Patent Application
20080148387
The Trusted Computing Group (TCG) develops and promotes industry standard specifications for hardware-enabled trusted computing and security technologies such as a trusted platform module (TPM). A TPM enables secure storage of digital keys, certificates and passwords and is less vulnerable to software and hardware attacks. However, country-specific and/or other types of restrictions may prohibit using computing systems having TPMs disposed thereon. Although computing systems may be specially manufactured to accommodate and/or comply with such restrictions, building and tracking these specially-manufactured computing systems during the manufacturing process, and thereafter, is costly.
For a more complete understanding of the present invention and the advantages thereof, reference is now made to the following descriptions taken in connection with the accompanying drawings in which:
The preferred embodiments of the present invention and the advantages thereof are best understood by referring to
In the embodiment illustrated in
Embodiments of system 10 enable a setting to be applied or set for TPM 14 to indicate TPM 14 as either being available (e.g., able to be used and/or otherwise accessed for use thereof by OS 30 and/or various applications 32) or hidden (e.g., unavailable and/or otherwise reported to OS 30 as not being present on computing system 12 so that OS 30 and/or applications 32 cannot readily access and/or use TPM 14). In the embodiment illustrated in
In operation, preferably during manufacturing or building of computing system 12 (e.g., before computing system 12 is delivered to a consumer), utility interface 44 is used to set the state of TPM 14 as being either hidden or available. In the embodiment illustrated in
Status flag 52 is used to indicate whether a hidden or available setting for TPM 14 has been selected through utility interface 44 (e.g., selected or set as either being hidden or available). Preferably, an available setting for TPM 14 is used as a default setting. Thus, if utility interface 44 is not used to select or apply a particular setting to TPM 14, the setting for TPM 14 remains as being available. However, in response to receiving a call or command from utility interface 44 to set TPM 14 thereafter as being either hidden or available, status flag 52 is set to “YES.” Status flag 52 is used to prevent subsequent changes to the setting applied to TPM 14. For example, in response to receiving a subsequent call or command from utility interface 44 for applying a setting for TPM 14, BIOS 24 determines whether status flag 52 has been set to “YES.” If status flag 52 has been set to “YES,” BIOS 24 rejects the call and/or otherwise generates an error message, thereby preventing a subsequent change to the setting applied to TPM 14. Accordingly, utility interface 44 is preferably used during manufacturing or building of computing system 12 to apply either a hidden or available setting to TPM 14 such that, once applied, the setting is not thereafter readily changeable by a consumer.
During booting of computing system 12 (e.g., in response to a power-on event or wake event from a hibernation, sleep or other type of reduced-power mode), BIOS 24 determines whether hide/available flag 50 is set to “YES,” thereby indicating a hidden or unavailable status setting for TPM 14. In the embodiment illustrated in
Further, in response to BIOS 24 determining that a hidden setting has been applied to TPM 14, BIOS 24 disables and/or otherwise prevents display of any TPM menu data 60 associated with TPM 14. For example, because TPM 14 is present in computing system 12, BIOS 24 generally comprises provides an interface to enable various options and/or settings associated with TPM 14 to be applied and/or otherwise configured, such as through BIOS 24 setup in the form of TPM menu data 60. Embodiments of system 10 disable and/or otherwise prevent display of TPM menu data 60 in response to detecting a hidden setting of TPM 14.
BIOS 24 is preferably configured to interface with OS 30 to report to OS 30 a lack of presence of TPM 14 on computing system 12 if the setting of TPM 14 is set to hidden. For example, in some embodiments, BIOS 24 uses a status method of reporting the presence and resources of various devices of computing system 12 to OS 30 through ACPI namespace. BIOS 24 is preferably configured to, in response to detecting a hidden setting for TPM 14, indicate to OS 30 a lack of presence of TPM 14 on computing system 12. Thus, based on the status reporting received from BIOS 24 indicating a lack of presence of TPM 14, OS 30 does not load any drivers associated with TPM 14, thereby preventing OS 30 and/or applications 32 from accessing and/or otherwise interfacing with TPM 14. However, it should be understood that in some embodiments, BIOS 24 is configured to also refrain from performing particular configuration settings/requests and/or refrain from enabling particular hardware resources necessary for the function and/or use of TPM 14.
Thus, in operation, utility interface 44 is used to apply and/or otherwise designate a setting for TPM 14 as being either hidden or available. After a desired setting is applied and/or otherwise designated, status flag 52 is used to indicate that a desired setting has been applied to TPM 14 to prevent a subsequent change to the setting. Thus, after either a hidden or available setting has been applied to TPM 14, the interface to change the setting of TPM 14 is essentially locked. Thus, in operation, if a hidden setting has been applied to TPM 14, a user or administrator of computing system 12 cannot generally thereafter change the setting for TPM 14 to being available.
At block 202, utility interface 44 is accessed for computing system 12. At block 204, utility interface 44 transmits a call or command to BIOS 24 to set the state of TPM 14 as being either hidden or available. At decisional block 206, a determination is made by BIOS 24 whether status flag 52 has been set to “YES.” If status flag 52 has been set to “YES” (e.g., indicating that a hidden/available setting has already been applied or set for TPM 14), the method proceeds to block 208, where BIOS 24 rejects the call or command and/or otherwise generates an error message, thereby preventing any further change to the TPM 14 setting. If at decisional block 206 it is determined that status flag 52 has not been set to “YES,” the method proceeds to block 210, where a desired setting for TPM 14 is received. Preferably, hide/available flag 50 is set to “NO” as a default setting, thereby indicating availability of TPM 14. However, it should be understood that a default setting for TPM 14 may be otherwise configured. In response to receiving a setting to apply to TPM 14, at block 212, BIOS 24 sets the new value of the hide/available flag 50 and sets the status flag 52 to “YES,” thereby indicating that a setting for TPM 14 has been selected, and the method ends.
At block 312, BIOS 24 locks the state of TPM 14. At block 314, BIOS 24 disables and/or otherwise prevents presentation of TPM-related menus such as TPM menu data 60 associated with setup access of BIOS 24. At block 316, BIOS 24 reports to OS 30 a lack of presence of TPM 14 on computing system 12. Thus, in response to receiving a report of a lack of presence TPM 14 on computing system 12, OS 30 does not load any drivers associated with TPM 14, thereby preventing access to an/or use of TPM 14.
Thus, embodiments system 10 enable a TPM disposed on a computing system to be set as hidden or unavailable, thereby preventing access and/or use of the TPM by an operating system and/or other applications residing on the computing system. Further, embodiments of system 10 enable using a particular motherboard configuration for a computing system (e.g., one having a TPM) to be used across different markets and/or geographical consumer areas while accommodating any TPM-related restrictions.
