Low cost trusted platform
A method and apparatus is described herein for emulating a physical trusted platform module (TPM) in a virtual monitor, such as a system management mode (SMM) or a system management interrupt (SMI) transfer monitor (STM). By allowing SMIs during a secure launch, SMM is allowed into the secure launch trust perimeter and a virtual monitor may emulate the structures, behaviors, and protected storage of a physical TMP, such as the storage of cryptographic keys, secure verification, attestation, and other TPM functions.
1. A method comprising:
generating a system management interrupt (SMI) during a secure launch of a computer system; and
initializing, in response to the SMI, a stand-alone trusted platform module (TPM) emulator, which is to include at least one protected secret, in a virtual monitor during the secure launch;
issuing a TPM ordinal;
emulating a command stream of the TPM ordinal in the virtual monitor; and
handling the command stream of the TPM ordinal in the virtual monitor.
2. The method of claim 1 , wherein the virtual monitor is selected from a group consisting of a system management monitor (SMM), a SMI transfer monitor (STM), and a virtual machine monitor (VMM).
3. The method of claim 1 , wherein initializing the stand-alone TPM emulator in the virtual monitor comprises:
attesting a system configuration based on platform configuration register values stored in a protected segment of a nonvolatile memory, the nonvolatile memory also to store boot-software.
4. The method of claim 3 , wherein initializing the stand-alone TPM emulator in the virtual monitor further comprises
storing a first key in a protected memory range of a system memory associated with the virtual monitor;
generating a second key; and
storing the second key in the protected memory range associated with the virtual monitor.
5. The method of claim 4 wherein each of the first and the second keys is selected from a group consisting of a public key, a private key, an endorsement key, an attestation identity key (AIK), a storage root key, an encryption key, a signing key, and an endorsement credential key.
6. The method of claim 3 , wherein the nonvolatile memory and boot-software are part of an extensible firmware interface (EFI) framework.
7. The method of claim 1 , wherein the stand-alone TPM emulator handles commands issued to a TPM memory space.
8. A storage device including program code which, when executed by a machine, causes the machine to perform the operations of:
initializing a machine state register (MSR) to generate a system management interrupt (SMI) in response to a secure instruction event; and
emulating a stand-alone trusted platform module (TPM) in a protected range of system memory in response to generating the SMI, wherein the protected range of memory is at least partially overlapping with a range of memory associated with a virtual monitor, the virtual monitor being selected from a group consisting of a system management monitor (SMM), a SMI transfer monitor (STM), and a virtual machine monitor (VMM).
9. The storage device of claim 8 , further comprises:
allowing the SMI to be generated during a secure launch of the machine.
10. The storage device of claim 8 , wherein the secure instruction is a secure-enter (SENTER) instruction.
11. The storage device of claim 8 , wherein the secure instruction is a secure initialization instruction.
12. The storage device of claim 8 , wherein emulating the stand-alone TPM in the protected range of system memory comprises:
emulating a TPM structure in the protected range of system memory, the TPM structure being selected from a group consisting of, a user key hierarchy, a platform configuration register (PCR), a monotonic counter, a data integrity register, an endorsement key, an attestation identity key (AIK), a storage root key, an encryption key, a signing key, and an endorsement credential key.
13. A system comprising:
a nonvolatile memory to store boot-code, the nonvolatile memory having a secure portion to store cryptographic information;
a system memory to include a range of memory associated with a virtual monitor, the range of memory further to hold stand-alone trusted platform module (TPM) emulator code to perform cryptographic operations on at least the cryptographic information; and
a controller hub coupled to the nonvolatile memory, the system memory, and a microprocessor, wherein the microprocessor is adapted to operate in a virtual monitor mode to execute the stand-alone TPM emulator code from the protected range of memory, wherein the microprocessor is also to issue a TPM ordinal, wherein the TPM ordinal references the range of memory associated with the stand-alone trusted platform module (TPM) emulator code.
14. The system of claim 13 , wherein the cryptographic information is selected from a group consisting of a platform configuration value, a private key, a public key, an endorsement key, an attestation identity key (AIK), a storage root key, an encryption key, a signing key, and an endorsement credential key.
15. The system of claim 13 , wherein
the cryptographic information includes a first hash value based on a previous system configuration, and wherein
the cryptographic operations include
determining a second hash value, upon booting the system, based upon a current system configuration, and
comparing the first and second hash values to determine if the system configurations match.
16. The system of claim 13 , wherein the cryptographic operations are selected from a group consisting of data protection, hashing, sealing an internally generate asymmetric key pair to a particular computing platform, signing information with a private key, and signing information with a public key.
17. The system of claim 13 , wherein upon detecting the issue of the TPM ordinal, the microprocessor is to execute the stand-alone TPM emulator code to handle the TPM ordinal.
18. The system of claim 13 , wherein the virtual monitor is selected from a group consisting of a system management monitor (SMM), a SMI transfer monitor (STM), and a virtual machine monitor (VMM).