Dynamically loaded measured environment for secure code launch
A “Secure Code Launcher” establishes platform trustworthiness, i.e., a trusted computing base (TCB), and uses hardware or firmware based components to securely launch one or more software components. The Secure Code Launcher measures and loads software components by interfacing with security extension functionality integral to one or more hardware or firmware-based components in the computing device. For example, various embodiments of the Secure Code Launcher include firmware-based components that interface with security extension functionality integral to the computing device to measure and load boot managers, operating system (OS) loaders, or other OS components including OS kernels. Similarly, the Secure Code Launcher is capable of measuring and loading software components responsible for installing an instance of an OS. In addition, various embodiments of the Secure Code Launcher provide a hypervisor loader that measures and loads a hypervisor which in turn measures and loads operating system components including virtual machines.
1. A method for providing secure program launch, comprising:
instantiate an event handler in a pre-boot environment of the computing device;
instantiate a boot initializer in the pre-boot environment of the computing device;
using the event handler to intercept software load commands issued by the boot initializer;
for each intercepted load command, initiating a software measurement of a corresponding software component; and
following each measurement, performing a secure program launch of the corresponding measured software component.
2. The method of claim 1 wherein the software measurement is performed by causing the event handler to initiate a Dynamic Root of Trust for Measurement (DRTM) event.
3. The method of claim 2 wherein each DRTM event makes use of a security extension of a processor of the computing device to perform the software measurement.
4. The method of claim 2 wherein each DRTM event loads the corresponding software component to protected memory of the computing device and causes a trusted platform module of the computing device to compute a hash sequence for the software component.
5. The method of claim 1 wherein the event handler and boot initializer are instantiated by a firmware component of the computing device.
6. The method of claim 5 wherein the firmware component of the computing device is untrusted.
7. The method of claim 1 wherein the boot initializer is allowed to continue boot operations on the computing device following secure program launch of the measured software components.
8. The method of claim 1 wherein the boot initializer is used to measure and perform secure program launch of a hypervisor called by the boot initializer.
9. The method of claim 8 wherein the computing device contains two or more processor cores, and wherein a separate hypervisor is measured and securely launched for two or more the processor cores.
10. The method of claim 1 wherein the event handler is used to measure and perform secure program launch of an operating system kernel called by the boot initializer.
11. A system for measuring software in a pre-boot environment, comprising:
a computing device having firmware for initiating a pre-boot environment;
an event handler device for intercepting software load commands issued by a boot initializer in the pre-boot environment;
a measurement device for initiating a measurement of a software component corresponding to each intercepted software load command; and
a device for performing a secure program launch of each measured software component.
12. The system of claim 11 wherein each software measurement is performed by initiating a Dynamic Root of Trust for Measurement (DRTM) event that makes use of security extension functionality of a processor of the computing device.
13. The system of claim 12 wherein each DRTM event loads the corresponding software component to protected memory of the computing device and causes a trusted platform module of the computing device to compute a hash sequence for the software component.
14. The system of claim 11 wherein the firmware of the computing device is untrusted.
15. The system of claim 11 wherein the boot initializer is allowed to continue boot operations on the computing device following secure program launch of the measured software components.
16. The system of claim 11 wherein the computing device contains two or more processor cores, and wherein a separate hypervisor software component is measured and securely launched for two or more the processor cores.
17. A computer-readable storage device having computer executable instructions stored therein, said instructions causing a computing device to perform actions comprising:
causing firmware of a computing device to initiate a pre-boot environment on the computing device;
instantiating a driver module having an event handler into protected memory of the computing device;
instantiating a boot initializer into protected memory of the computing device;
using the event handler of the driver module to intercept software load commands issued by the boot initializer;
for each intercepted load command, using the driver module to initiate a software measurement of a corresponding software component; and
following each measurement, performing a secure program launch of the corresponding measured software component.
18. The computer-readable storage device of claim 17 wherein each software measurement is performed by initiating a Dynamic Root of Trust for Measurement (DRTM) event that makes use of security extension functionality of a processor of the computing device.
19. The computer-readable storage device of claim 18 wherein each DRTM event loads the corresponding software component into protected memory of the computing device and causes a trusted platform module of the computing device to compute a hash sequence for the software component.
20. The computer-readable storage device of claim 17 wherein the computing device contains two or more processor cores, and wherein a separate hypervisor software component is measured and securely launched for two or more the processor cores.