating system (OS) in each of the plurality of VMs;
program Trusted Platform Module (TPM) access control hardware to partition TPM registers into a plurality of subsets of the TPM registers, each subset of the TPM registers: (i) being assigned to a separate VM using the VMID of the corresponding VM for dedicated access thereto and (ii) having a location identified by a separate Execution Instruction Pointer (EIP) field; and
transfer control to the guest operating systems, wherein each guest operating system, after discovery of a TPM, loads a TPM device driver (TDD) program, wherein a TPM device driver (TDD) is registered with an integrity services device, wherein if the TDD passes an integrity check, a protected page table (PPT) is created for the TDD, TDD data and code is moved into the PPT, and a specific subset of the plurality of the TPM registers is accessible to the integrity checked TDD using the EIP and the VMID of the VM in which the guest operating system is loaded.
2. The method of claim 1 , wherein the VMM programs the TPM to appear as a device with n Platform Configuration Registers (PCRs) for each operating system, wherein n represents the number of PCRs the TPM supports divided by the number of VMs to be supported.
3. An article comprising: a storage medium having a plurality of machine accessible instructions, wherein when the instructions are executed by a processor, the instructions provide for:
after power on of a platform, measuring a BIOS (Basic Input/Output System) and a Virtual Machine Monitor (VMM), wherein after being measured, the VMM to:
establish a plurality of Virtual Machines (VMs), each of the plurality of VMs identified by a Virtual Machine Identification (VMID);
load measured extension security services;
load a separate guest operating system (OS) in each of the plurality of VMs;
program Trusted Platform Module (TPM) access control hardware to partition TPM registers into a plurality of subsets of the TPM registers, each subset of the TPM registers: (i) being assigned to a separate VM using the VMID of the corresponding VM for dedicated access thereto and (ii) having a location identified by a separate Execution Instruction Pointer (EIP) field; and
transfer control to the guest operating systems, wherein each guest operating system, after discovery of a TPM, loads a TPM device driver (TDD) program, wherein a TPM device driver (TDD) is registered with an integrity services device, wherein if the TDD passes an integrity check, a protected page table (PPT) is created for the TDD, TDD data and code is moved into the PPT, and a specific subset of the plurality of subsets of the TPM registers is accessible to the integrity checked TDD using the corresponding EIP and the VMID of the VM in which the guest operating system is loaded.
4. The article of claim 3 , wherein the VMM programs the TPM to appear as a device with n Platform Configuration Registers (PCRs) for each operating system, wherein n represents the number of PCRs the TPM supports divided by the number of VMs to be supported.