Runtime Measurement Register-Based Virtual TPM Attestation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing vTPM solutions face challenges in cost, complexity, and security due to the need for additional software development, potential security vulnerabilities, and the requirement for a separate execution environment.

Innovation Solution

The implementation of RunTime Measurement Registers (RTMRs) provides a novel approach for vTPMs, eliminating the need for an isolated execution environment, enhancing security through hardware protection, and simplifying the attestation process.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If a virtual TPM (vTPM) is implemented as a software construct, then it can be used with virtual machines, but it lacks the security properties of a physical TPM

Engineering Contradiction:

ImprovevTPM compatibility with virtual machinesVSAvoidsecurity properties

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The patent uses TDX (Trusted Domain Extensions) as an intermediary layer between the vTPM software and the hardware. The TDX module creates a trusted execution environment that mediates access to measurement registers, ensuring that even though the vTPM is software-based, its measurements are protected by hardware-enforced isolation and encryption. This resolves the contradiction by allowing vTPM versatility while maintaining security through the TDX intermediary.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent replaces the need for a physical TPM hardware device with a software-based vTPM protected by hardware virtualization features. Instead of relying on physical TPM security boundaries, the system uses TDX's memory encryption and isolation mechanisms to protect the vTPM's measurement data, substituting mechanical/hardware TPM protection with a software approach backed by hardware virtualization security.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

2Reliability

If TEE-specific ISA instructions are used for attestation, then the TEE hardware can be attested, but software development and deployment costs increase due to ISA diversity

Engineering Contradiction:

ImproveTEE hardware attestation capabilityVSAvoidsoftware development cost

Core Design Contradiction:

ReliabilityVSEase of manufacture

Solution Approach 1:

The patent implements a universal vTPM interface that works across different TEE technologies (Intel SGX, AMD SEV, TDX). The vTPM software layer provides a standardized TPM 2.0 interface that can attest to various TEE implementations without requiring TEE-specific ISA instructions in the guest OS. This multi-functionality allows a single software stack to work with multiple hardware platforms, reducing development costs while maintaining attestation capabilities.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Solution Approach 2:

The vTPM software acts as an intermediary that translates between the TEE-specific attestation mechanisms and the standardized TPM interface. Instead of requiring the guest operating system to use TEE-specific instructions, the vTPM mediates the attestation process by collecting measurements from the TEE and presenting them through the universal TPM interface, thereby reducing software development complexity.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Reliability

If a separate execution environment is used to protect vTPM, then security is maintained, but system complexity and costs increase

Engineering Contradiction:

ImprovevTPM security protectionVSAvoidexecution environment structure

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent merges the vTPM execution environment with the guest virtual machine itself. Instead of requiring a separate protected execution environment for the vTPM, the vTPM software runs within the guest OS context while its measurement data is protected by TDX's memory encryption. This combining of the vTPM into the guest environment reduces system complexity while maintaining security through TDX's hardware-backed protection.

Inventive Principle:

Principle #5Merging (Combining)

Solution Approach 2:

The patent extracts the security protection mechanism (TDX memory encryption and isolation) from the execution environment structure and applies it directly to the vTPM's measurement registers and data. Instead of creating a separate protected environment for the entire vTPM subsystem, the protection is extracted and applied specifically to the critical measurement data, reducing overall system complexity while maintaining security.

Inventive Principle:

Principle #2Taking out (Extraction)

Data Source

PatentUS20250124132A1Runtime measurement register-based virtual trusted platform module

Publication Date: 2025.04.17 INTEL CORP

AI summary

A method and system for implementing a virtual trusted platform module (vTPM). Software components are sequentially loaded and measured from a core root of trust for measurement (CRTM) in a user confidential virtual machine (CVM). The measurements of the software components are recorded in a runtime measurement register (RTMR) log and a digest of each entry of the RTMR log is extended into an RTMR configured for the user CVM. A signed quote and corresponding measurement entries of the RTMR log are provided to a verifier. The signed quote includes a value of the RTMR. A state of the user CVM may be verified based on the RTMR value and the RTMR log entries. The measurement entries of the RTMR log may be replayed to calculate platform configuration register (PCR) values and the TCG event log may be verified using the PCR values.