Platform Secure Boot

Patent metadata

Field	Value
Publication number	US-2015121054-A1
Application number	US-201314068102-A
Country	US
Kind code	A1
Filing date	Oct 31, 2013
Priority date	Oct 31, 2013
Publication date	Apr 30, 2015
Grant date	—

Abstract

A system and method for securing a boot process on the electronic device using a hardware-based secure processor are provided. The hardware-based secure processor receives a boot instruction. In response to the received boot instruction, the hardware-based secure processor authenticates the boot code in hardware while stalling the processor. Once the boot code is authenticated, the processor is released from the stall and processes the boot code.

First claim

What is claimed is:

1 . A system comprising:
a hardware-based secure processor configured to:
receive a boot instruction;
in response to the received boot instruction, authenticate a boot code in hardware while stalling an unsecure processor, wherein the unsecure processor executes the boot code; and
release the unsecure processor from the stall once the authentication completes.

2 . The system of claim 1 , wherein the boot instruction is a reset instruction.

3 . The system of claim 1 , wherein the hardware-based secure processor is a cryptographic secure processor.

4 . The system of claim 1 , wherein the hardware-based secure processor is a secure asset management unit.

5 . The system of claim 1 , wherein the hardware-based secure processor is further configured to:
authenticate a basic input/output system (BIOS) prior to the unsecure processor executing instructions included in the BIOS.

6 . The system of claim 1 , further comprising:
an on-chip memory configured to initialize the unsecure processor in response to the boot instruction, wherein the on-chip memory is located within an integrated circuit that includes the unsecure processor.

7 . The system of claim 1 , further comprising:
an off-chip memory configured to store the boot code, wherein the off-chip memory is located outside of an integrated circuit that includes the unsecure processor.

8 . The system of claim 1 , further comprising:
an off-chip memory configured to store a secure processor firmware, wherein the secure processor firmware initializes the hardware based secure processor and causes the hardware based secure processor to load and authenticate the boot code and wherein the off-chip memory is located outside of an integrated circuit that includes the unsecure processor.

9 . The system of claim 1 , wherein the hardware-based secure processor is further configured to decrypt or decompress off-chip code executable on the unsecure processor, and wherein the unsecure processor executes the off-chip code subsequent to the decryption or decompression of the off-chip code.

10 . The system of claim 9 , wherein the hardware-based secure processor authenticates the off-chip code and not the encryption of the off-chip code based on a root-of-trust embedded in an electronic fuse (eFUSE).

11 . A method comprising:
receiving a boot instruction; and in response to the received boot instruction, authenticating a boot code using a hardware-based secure processor while stalling an unsecure processor that executes the boot code; and releasing the unsecure processor from the stall once the authentication completes, wherein the released unsecure processor executes the boot code.

12 . The method of claim 11 , wherein the boot instruction is a reset instruction.

13 . The method of claim 11 , wherein the hardware-based secure processor is a cryptographic secure processor.

14 . The method of claim 11 , wherein the hardware-based secure processor is a secure asset management unit.

15 . The method of claim 11 , further comprising:
authenticating a basic input/output system (BIOS) prior to the processor executing instructions included in the BIOS.

16 . The method of claim 11 , further comprising:
initializing the unsecure processor in response to the boot instruction using an on-chip memory code, wherein the on-chip memory code is stored within an integrated circuit that includes the unsecure processor.

17 . The method of claim 11 , further comprising:
storing the boot code in an off-chip memory, wherein the off-chip memory is located outside of an integrated circuit that includes the unsecure processor.

18 . The method of claim 11 , further comprising:
initializing, using the secure processor firmware, the hardware-based secure processor; and causing the hardware-based secure processor to load and authenticate the boot code.

19 . The method of claim 11 , further comprising:
decrypting or decompressing off-chip code executable on the unsecure processor, using the hardware-based secure processor; and executing, using the unsecure processor the off-chip code subsequent to the decryption or decompression of the off-chip code, wherein the off-chip code is stored in an off-chip memory located outside of an integrated circuit that includes the unsecure processor.

20 . The method of claim 19 , wherein the hardware-based secure processor authenticates the off-chip code and not the encryption of the off-chip code based on a root-of-trust embedded in an electronic fuse (eFUSE).

Assignees

• Advanced Micro Devices Inc

Inventors

• Wu Winthrop J

Classifications

• G06F21/575 Primary

  Secure boot · CPC title

• G06F21/74

  operating in dual or compartmented mode, i.e. at least one secure mode · CPC title