Secure boot processor with embedded NVRAM

Patent metadata

Field	Value
Publication number	US-10878100-B2
Application number	US-201816162935-A
Country	US
Kind code	B2
Filing date	Oct 17, 2018
Priority date	Oct 17, 2018
Publication date	Dec 29, 2020
Grant date	Dec 29, 2020

Abstract

A processor semiconductor chip is described. The processor semiconductor chip includes at least one processing core. The processor semiconductor chip also includes a memory controller. The processor semiconductor chip also includes an embedded non flash non-volatile random access memory having a stack of storage cells disposed above the processor semiconductor chip's semiconductor substrate. The embedded non-volatile random access memory is to store boot up program code that, when executed by the processor semiconductor chip, is to analyze a subsequent module of program code so that a maliciously modified version of the subsequent module of program code can be identified. The embedded non-volatile random access memory to also store the subsequent module of program code.

First claim

The invention claimed is:

1. A processor semiconductor chip, comprising:
a) at least one processing core;
b) a memory controller; and
c) a embedded non flash non-volatile random access memory comprising a stack of storage cells disposed above a semiconductor substrate of the processor semiconductor chip, the embedded non-volatile random access memory to store boot up program code that, when executed by the processor semiconductor chip, is to analyze a subsequent module of program code so that a maliciously modified version of the subsequent module of program code can be identified, wherein the boot up program code is designed to invoke a trusted platform module (TPM) that measures the subsequent module of program code by performing a sequence of hashes on the subsequent module of program code, the embedded non-volatile random access memory to also store the subsequent module of program code.

2. The processor semiconductor chip of claim 1 wherein the boot up program code is to analyze BIOS program code.

3. The processor semiconductor chip of claim 1 wherein the boot up program code comprises initial boot block program code.

4. The processor semiconductor chip of claim 1 wherein the boot up program code is to analyze another boot up program code module.

5. The processor semiconductor chip of claim 4 wherein the boot up program code comprises authenticated code module (ACM) program code.

6. The processor semiconductor chip of claim 1 wherein the boot up program code comprises SINIT ACM program code.

7. A processor semiconductor chip, comprising:
a) at least one processing core;
b) a memory controller; and,
c) a embedded non flash non-volatile random access memory comprising a stack of storage cells disposed above a semiconductor substrate of the processor semiconductor chip, the embedded non-volatile random access memory to store boot up program code and a data structure associated with the boot up program code, wherein, the boot up program code, when executed by the processor semiconductor chip, is to analyze a subsequent module of program code so that a maliciously modified version of the subsequent module of program code can be identified, wherein the boot up program code is designed to invoke a trusted platform module (TPM) that measures the subsequent module of program code by performing a sequence of hashes on the subsequent module of program code, the embedded non-volatile random access memory to also store the subsequent module of program code and another data structure associated with the subsequent module of program code.

8. The processor semiconductor chip of claim 7 wherein the data structure comprises an electronic signature.

9. The processor semiconductor chip of claim 8 wherein the another data structure comprises another electronic signature.

10. The processor semiconductor chip of claim 7 wherein the data structure comprises a first policy.

11. The processor semiconductor chip of claim 10 wherein the embedded non flash non volatile memory is to store a TPM policy.

12. The processor semiconductor chip of claim 7 wherein the boot up program code comprises ACM program code.

13. The processor semiconductor chip of claim 7 wherein the data structure is a key.

14. The processor semiconductor chip of claim 7 wherein the another data structure is a key.

15. A computing system, comprising:
a) a TPM;
b) a system memory; and,
c) a processor semiconductor chip coupled to the TPM and the system memory, the processor semiconductor chip, comprising:
i) at least one processing core;
ii) a memory controller;
iii) an embedded non flash non-volatile random access memory comprising a stack of storage cells disposed above a semiconductor substrate of the processor semiconductor chip, the embedded non-volatile random access memory to store boot up program code that, when executed by the processor semiconductor chip, is to analyze a subsequent module of program code so that a maliciously modified version of the subsequent module of program code can be identified, wherein the boot up program code is designed to invoke a trusted platform module (TPM) that measures the subsequent module of program code by performing a sequence of hashes on the subsequent module of program code, the embedded non-volatile random access memory to also store the subsequent module of program code.

16. The computing system of claim 15 wherein the boot up program code is to analyze BIOS program code.

17. The computing system of claim 15 wherein the boot up program code comprises initial boot block program code.

18. The computing system of claim 15 wherein the boot up program code is to analyze another boot up program code module.

Assignees

• Intel Corp

Inventors

• Connor Christopher
• Querbach Bruce

Classifications

• G06F21/575 Primary

  Secure boot · CPC title

• G11C11/34

  using semiconductor devices · CPC title

• G11C7/24

  Memory cell safety or protection circuits, e.g. arrangements for preventing inadvertent reading or writing; Status cells; Test cells · CPC title

• G06F21/572

  Secure firmware programming, e.g. of basic input output system [BIOS] · CPC title

• G11C7/20

  Memory cell initialisation circuits, e.g. when powering up or down, memory clear, latent image memory · CPC title