System, apparatus and method for secure monotonic counter operations in a processor
In one embodiment, an apparatus includes: at least one core to execute instructions, the at least one core formed on a semiconductor die; a first memory formed on the semiconductor die, the first memory comprising a non-volatile random access memory, the first memory to store a first entry to be a monotonic counter, the first entry including a value field and a status field; and a control circuit, wherein the control circuit is to enable access to the first entry if the apparatus is in a secure mode and otherwise prevent the access to the first entry. Other embodiments are described and claimed.
1. At least one non-transitory computer readable storage medium comprising instructions that when executed enable a system to:
responsive to receipt of a request from a requester to update a monotonic counter of a processor, determine whether the processor is in a first security mode;
when it is determined that the processor is in the first security mode, access, via logic of the processor, the monotonic counter using an identifier associated with the request, the logic to index into a table of monotonic counters with the identifier to access the monotonic counter;
increment, via the logic, a value of the monotonic counter;
output, via the logic, the value of the monotonic counter to the requester; and
encrypt the monotonic counter and send the encrypted monotonic counter to a second computing system, responsive to a request to provide secure content to the second computing system, the monotonic counter associated with the secure content.
2. The at least one non-transitory computer readable storage medium of claim 1 , further comprising instructions that when executed enable the system to prevent the access to the monotonic counter when it is determined that the processor is not in the first security mode, wherein the requester is an agent to execute in the first security mode.
3. The at least one non-transitory computer readable storage medium of claim 1 , further comprising instructions that when executed enable the system to:
determine, after the increment to the value of the monotonic counter, whether the value of the monotonic counter has rolled over; and
responsive to the rollover of the value of the monotonic counter, set a rollover indicator in a status field included in the monotonic counter.
4. The at least one non-transitory computer readable storage medium of claim 1 , further comprising instructions that when executed enable access to the secure content if the value of the monotonic counter has not met a policy threshold, and otherwise to prevent the access to the secure content.
5. The at least one non-transitory computer readable storage medium of claim 1 , further comprising instructions that when executed enable the secure content and the encrypted monotonic counter to be sent to the second computing system, based at least in part on a license associated with the secure content.
6. The at least one non-transitory computer readable storage medium of claim 1 , wherein the request comprises an instruction set architecture instruction.
7. At least one non-transitory computer readable storage medium comprising instructions that when executed enable a system to:
responsive to receipt of a request from a requester to update a monotonic counter of a processor, determine whether the processor is in a first security mode;
when it is determined that the processor is in the first security mode, access, via logic of the processor, the monotonic counter using an identifier associated with the request, the logic to index into a table of monotonic counters with the identifier to access the monotonic counter;
increment, via the logic, a value of the monotonic counter;
output, via the logic, the value of the monotonic counter to the requester; and
update the monotonic counter when a user enters or exits a geo fence.
8. A method comprising:
responsive to receipt of a request from a requester to update a monotonic counter of a processor, determining whether the processor is in a first security mode;
when it is determined that the processor is in the first security mode, accessing, via logic of the processor, the monotonic counter using an identifier associated with the request, the logic to index into a table of monotonic counters with the identifier to access the monotonic counter;
incrementing, via the logic, a value of the monotonic counter;
outputting, via the logic, the value of the monotonic counter to the requester;
accessing secure content if the value of the monotonic counter has not met a policy threshold, and otherwise preventing the access to the secure content, the monotonic counter associated with the secure content; and
encrypting the monotonic counter and sending the encrypted monotonic counter to a second computing system, responsive to a request to provide the secure content to the second computing system.
9. The method of claim 8 , further comprising preventing the access to the monotonic counter when it is determined that the processor is not in the first security mode, wherein the requester is an agent to execute in the first security mode.
10. The method of claim 8 , further comprising:
determining, after the increment to the value of the monotonic counter, whether the value of the monotonic counter has rolled over; and
responsive to the rollover of the value of the monotonic counter, setting a rollover indicator in a status field included in the monotonic counter.
11. The method of claim 8 , further comprising enabling the secure content and the encrypted monotonic counter to be sent to the second computing system, based at least in part on a license associated with the secure content.
12. The at least one non-transitory computer readable storage medium of claim 7 , wherein the request comprises an instruction set architecture instruction.