Abstract:
A computer system is provided that comprises a processor and a Basic Input/Output System (BIOS) module coupled to the processor. The BIOS module stores a Core Root of Trust for Measurement (CRTM), wherein the CRTM selectively unlocks itself.

Description:
BACKGROUND  
       [0001]     The Trusted Computing Group (TCG) has defined hardware and software components to establish secure or “trusted” computing environments. One hardware/firmware component defined by TCG is the platform Root of Trust (ROT). The platform ROT identifies secure storage options for the Core Root of Trust for Measurement (CRTM). The CRTM specifies predefined policies and performs platform integrity measurements. The platform integrity measurements may include measuring system level metrics or conducting an integrity test for the intended user of a device. Due to the importance of the CRTM in establishing a trusted computing environment, TCG suggests the CRTM must be immutable (i.e., unchangeable). If part or all of a device&#39;s Basic Input/Output System (BIOS) is used as the CRTM, a conflict arises in that updating the BIOS is sometimes desirable or even necessary. Current BIOS flash methods rely on application level flash utilities that enable hackers and/or rogue applications to undesirably modify part or all of a BIOS. 
     
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
       [0002]     For a detailed description of exemplary embodiments of the invention, reference will now be made to the accompanying drawings in which:  
         [0003]      FIG. 1  shows an embodiment of a computer in accordance with the invention;  
         [0004]      FIG. 2  shows an embodiment of a system in accordance with the invention; and  
         [0005]      FIG. 3  shows an embodiment of a method in accordance with the invention. 
     
    
     NOTATION AND NOMENCLATURE  
       [0006]     Certain terms are used throughout the following description and claims to refer to particular system components. As one skilled in the art will appreciate, computer companies may refer to a component by different names. This document does not intend to distinguish between components that differ in name but not function. In the following discussion and in the claims, the terms “including” and “comprising” are used in an open-ended fashion, and thus should be interpreted to mean “including, but not limited to . . . . ” Also, the term “couple” or “couples” is intended to mean either an indirect, direct, optical or wireless electrical connection. Thus, if a first device couples to a second device, that connection may be through a direct electrical connection, through an indirect electrical connection via other devices and connections, through an optical electrical connection, or through a wireless electrical connection.  
       DETAILED DESCRIPTION  
       [0007]     The following discussion is directed to various embodiments of the invention. Although one or more of these embodiments may be preferred, the embodiments disclosed should not be interpreted, or otherwise used, as limiting the scope of the disclosure, including the claims. In addition, one skilled in the art will understand that the following description has broad application, and the discussion of any embodiment is meant only to be exemplary of that embodiment, and not intended to intimate that the scope of the disclosure, including the claims, is limited to that embodiment.  
         [0008]     A device or computer platform that follows the Trusted Computing Group (TCG) specification implements a Core Root of Trust for Measurement (CRTM). In at least some embodiments, part of a platform&#39;s Basic Input/Output System (BIOS) (e.g., the boot block) can be used as the CRTM. In alternative embodiments, additional BIOS routines or all of the BIOS can be used as the CRTM. Since a BIOS may undergo revisions during a platform lifecycle, embodiments of the invention enable a platform manufacturer or other authorized entity to securely update the BIOS in a manner that protects the validity of the CRTM.  
         [0009]      FIG. 1  shows a computer  100  in accordance with embodiments of the invention. The computer  100  may be, for example, a server, a desktop computer, a laptop computer or a mobile device. In some embodiments, the computer  100  comprises a processor  134  in communication with a Trusted Platform Module (TPM)  120 , a BIOS  110  and a system memory  150 . The BIOS  110  may be implemented, for example, as part of a chipset (e.g., a “Southbridge”) or other module.  
         [0010]     The TPM  120  is configured to provide cryptographic functions such as a Rivest Shamir Adleman (RSA) algorithm, a secure hashing (e.g., SHA- 1 ) engine, a hashed message authentication check (HMAC) engine, key generation, random number generation, storage, initialization functions, and management functions. The TPM  120  is implemented using software, firmware and/or hardware.  
         [0011]     As shown in  FIG. 1 , the TPM  120  comprises an input/output (I/O) interface  122  in communication with the processor  134 . The I/O interface  122  couples to other TPM components such as cryptographic services  124 , a random number source  126 , asymmetric algorithms  128 , storage  130  and Platform Configuration Registers (PCRs)  132 . The cryptographic services  124  support functions such as hashing, certificate signing, and encryption. The random number source  126  generates random numbers for the cryptographic services  124 . For example, in some embodiments, the cryptographic services  124  use random numbers to generate encryption keys. The asymmetric algorithms  128  enable the TPM  120  to perform asymmetric key operations. The storage  130  securely stores secrets (e.g., encryption keys or other data) protected by the TPM  120 . The PCRs  132  store information about the current state of the computer  100 . For example, in some embodiments, the PCRs  132  store individual integrity metrics related to the computer  100  as well as sequences of integrity metrics.  
         [0012]     As previously mentioned, a device or computer platform that follows the Trusted Computing Group (TCG) specification implements a Core Root of Trust for Measurement (CRTM). In at least some embodiments, the BIOS  110  of the computer  100  comprises a boot block  112  and a signature domain  116  used as a CRTM  118 A. The boot block  112  stores instructions executed during a boot process of the computer  100  and the signature domain  116  stores a signature or hashed signature known to the manufacturer of the computer  100  or some other authorized entity. As shown, the boot block  112  comprises a lock function  114  that enables a CRTM update utility  152  to update the CRTM  118  as will later be described. The CRTM update utility  152  may be stored in the system memory  150  and executed by the processor  134 .  
         [0013]     The BIOS  110  also comprises other routines  114  that enable other known or future BIOS processes to be performed. These other routines  114  can optionally be used as the CRTM  11   8 B (in addition to the boot block  112  and the signature domain  116 ). Again, the security of the CRTM  118  is important because CRTM policies and measurement functions establish whether the computer  100  can be trusted.  
         [0014]     When the computer  100  resets or boots, the boot block  112  is the first piece of code to be executed. Before the boot block  112  transfers control to another component (e.g., another BIOS component or the computer&#39;s operating system), the lock function  114  is executed. The lock function  114  prevents any updates or changes to the CRTM  118  unless an authentication process is successful as will later be described. To lock the CRTM  118  or other portions of BIOS  110 , the computer&#39;s manufacturer or another authorized entity may specify memory locations (e.g., memory addresses) to be locked by the lock function  114 . If only part of the BIOS  110  is used as the CRTM  118 , a flash utility can be prepared to update the non-CRTM portions of the BIOS  110  as needed. In at least some embodiments, the flash utility is an application level utility (based on the Open System Interconnection (OSI) model). To ensure the non-CRTM portions are updateable, the computer&#39;s manufacturer or other authorized entity should carefully specify which memory locations of BIOS  110  are to be locked by the lock function  114  and which are not. Also, if the CRTM  118  is updated, the memory locations affected by the lock function  114  may need to be updated as well.  
         [0015]     If a need arises to update the CRTM  118 , the CRTM update utility  152  can be executed, for example, during the computer&#39;s run time. During execution, the CRTM update utility  152  writes a password or signature to a predefined location  119  of the BIOS  110  and reboots the computer  100 . For example, the CRTM update utility  152  may provide an interface that enables a user to enter the signature based on keyboard commands, mouse commands, a smart card, biometrics, or other means for entering a signature. Once entered, the signature is written to the predefined location  119 . During each reboot, the lock function  114  causes the processor  134  to search for a signature in the predetermined location  119 . If a signature is not found at the predetermined location  119  or if the signature does not match the value stored in the CRTM&#39;s signature domain  116 , the lock function  114  locks the CRTM  118  before transferring control to another component of the computer  100 .  
         [0016]     Alternatively, if a signature is found at the predetermined location  119  and the signature matches the value stored in the CRTM&#39;s signature domain  116 , the lock function  114  does not lock the CRTM  118  before transferring control to another component of the computer  100 . With the CRTM  118  unlocked, the CRTM update utility  152  is able to update the CRTM  118  during the computer&#39;s runtime then reboot the computer  100 . When the signatures match, the lock function  114  also deletes the signature stored at the predetermined location  154 . Therefore, only one boot cycle is available for updating the unlocked CRTM  118 . Upon subsequent reboot, the lock function  114  will cause the CRTM  118  to lock unless the correct signature has been written again in the predetermined location  119 .  
         [0017]      FIG. 2  shows a system  200  in accordance with embodiments of the invention. In  FIG. 2 , the system  200  comprises a computer  202  having a processor  206  in communication with a Trusted Platform Module (TPM)  120  and a BIOS  110 . The functions of the BIOS  110  and the TPM  120  were previously described for  FIG. 1  and, for convenience, will not be repeated for  FIG. 2 . As shown in  FIG. 2 , the processor  206  is also in communication with other components such as a secondary storage  204 , read-only memory (ROM)  208 , random access memory (RAM)  210 , a network interface  212  and input/output (I/O) devices  214 . For example, the I/O devices  214  can be printers, scanners, video monitors, liquid crystal displays (LCDs), touch screen displays, keyboards, keypads, switches, dials, mice, track balls, voice recognizers, card readers, paper tape readers, or other I/O devices.  
         [0018]     In at least some embodiments, the secondary storage  204  comprises at least one disk drive or tape drive and is used for non-volatile storage of data and as an over-flow data storage device if the RAM  210  is not large enough to hold all working data. Also, the secondary storage  204  may be used to store programs which are loaded into the RAM  210  when such programs are selected for execution. Thus, the RAM  210  often stores volatile data and/or instructions. The ROM  208  can be used to store instructions and perhaps data which are read during program execution. In some embodiments, the ROM  208  is a non-volatile memory device which has a small memory capacity relative to the larger memory capacity of the secondary storage  204 . In  FIG. 2 , the processor  206  executes instructions, codes, computer programs, or scripts which are accessed from hard disks, floppy disks, optical disks (these various disk based systems may all be considered secondary storage  204 ), ROM  208 , RAM  210 , or the network interface  212 .  
         [0019]     The network interface  212  may take the form of modems, modem banks, Ethernet cards, Universal Serial Bus (USB) interface cards, serial interfaces, token ring cards, fiber distributed data interface (FDDI) cards, wireless local area network (WLAN) cards, radio transceiver cards such as code division multiple access (CDMA) and/or global system for mobile communications (GSM) radio transceiver cards, or other network devices. Via the network interface  212 , the processor  206  is able to connect to and communicate with the Internet or intranet(s). With such a network connection, it is contemplated that the processor  206  might receive information from the network, or might output information to the network in the course of performing the CRTM update process. For example, the CRTM update utility  152  could be stored remotely in  FIG. 2  (e.g., on the network) rather than locally as in  FIG. 1 .  
         [0020]     Information from the network (e.g., a sequence of instructions to be executed using processor  206 ) may be received and transmitted in the form of a data signal embodied in a carrier wave. Alternatively, the information may be received and transmitted in the form of a data baseband signal. The baseband signal or signal embodied in the carrier wave may propagate in or on the surface of electrical conductors, in coaxial cables, in waveguides, in optical media (e.g., optical fiber), or in the air or free space. The information contained in the baseband signal or signal embedded in the carrier wave may be ordered according to different sequences or protocols, as may be desirable for generating, transmitting or processing the information. The baseband signal or signal embedded in the carrier wave may be generated according to any suitable method currently being used or hereafter developed.  
         [0021]     The CRTM  118  of  FIG. 2  can be locked/unlocked as previously described for  FIG. 1 . To protect the CRTM  118  (in either of  FIGS. 1 and 2 ) from unauthorized modification, several security precautions can be implemented. For example, the window during which the CRTM  118  remains unlocked can be reduced or minimized by configuring the CRTM update utility  152  to automatically update the unlocked CRTM  118  once the host computer (i.e., the computer associated with the CRTM  118 ) has booted. If desired, the CRTM update utility  152  can be configured to start executing before other runtime applications. Alternatively, a user may choose to quickly execute the CRTM update utility  152  once the host computer has booted. After the update is complete, the host computer can be immediately rebooted whereby the CRTM  118  locks itself before passing control to another component.  
         [0022]     Also, the signature stored in the predetermined location  119  and the signature domain  116  can be hashed to increase security. If desired, the TPM  120  can be implemented to generate and authenticate a shared secret for use between with the CRTM update utility  152  and the CRTM  118 . In other words, a secure session can be established between the CRTM update utility  152  and the CRTM  118  for updating the CRTM  118 . Additionally, if signature authentication fails (e.g., someone executed the CRTM update utility  152  but entered an incorrect signature), the CRTM  118  may refuse to pass control of the host computer to another component and/or may provide notification that an invalid attempt to unlock the CRTM  118  occurred.  
         [0023]      FIG. 3  shows a method  300  in accordance with embodiments of the invention. As shown in  FIG. 3 , the method  300  comprises storing a signature in a CRTM (block  302 ) and powering on a computer (block  304 ). The CRTM can be part or all of the computer&#39;s BIOS. At block  306 , CRTM functions are executed including a CRTM lock function. The CRTM then transfers control to another component of the computer (block  308 ). If a CRTM update is desired (determination block  310 ), a CRTM update utility is executed to write a signature to the computer&#39;s BIOS (block  312 ). The computer is then rebooted (block  314 ) which causes the CRTM functions to execute again. If the signature stored in the BIOS does not match the signature stored in the CRTM (determination block  316 ), the CRTM is locked (block  318 ). Additionally, if there is no signature stored in the BIOS, the CRTM could be locked. In at least some embodiments, the signature authentication is part of the CRTM instruction set executed during a boot process. If the signature stored in the BIOS matches the signature stored in the CRTM (determination block  316 ), the CRTM is unlocked (block  320 ) and the signature stored in the BIOS is deleted (block  322 ). While unlocked, the CRTM is updated and the computer is rebooted (block  324 ). The method  300  beginning at block  304  is then repeated. Since the signature has been deleted from the BIOS, the CRTM cannot be updated again until a signature is again written to BIOS and authenticated.  
         [0024]     Using the method  300  the computer&#39;s manufacturer or another authorized entity can update the CRTM (including the signature stored in the CRTM) as needed. To protect the security of the CRTM, a CRTM update utility may automatically update the unlocked CRTM once the computer has booted. Alternatively, a user may quickly execute the CRTM update utility once the computer reaches runtime. After the update is complete, the computer can be immediately rebooted whereby the CRTM locks itself before passing control to another component. To increase security, the signature stored in the CRTM and/or the BIOS can be hashed. Since both signatures are stored in BIOS and the signature authentication occurs before the CRTM passes control to another component, the CRTM update process is highly secure. If desired, a TPM can generate and authenticate a shared secret for use between with a CRTM update utility and the CRTM. The shared secret can be used to establish a secure session between the CRTM update utility and a CRTM for updating the CRTM.