Patent Application
20080005574
Embodiments of the invention are illustrated by way of example and not by way of limitation in the figures of the accompanying drawings in which like references indicate similar elements. It should be noted that references to “an” or “one” embodiment in this disclosure are not necessarily to the same embodiment, and such references mean “at least one.”
Embodiments of the invention alter the normal reset sequence of a programmable processor to include computing a cryptographic hash or digest of the first user code module to be executed, before the processor begins executing the code. If the user code initializes a security auditing system, the processor automatically incorporates the previously-computed cryptographic hash into the auditing system.
In this specification, “user code” and “user instructions” refer to instructions for the programmable processor that are not hard-coded or otherwise fixed in the processor. For example, the Pentium® line of microprocessors produced by the Intel Corporation of Santa Clara, Calif. begin running after a reset by loading and executing an instruction located at memory address $FFFFFFF0. This instruction is usually stored in a read-only memory (“ROM”) or other non-volatile memory (e.g. Flash memory) and is part of the basic input-output system (“BIOS”); in other contexts, it may be considered a “system” instruction. However, it is the first instruction that can be specified by a user of the microprocessor, and for the purposes of embodiments of the present invention, is the first user instruction. Note that some microprocessors (often known as “microcontrollers”) include internal configurable and/or programmable memory where a software developer can store instructions, so the first user instruction may not be stored in a memory that is physically separated from the processor.
User instructions are different from another type of instruction that is only used within the processor itself. An example of the other type of instruction is called a “micro instruction” or a “microcode instruction.38 This type of instruction may be design-specific to each processor, and does not necessarily adhere to any architectural particular software instruction set. Microcode instructions are used to perform housekeeping tasks of the processor (for example, reset initialization processing). A sequence of microcode instructions may also be used to implement a complex user instruction. However, microcode instructions are frequently undocumented, and are not available for direct use by a programmer. The key difference between user instructions and microcode instructions (or more generally, “non-user instructions”) is that user instructions permit users of the processor to direct its activities, while non-user instructions are only available for use by the processor manufacturer.
There is one wrinkle to this distinction that must be noted. Some processors provide a mechanism for user instructions to load new, different or supplemental microcode. This mechanism might be used to correct logic errors in the processor hardware or as-shipped microcode. The mechanism is invoked by executing particular system-control user instructions, and the new microcode may change the way the processor behaves. However, supplemental microcode is generally lost after a processor reset or power cycle, so the manufacturer's original microcode runs when the processor is rebooted. In any event, a user instruction is required to initiate the microcode update, and embodiments of the invention operate before the first user instruction is executed, so any loading of supplemental microcode happens only after logic implementing a portion of an embodiment has had the opportunity to carry out its functions.
PCR extension methods are designed to be irreversible and the result is unique: if the cryptographic algorithms are unbroken, the chance for finding an input that, when incorporated into a PCR, causes the PCR value to become a chosen target value, is no greater than a pure random chance. Platform security schemes can be built around this property as shown in
This system works well, but can be subverted by attacking the first module in the chain. This is typically the first user code to execute after a system reset (or after “waking up” following a dormant “sleep” period). This code is frequently stored in a non-volatile memory such as a read-only memory (“ROM”), an [electrically] eraseable, programmable, read-only memory (“[E]EPROM”), or a Flash memory, and is often referred to as the basic input-output system or “BIOS.” Attacks exploiting this weakness have been seen in real-world systems.
An embodiment of the invention tightens the security of the TPM system and thwarts many attacks by operating as shown in
At this point, a prior-art microprocessor might retrieve a first user instruction located at a predetermined address in memory (or alternatively, retrieve a pointer or “vector” at a predetermined address, and then load the first user instruction from the pointed-to address) and execute the instruction. However, according to an embodiment of the invention, the processor locates a block of memory (425) including its address and length, then fetches data from the block (430) and computes a cryptographic hash of the data (435). The hash may be computed according to a Secure Hash Algorithm (“SHA”), a Message Digest (“MD”) algorithm, or other suitable cryptographically secure, one-way hash algorithm supported by the TPM. Operations 425, 430 and 435 are performed without retrieving and/or executing any user instructions from a user memory. In many embodiments, these operations are performed under the control of microcode instructions (or state machines) built into the processor itself, although dedicated hardware circuits may be provided to iteratively load the bytes of data in the block of memory and compute the cryptographic hash.
After the hash is computed, the processor begins executing user instructions by loading the first user instruction at a predetermined address in memory (440) and executing it (445). Execution of user instructions continues in the ordinary manner.
Later, a user instruction may initialize a Trusted Platform Module (“TPM”) in the system (450). An embodiment of the invention detects the initialization and, if the initialization was to put the TPM in a clear state (455), a platform configuration register (“PCR”) is extended with the previously-computed hash (460). (In other words, the previously-computed hash is measured into the PCR.) If the user instruction initializes the TPM to a non-clear state (as might occur if the system was recovering from a sleep period and the TPM was to be initialized to its pre-sleep condition), the hash of the boot block may be discarded (465).
The block of memory located and hashed as described above may be a “boot block,” as shown in
An embodiment of the invention may be a machine-readable medium having stored thereon instructions which cause a programmable processor to perform operations as described above. In other embodiments, the operations might be performed by specific hardware components that contain hardwired logic. Those operations might alternatively be performed by any combination of programmed computer components and custom hardware components.
A machine-readable medium may include any mechanism for storing or transmitting information in a form readable by a machine (e.g., a computer), including but not limited to Compact Disc Read-Only Memory (CD-ROM), Read-Only Memory (ROM), Random Access Memory (RAM), and Erasable Programmable Read-Only Memory (EPROM).
The applications of the present invention have been described largely by reference to specific examples and in terms of particular allocations of functionality to certain hardware and/or software components. However, those of skill in the art will recognize that a security scheme that moves the root of a trust chain into a programmable processor can also be constructed with software and hardware that distribute the functions of embodiments of this invention differently than herein described. Such variations and implementations are understood to be captured according to the following claims.
