System and method for implementing a trusted dynamic launch and trusted platform module (TPM) using secure enclaves
An apparatus and method are described for implementing a trusted dynamic launch and trusted platform module (TPM) using a secure enclave. For example, a computer-implemented method according to one embodiment of the invention comprises: initializing a secure enclave in response to a first command, the secure enclave comprising a trusted software execution environment which prevents software executing outside the enclave from having access to software and data inside the enclave; and executing a trusted platform module (TPM) from within the secure enclave, the trusted platform module securely reading data from a set of platform control registers (PCR) in a processor or chipset component into a memory region allocated to the secure enclave.
1. A processor comprising:
a platform control register (pPCR);
a memory device to store a protected page cache for a secure enclave, the secure enclave comprising a trusted execution environment to prevent external access to software and data within the secure enclave, the secure enclave to execute a trusted platform module (TPM) to securely read data from the pPCR into the memory; and
logic to store processor values including:
an owner epoch value;
a platform unique key; and
attestation primitives.
2. The processor as in claim 1 , wherein the memory device provides a physically contiguous range of memory addresses reserved for the processor.
3. The processor as in claim 1 further comprising:
flags register to store architecture state for the processor.
4. The processor as in claim 1 , wherein the TPM includes a software-based platform control register (tPCR) to temporarily store data read from the pPCR register.
5. The processor as in claim 1 , wherein the secure enclave is allocated a memory region including non-volatile memory.
6. The processor as in claim 3 , wherein the flags register and the logic are used to generate a root key to encrypt data for the trusted platform module.
7. The processor as in claim 3 , wherein the attestation primitives include a set of measurement registers (MRs), at least one of the MRs to provide a measurement of code and data contained in the secure enclave.
8. The processor as in claim 4 , wherein the tPCR and pPCR are configured to extend using hash values via a cryptographic hash of a value to be written and a previously stored value.
9. The processor as in claim 7 , wherein at least one of the MRs to provide a measurement of a public key used to sign the measurement of the enclave.
10. The processor as in claim 9 , wherein the attestation primitives further comprise a platform attestation key used to sign data within the MRs to verify that the enclave was built on a computing platform associated with the processor.
11. An apparatus comprising:
a processor including a memory device to store a protected page cache for a secure enclave, the secure enclave comprising a trusted execution environment to prevent external access to software and data within the secure enclave, the secure enclave to execute a trusted platform module (TPM) to securely read data from a platform control register (pPCR) of the processor into the memory device; and
logic to store processor values including: an owner epoch value; a platform unique key; and attestation primitives.
12. The apparatus as in claim 11 , wherein the memory device is an on-die memory device configured to provide a physically contiguous range of memory to the processor.
13. The apparatus as in claim 11 , wherein the memory device is reserved for processor use.
14. The apparatus as in claim 11 , wherein the memory device is embedded dynamic random access memory (eDRAM) or static random access memory (SRAM).
15. A system comprising:
a memory device coupled with a bus;
a memory encryption engine (MEE) to create a cryptographically protected region in the memory device;
a processor coupled to the bus, the processor including a secure enclave comprising a trusted execution environment to prevent external access to software and data within the secure enclave, the secure enclave to execute a trusted platform module (TPM) to securely read data from a platform control register (pPCR) of the processor into the cryptographically protected region in the memory device; and
logic to store processor values including: an owner epoch value; a platform unique key; and attestation primitives.
16. The system as in claim 15 further comprising an agent coupled with the bus and the MEE to recognize a memory access to the MEE and route the access to a cryptographic controller.
17. The system as in claim 15 , wherein the cryptographically protected region includes a protected page cache for the secure enclave.
18. The system as in claim 16 , wherein the cryptographic controller to generate one or more accesses to the memory device to fetch data from the cryptographically protected region.
19. The system as in claim 17 , wherein the protected page cache is a physically contiguous range of memory reserved for use by the processor.
20. The system as in claim 17 , wherein the protected page cache includes multiple sections, each section having an associated security level.
21. The system as in claim 18 , wherein the cryptographic controller is further to decrypt the data from the cryptographically protected region to satisfy the memory access to the MEE.
22. The system as in claim 20 , wherein the associated security level includes one of confidentiality protected and replay protected.
23. The system as in claim 22 , wherein the processor additionally includes a monotonic counter to prevent anti-replay attacks on protected data and the TPM is further to virtualize the monotonic counter.