Secure reporting of platform state information to a remote server
Technologies disclosed herein provide a method for receiving at a device from a remote server, a request for state information from a first processor of the device, obtaining the state information from one or more registers of the first processor based on a request structure indicated by a first instruction of a software program executing on the device, and generating a response structure based, at least in part, on the obtained state information. The method further includes using a cryptographic algorithm and a shared key established between the device and the remote server to generate a signature based, at least in part, on the response structure, and communicating the response structure and the signature to the remote server. In more specific embodiments, both the response structure and the request structure each include a same nonce value.
1. At least one non-transitory machine readable medium comprising one or more instructions of a software program stored thereon, the one or more instructions when executed by one or more processors cause the one or more processors to:
receive, from a remote server, a request for state information from a first processor;
obtain the state information from one or more registers in the first processor based on a request structure indicated by a first instruction of the one or more instructions and on a first privilege level associated with the first instruction that is higher than a second privilege level of the software program, wherein the first privilege level is to permit the first instruction of the one or more instructions to access the state information in the one or more registers, and wherein the second privilege level of the software program is to prevent other instructions of the one or more instructions in the software program from accessing the state information in the one or more registers;
generate a response structure based, at least in part, on the obtained state information;
generate a signature based, at least in part, on the response structure, a cryptographic algorithm, and a shared key established between the one or more processors and the remote server; and
communicate the response structure and the signature to the remote server.
2. The at least one non-transitory machine readable medium of claim 1 , wherein the response structure and the request structure each include a same nonce value.
3. The at least one non-transitory machine readable medium of claim 1 , wherein the first instruction, when executed by the one or more processors, causes the one or more processors to:
identify a first memory address included in the first instruction; and
locate the request structure at the first memory address in a memory element.
4. The at least one non-transitory machine readable medium of claim 1 , wherein the one or more instructions, when executed by the one or more processors, cause the one or more processors to:
communicate, to the remote server, the request structure with the response structure and the signature.
5. The at least one non-transitory machine readable medium of claim 4 , wherein the first instruction, when executed by the one or more processors, causes the one or more processors to
identify a second memory address included in the first instruction; and
store a state information report at the second memory address in a memory element, the state information report including the response structure, the signature, and the request structure.
6. The at least one non-transitory machine readable medium of claim 1 , wherein the first instruction, when executed by the one or more processors, causes the one or more processors to:
identify a field in a first register of the one or more registers, the field indicated in the request structure; and
obtain a value from the identified field in the first register, wherein the response structure is generated based, at least in part, on the value from the identified field in the first register.
7. The at least one non-transitory machine readable medium of claim 1 , wherein the second privilege level of the software program is a ring 3 privilege level.
8. The at least one non-transitory machine readable medium of claim 1 , wherein the first privilege level associated with the first instruction is a ring 0 privilege level.
9. The at least one non-transitory machine readable medium of claim 1 , wherein the request structure includes a bitmask corresponding to a plurality of fields in the one or more registers.
10. The at least one non-transitory machine readable medium of claim 1 , wherein the first instruction is a read-only instruction.
11. The at least one non-transitory machine readable medium of claim 1 , wherein:
subsequent to communicating the response structure and the signature to the remote server, the software program is to be blocked from execution by the one or more processors in response to the remote server failing to verify the signature.
12. A system, comprising:
a computing platform including:
one or more memory elements storing a software program including one or more instructions for execution; and
one or more processors to execute the one or more instructions to:
receive, from a remote server, a request for state information;
obtain the state information from at least one register in the computing platform based on a request structure indicated by a first instruction of the one or more instructions and on a first privilege level associated with the first instruction that is higher than a second privilege level of the software program, wherein the first privilege level is to permit the first instruction of the one or more instructions to access the state information in the at least one register, and wherein the second privilege level of the software program is to prevent other instructions of the one or more instructions in the software program from accessing the state information in the at least one register;
generate a response structure based, at least in part, on the obtained state information;
generate a signature based, at least in part, on the response structure, a cryptographic algorithm, and a shared key established between the computing platform and the remote server; and
send the response structure and the signature to the remote server.
13. The system of claim 12 , wherein the response structure and the request structure each include a same nonce value.
14. The system of claim 12 , wherein the one or more processors are to execute the one or more instructions to further:
communicate the request structure to the remote server with the response structure and the signature.
15. The system of claim 12 , wherein the one or more processors are to execute the one or more instructions to further:
identify a field in a first register of the computing platform, the field indicated in the request structure; and
obtain a value from the identified field in the first register, wherein the response structure is generated based, at least in part, on the value from the identified field in the first register.
16. The system of claim 12 , wherein the second privilege level of the software program is a ring 3 privilege level and the first privilege level associated with the first instruction is a ring 0 privilege level.
17. The system of claim 12 , wherein the state information includes one or more of configuration information of the computing platform and current operational information of the computing platform.
18. A method, comprising:
receiving by a software program executing in an untrusted privilege level on a computing platform of a device, from a remote server, a request for state information from a first processor of the device;
obtaining the state information from one or more registers of the first processor based on a request structure indicated by a first instruction of the software program, wherein the untrusted privilege level in which the software program executes is lower than a trusted privilege level associated with the first instruction, wherein the trusted privilege level permits the first instruction of the software program to access the state information in the one or more registers, and wherein the untrusted privilege level of the software program prevents other instructions in the software program from accessing the state information in the one or more registers;
generating a response structure based, at least in part, on the obtained state information;
using a cryptographic algorithm and a shared key established between the device and the remote server to generate a signature based, at least in part, on the response structure; and
communicating the response structure and the signature to the remote server.
19. The method of claim 18 , wherein the response structure and the request structure each include a same nonce value.
20. The method of claim 18 , wherein the software program executes in a ring 3 privilege level and the first instruction is executable in a ring 0 privilege level.