Method for extending the CRTM in a trusted platform

Abstract

A method, system and computer program product for enhancing the functionality of the existing core root of trust measurement (CRTM). The CRTM is extended to allow platform manufacturer controlled and certified code to be incorporated into the function of the CRTM, wherein the manufacturer may define the policy for accepting a new function into the CRTM. When a firmware or software module image is compiled, the build process generates a hash value of the compiled firmware or software image, wherein the hash value reflects a fingerprint (or short hand) representation of the compiled image. A determination is made as to whether the hash value of the firmware or software image is to be a CRTM extension. If so, a digital signature of the module is created using the CRTM extension private key. This signature value is added to the firmware or software module.

Description

BACKGROUND OF THE INVENTION [0001] 1. Technical Field [0002] The present invention relates generally to an improved data processing system. In particular, the present invention relates to a method, apparatus, and computer instructions for extending the core root of trust for measurement (CRTM) in a trusted platform. [0003] 2. Description of Related Art [0004] Most data processing systems contain sensitive data and sensitive operations that need to be protected. For example, the integrity of configuration information needs to be protected from illegitimate modification, while other information, such as a password file, needs to be protected from illegitimate disclosure. As another example, a data processing system needs to be able to reliably identify itself to other data processing systems. [0005] An operator of a given data processing system may employ many different types of security mechanisms to protect the data processing system. For example, the operating system on the data pr...

AI Technical Summary

Benefits of technology

[0012] The present invention provides a method, system and computer program product for enhancing the functionality of the existing core root of trust for measurement (CRTM). With the present invention, the CRTM is extended to allow platform manufacturer controlled and certified code to be incorporated into the function of the CRTM, wherein the manufacturer may define the policy for accepting a new function into the CRTM. When the processor initializes the data processing system, the firmware or soft

Problems solved by technology

The integrity of a data processing system's data and its operations, however, centers on the issue of trust.

Hence, the ability to protect a data processing system is limited by the manner in which trust is created or rooted within the data processing system.

Consequently, the Intel model adds additional complexity to the processor architecture.

Thus, the Intel model does not provide an extension of the CRTM, but rather it provides mechanism for instantiating a replacement CRTM for one set of execution models.

Images