Secure Enclave TPM Implementation for Cost Reduction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current Trusted Execution Technology (TXT) implementations require a dedicated TPM chip, making them unsuitable for small form-factor, low-cost computing platforms, and are costly and complex to implement.
Innovation Solution
A software-based solution using Secure Enclaves, hardware registers, and non-volatile storage to provide TPM-equivalent functionality without a dedicated TPM chip, leveraging Secure Enclaves to implement a Trusted Computing Base and attestation features, and replicating the GETSEC [SENTER] instruction for dynamic root of trust measurement and launch.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a dedicated TPM chip is used to implement Trusted Execution Technology, then security and trust features are improved, but device complexity and cost increase
Solution Approach 1:
The patent merges the TPM functionality with the processor by implementing a software-based TPM using Secure Enclaves within the CPU. The Secure Enclave provides hardware-protected execution environment that combines the security features of a dedicated TPM with the processing capabilities of the CPU, eliminating the need for a separate physical chip while maintaining security requirements for trusted execution and attestation.
Solution Approach 2:
The processor is designed to perform multiple functions: general-purpose computing and trusted execution environment. The Secure Enclave technology enables the processor to universally handle both standard computational tasks and security-critical operations like key generation, storage, and attestation, replacing the specialized function of a dedicated TPM chip with a multi-functional processor capability.
2Reliability
If a dedicated TPM chip is used to implement Trusted Execution Technology, then security and trust features are improved, but cost increases
Solution Approach 1:
The patent merges the TPM functionality with the processor by implementing a software-based TPM using Secure Enclaves within the CPU. The Secure Enclave provides hardware-protected execution environment that combines the security features of a dedicated TPM with the processing capabilities of the CPU, eliminating the need for a separate physical chip while maintaining security requirements for trusted execution and attestation.
3Device complexity
If Secure Enclaves are used to implement TPM functionality, then device complexity is reduced, but measurement precision and attestation capability may be compromised
Solution Approach 1:
The patent introduces an intermediary layer (software-based TPM running in Secure Enclave) that mediates between the processor and the trusted execution requirements. This software-based TPM implements the full TPM command set and maintains precise measurement of the trusted computing base through hardware-backed secure execution, ensuring attestation capability is not compromised while reducing overall system complexity.
Data Source
AI summary
An apparatus and method are described for implementing a trusted dynamic launch and trusted platform module (TPM) using a secure enclave. For example, a computer-implemented method according to one embodiment of the invention comprises: initializing a secure enclave in response to a first command, the secure enclave comprising a trusted software execution environment which prevents software executing outside the enclave from having access to software and data inside the enclave; and executing a trusted platform module (TPM) from within the secure enclave, the trusted platform module securely reading data from a set of platform control registers (PCR) in a processor or chipset component into a memory region allocated to the secure enclave.