Secure processing environment measurement and attestation

Patent metadata

Field	Value
Publication number	US-9276750-B2
Application number	US-201313949192-A
Country	US
Kind code	B2
Filing date	Jul 23, 2013
Priority date	Jul 23, 2013
Publication date	Mar 1, 2016
Grant date	Mar 1, 2016

Abstract

Embodiments of an invention for secure processing environment measurement and attestation are disclosed. In one embodiment, a processor includes an instruction unit and an execution unit. The instruction unit is to receive a first instruction associated with a build or a rebuild of a secure enclave. The execution unit is to execute the first instruction. Execution of the first instruction, when associated with the build, includes calculation of a first measurement and a second measurement of the secure enclave. Execution of the first instruction, when associated with the rebuild, includes calculation of the second measurement without calculation of the first measurement.

First claim

What is claimed is:

1. A processor comprising:
instruction hardware to receive a first instruction and a second instruction, the first instruction associated with one of a build and a rebuild of a secure enclave, wherein the first instruction, when associated with the rebuild, provides an expected hash; and
execution hardware to execute the first instruction and the second instruction, wherein execution of the first instruction, when associated with the build, includes calculation of a calculated hash of the secure enclave and calculation of a message authentication code of the secure enclave, and when associated with the rebuild, includes obtaining the message authentication code calculated during the build, calculation of the message authentication code without calculation of the calculated hash, and comparing the message authentication code calculated during the rebuild to the message authentication code calculated during the build, and wherein execution of the second instruction includes attesting to content of the secure enclave using one of the calculated hash and the expected hash.

2. The processor of claim 1 , further including a key, wherein calculation of the message authentication code is performed using the key.

3. The processor of claim 1 , wherein execution of the first instruction, when associated with the rebuild, also includes calculating the message authentication code based on the expected hash.

4. The processor of claim 1 , wherein calculation of the calculated hash is based on SHA-256.

5. A method comprising:
invoking a first instruction to measure an initial build of a secure enclave;
executing, by execution hardware in a processor, the first instruction to measure the initial build, including calculating a calculated hash of the secure enclave and calculating a message authentication code of the secure enclave;
storing the calculated hash in a measurement register in a cache protected by the processor from access except by software executing from within the secure enclave;
invoking the first instruction to measure a subsequent build of the secure enclave, the first instruction providing an expected hash;
executing, by the execution hardware in the processor, the first instruction to measure the subsequent build, including obtaining the message authentication code calculated during the initial build, calculating the message authentication code without calculation of the calculated hash, and comparing the message authentication code calculated during the subsequent build to the message authentication code calculated during the initial build;
invoking a second instruction to attest to content of the secure enclave; and
executing, by the execution hardware in the processor, the second instruction to attest to content of the secure enclave using one of the calculated hash and the expected hash.

6. The method of claim 5 , wherein calculating the calculated message authentication code is performed using a key.

7. The method of claim 5 , wherein calculating the calculated message authentication code in response to the first instruction, when associated with the subsequent build, includes calculating the message authentication code based on the expected hash.

8. A system comprising:
a system memory; and
a processor including
an instruction unit to receive a first instruction and a second instruction, the first instruction associated with one of a build and a rebuild of a secure enclave using data from the system memory, wherein the first instruction, when associated with the rebuild, provides an expected hash; and
an execution unit to execute the first instruction and the second instruction, wherein execution of the first instruction, when associated with the build, includes calculation of a calculated hash of the secure enclave and calculation of a message authentication code of the secure enclave, and when associated with the rebuild, includes obtaining the message authentication code calculated during the build, calculation of the message authentication code without calculation of the calculated hash, and comparing the message authentication code calculated during the rebuild to the message authentication code calculated during the build, and wherein execution of the second instruction includes attesting to content of the secure enclave using one of the calculated hash and the expected hash.

Assignees

• Scarlata Vincent R
• Rozas Carlos
• Johnson Simon
• Savagaonkar Uday
• Leslie-Hurd Rebekah
• Huntley Barry
• Shanbhogue Vedvyas
• Anati Ittai
• Mckeen Francis
• Goldsmith Michael
• Wood William
• Gueron Shay
• Intel Corp

Inventors

• Scarlata Vincent R
• Rozas Carlos
• Johnson Simon
• Savagaonkar Uday
• Leslie-Hurd Rebekah
• Huntley Barry
• Shanbhogue Vedvyas
• Anati Ittai
• Mckeen Francis
• Goldsmith Michael
• Wood William
• Gueron Shay

Classifications

• H04L9/3242 Primary

  involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC · CPC title

• H04L9/3234

  involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853) · CPC title

• H04L2209/127

  Trusted platform modules [TPM] · CPC title

• G06F9/3004

  to perform operations on memory · CPC title