Attestable PCR Extensions Using Volatile TPM Canary Objects

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Security devices like Trusted Platform Modules (TPMs) are susceptible to tampering attacks that modify firmware and software states, which existing detection techniques struggle to effectively prevent.

Innovation Solution

Implementing a canary object in volatile memory of the TPM, created by the CPU during boot, which is erased upon reboot, allowing detection of unauthorized modifications by verifying the presence of the original canary object.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If existing detection techniques are used to monitor TPM state, then security monitoring is provided, but the techniques are vulnerable to tampering attacks that can evade detection

Engineering Contradiction:
Improvedetection reliabilityVSAvoidtampering attack susceptibility
Core Design Contradiction:
ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent introduces a canary object as an intermediary indicator that the CPU sets in the TPM's volatile memory. This canary object serves as a mediator between the CPU's secure session and the TPM state, allowing indirect detection of unauthorized reboots without directly monitoring vulnerable TPM registers. The canary object is erased when TPM is rebooted, providing reliable detection of tampering attempts.

Inventive Principle:
Principle #24Intermediary (Mediator)

Solution Approach 2:

The CPU performs preliminary action by creating and storing the canary object in the TPM's volatile memory during a secure session before any potential tampering occurs. This preliminary placement of the canary object establishes a known good state that can later be verified to detect unauthorized reboots, enabling proactive security monitoring rather than reactive detection.

Inventive Principle:
Principle #10Preliminary action

2Reliability

If TPM volatile memory is used to store detection information, then reboot detection is enabled, but the information is lost upon legitimate reboots

Engineering Contradiction:
Improvereboot detection capabilityVSAvoidcanary object erasure
Core Design Contradiction:
ReliabilityVSLoss of information

Solution Approach 1:

The patent converts the harmful characteristic of volatile memory (data loss on reboot) into a beneficial security feature. The erasure of the canary object upon TPM reboot is not treated as a flaw but as the core detection mechanism itself. When the canary object is missing, it positively indicates an unauthorized reboot occurred, transforming information loss into reliable tampering detection.

Inventive Principle:
Principle #22Blessing in disguise (Convert harm into benefit)

3Reliability

If canary object verification is implemented, then unauthorized modifications are detected, but complex setup and continuous updates are required

Engineering Contradiction:
Improveunauthorized modification detectionVSAvoidsetup and maintenance complexity
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The canary object mechanism is self-service in that the CPU automatically creates and manages the canary object during secure sessions without requiring external configuration or continuous updates. The TPM independently maintains the canary object in its volatile memory, and the verification process simply checks for the object's presence, eliminating the need for complex setup procedures or ongoing maintenance updates.

Inventive Principle:
Principle #25Self-service

Data Source

PatentEP4645137A1Attestable PCR extensions
Publication Date: 2025.11.05 NVIDIA CORP
  • EP4645137A1 patent drawingFigure 1
  • EP4645137A1 patent drawingFigure 2
  • EP4645137A1 patent drawingFigure 3

AI summary

Processors, systems, methods, and computer program products to detect unauthorized modifications to security information in a security device. In at least one embodiment, a processor comprises one or more circuits that use information stored in one or more storage locations of one or more security devices to detect whether the security devices have been rebooted.