IPC분류정보
국가/구분 |
United States(US) Patent
등록
|
국제특허분류(IPC7판) |
|
출원번호 |
US-0615519
(2009-11-10)
|
등록번호 |
US-8407476
(2013-03-26)
|
발명자
/ 주소 |
- Kozuch, Michael A.
- Sutton, II, James A.
- Grawrock, David
|
출원인 / 주소 |
|
대리인 / 주소 |
|
인용정보 |
피인용 횟수 :
1 인용 특허 :
219 |
초록
▼
An article of manufacture is provided for securing a region in a memory of a computer. According to one embodiment, the article of manufacture comprises a machine-accessible medium including data that, when accessed by a machine, causes the machine to: halt all but one of a plurality of processing e
An article of manufacture is provided for securing a region in a memory of a computer. According to one embodiment, the article of manufacture comprises a machine-accessible medium including data that, when accessed by a machine, causes the machine to: halt all but one of a plurality of processing elements in a computer, where the halted processing elements enter into a special halted state; load content into the region only after the halting of all but the one of the plurality of processing elements and the region is protected from access by the halted processing elements; place the non-halted processing element into a known privileged state; and cause the halted processing elements to exit the halted state after the non-halted processing element has been placed into the known privileged state.
대표청구항
▼
1. An article of manufacture, comprising: a non-transitory machine-accessible storage medium including instructions that, when accessed by a machine, cause the machine to execute a method for loading verifiably trustable software, the method comprising: causing all but one of a plurality of processi
1. An article of manufacture, comprising: a non-transitory machine-accessible storage medium including instructions that, when accessed by a machine, cause the machine to execute a method for loading verifiably trustable software, the method comprising: causing all but one of a plurality of processing elements in a processing system to enter into a special halted state as part of a join secure operation;identifying a region in a memory of the processing system for use in trust measurement;protecting the identified region from access by the processing elements associated with the special halted state;using a signed cryptographic hash of the identified region to verify whether content in the identified region can be trusted;placing the non-halted processing element into a known privileged state; andafter the non-halted processing element has been placed into the known privileged state, generating a signal that causes the processing elements associated with the special halted state to exit the special halted state and resume activity, wherein each of the plurality of processing elements associated with the special halted state exits the special halted state as part of the join secure operation, in response to a signal from the non-halted processing element indicating that a start secure operation is complete, and wherein the join secure operation is performed atomically. 2. The article of manufacture of claim 1 wherein the method for loading verifiably trustable software further comprises: causing the non-halted processing element to jump to a known entry point in the identified region in the memory. 3. The article of manufacture of claim 1 wherein the instructions cause the processing elements associated with the special halted state to jump to a known entry point in the identified region in the memory upon exiting the special halted state. 4. The article of manufacture of claim 1 wherein identifying the region in the memory comprises receiving a region parameter, the region parameter specifying a location of the region. 5. The article of manufacture of claim 4 wherein the location comprises a range of addresses in the memory of the processing system within which the region is located. 6. The article of manufacture of claim 4 wherein the location comprises a start address and a length of the memory of the processing system within which the region is located. 7. The article of manufacture of claim 1 wherein the content is a component of an operating system to operate the processing system. 8. The article of manufacture of claim 7 wherein the component of the operating system is one of a virtual machine monitor and a privileged software nucleus. 9. The article of manufacture of claim 1 wherein the instructions further cause the machine to: block access to the identified region of memory for a duration of time even after the processing elements associated with the special halted state have entered the special halted state when the plurality of processing elements are implemented within a processing system that supports direct memory access (DMA). 10. The article of manufacture of claim 1 wherein the operations of identifying the region for use in trust measurement and using the signed cryptographic hash of the identified region to verify whether the content can be trusted are uninterruptible. 11. A method for loading verifiably trustable software, the method comprising: causing all but one of a plurality of processing elements in a processing system to enter into a special halted state as part of a join secure operation;identifying a region in a memory of the processing system for use in trust measurement;protecting the identified region from access by the processing elements associated with the special halted state;using a signed cryptographic hash of the identified region to verify whether content in the identified region can be trusted;placing the non-halted processing element into a known privileged state; andafter the non-halted processing element has been placed into the known privileged state, generating a signal that causes the processing elements associated with the special halted state to exit the special halted state and resume activity, wherein each of the plurality of processing elements associated with the special halted state exits the special halted state as part of the join secure operation, in response to a signal from the non-halted processing element indicating that a start secure operation is complete, and wherein the join secure operation is performed atomically. 12. The method of claim 11, further comprising: causing the non-halted processing element to jump to a known entry point in the identified region in the memory. 13. The method of claim 11, further comprising: causing the processing elements associated with the special halted state to jump to a known entry point in the identified region in the memory upon exiting the special halted state. 14. The method of claim 11 wherein identifying the region of the memory comprises receiving a region parameter, the region parameter specifying a location of the region. 15. The method of claim 14 wherein the location comprises a range of addresses in the memory of the processing system within which the region is located. 16. The method of claim 14 wherein the location comprises a start address and a length of the memory of the processing system within which the region is located. 17. The method of claim 11 wherein the content is a component of an operating system to operate the processing system. 18. The method of claim 17 wherein the component of the operating system is one of a virtual machine monitor and a privileged software nucleus. 19. The method of claim 11 further comprising: blocking access to the identified region of memory for a duration of time even after the processing elements associated with the special halted state have entered the special halted state when the plurality of processing elements are implemented within a processing system that supports direct memory access (DMA). 20. The method of claim 11 wherein the operations of identifying the region for use in trust measurement and using the signed cryptographic hash of the identified region to verify whether the content can be trusted are uninterruptible. 21. An apparatus comprising: a plurality of processing elements; anda memory comprising instructions to execute on the plurality of processing elements, wherein the instructions, when executed, cause the plurality of processing elements to execute a method for loading verifiably trustable software, the method comprising: causing all but one of the plurality of processing elements to enter into a special halted state as part of a join secure operation;identifying a region in the memory for use in trust measurement;protecting the identified region from access by the processing elements associated with the special halted state;using a signed cryptographic hash of the identified region to verify whether content in the identified region can be trusted;placing the non-halted processing element into a known privileged state; andafter the non-halted processing element has been placed into the known privileged state, generating a signal that causes the processing elements associated with the special halted state to exit the special halted state and resume activity, wherein each of the plurality of processing elements associated with the special halted state exits the special halted state as part of the join secure operation, in response to a signal from the non-halted processing element indicating that a start secure operation is complete, and wherein the join secure operation is performed atomically. 22. The apparatus of claim 21 wherein the method for loading verifiably trustable software further comprises: causing the non-halted processing element to jump to a known entry point in the identified region in the memory. 23. The apparatus of claim 21, wherein the instructions cause the processing elements associated with the special halted state to jump to a known entry point in the region in the memory upon exiting the special halted state. 24. The apparatus of claim 21 wherein identifying the region of the memory comprises receiving a region parameter, the region parameter specifying a location of the region. 25. The apparatus of claim 24 wherein the location comprises a range of addresses in the memory. 26. The apparatus of claim 24 wherein the location comprises a start address and a length of the memory. 27. The apparatus of claim 21 wherein the content is a component of an operating system. 28. The apparatus of claim 27 wherein the component of the operating system is one of a virtual machine monitor and a privileged software nucleus. 29. The apparatus of claim 21 wherein the instructions further cause the apparatus to perform operations comprising: blocking access to the identified region of memory for a duration of time even after the processing elements associated with the special halted state have entered the special halted state when the plurality of processing elements are implemented within a processing system that supports direct memory access (DMA). 30. The apparatus of claim 21 wherein the operations of identifying the region for use in trust measurement and using the signed cryptographic hash of the identified region to verify whether the content can be trusted are uninterruptible.
※ AI-Helper는 부적절한 답변을 할 수 있습니다.