Scalable Paging of Platform Configuration Registers in TPM
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current trusted computing platforms face limitations due to the restricted number of Platform Configuration Registers (PCRs), which restricts the granularity of data sealing and unsealing, especially when new equipment or drivers are installed, leading to compromised security and access issues.
Innovation Solution
A method for managing platform configuration registers involves receiving requests for PCR values, comparing them to loaded values, and if not found, downloading and decrypting encrypted PCR values into the register stack, allowing for scalable storage and access through a PCR manager that can page PCR registers in and out of memory.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the number of PCRs is increased to accommodate more drivers and equipment, then the granularity of data sealing improves, but the device complexity and memory requirements increase
Solution Approach 1:
The patent divides the PCR storage into multiple pages, where each page contains a subset of PCR values. The PCR manager selectively loads only the required page into memory when a sealing operation is needed, rather than maintaining all PCR values in memory simultaneously. This segmentation approach enables support for a large number of PCRs (improving adaptability) while keeping the active memory footprint manageable (reducing device complexity).
Solution Approach 2:
The patent introduces a pagination dimension to the PCR storage model. Instead of a single flat memory structure, PCRs are organized into multiple pages that can be independently loaded and unloaded. This dimensional transformation allows the system to handle a vast number of PCR values by switching between pages as needed, effectively trading off between adaptability (number of available PCRs) and device complexity (memory management overhead).
2Speed
If all PCR values are kept in memory for fast access, then the access speed improves, but the memory consumption increases
Solution Approach 1:
The patent implements a dynamic PCR management system where the PCR manager loads specific pages into memory based on runtime demands. When a sealing operation requires a particular PCR value, the manager checks if the corresponding page is already in memory; if not, it dynamically loads the page from storage. This dynamic approach ensures fast access speed for actively used PCRs while minimizing overall memory consumption by keeping only necessary pages resident.
Solution Approach 2:
The patent extracts only the necessary subset of PCR values from the complete PCR set and loads them into memory when needed. Rather than maintaining the entire PCR database in memory, the system extracts and loads only the specific page containing the required PCR values for the current operation, thereby achieving fast access performance with minimal memory consumption.
3Adaptability or versatility
If the system supports a large number of PCRs, then the versatility of trusted platform improves, but the difficulty of managing and tracking PCR values increases
Solution Approach 1:
The patent introduces a PCR manager as an intermediary component between the application layer and the underlying PCR storage infrastructure. The manager handles all complexity of tracking, loading, and managing PCR values across multiple pages, presenting a simplified interface to applications. This intermediary absorbs the management complexity, allowing the system to support a large number of PCRs with high versatility while shielding users from the underlying complexity through automated page management and tracking.
Data Source
AI summary
A method, computer program, and system for paging platform configuration registers in and out of a trusted platform module. In a trusted computing platform, an unlimited number of platform configuration registers can be obtained through paging. The trust platform module encrypts and decrypts platform configuration registers for storage outside the trusted platform module.