Filing Information

Inventor(s)	Derek L. Davis · Pranav Mehta ·
Assignee(s)	Intel Corporation ·  View assignee updates
Attorney/Agent(s)	Blakely, Sokoloff, Taylor & Zafman LLP ·
Primary Examiner	Albert Decady ·
Assistant Examiner	Steve Kabakoff ·
Application Number	US9118147
Filing date	07/17/1998
Issue date	06/04/2002
Predicted expiration date	07/17/2018
U.S. Classifications	713/193  · 713/187  · 713/188  · 713/191  · 713/189  ·
International Classifications	--
Kind Code	B2
International Classifications	713187-188 · 713189 · 713191 · 713193 · 713200 ·

Patent Family

Abstract

A cryptographic device is implemented in communication with a host processor to prevent the host processor from performing a standard boot-up procedure until a basic input output system (BIOS) code is authenticated. This is accomplished by a cryptographic device which is addressed by the host processor during execution of a first instruction following a power-up reset. The cryptographic device includes a first integrated circuit (IC) device and a second IC device. The first IC device includes a memory to contain firmware and a root certification key. The second IC device includes logic circuitry to execute a software code to authenticate the BIOS code before permitting execution of the BIOS code by the host processor.

Independent Claims | See all claims (19)

1. 1. A system comprising: a chipset including a controller; a storage device coupled to the chipset and controlled by the memory controller, the storage device including software code, a digital signature of the software code, and a digital certificate pre-stored within the storage device; a processor coupled to the chipset via a data/control control line, the processor including an opcode fetch emulation bit, the opcode fetch emulation bit to default to a predetermined state during a power-on reset condition and cause the processor to disguise a data fetch to the storage device as an instruction fetch through deassertion of the data/control control line so that the data fetch appears as an instruction fetch to the controller; and a cryptographic device in communication with the processor, the cryptographic device to authenticate the software code, loaded into the cryptographic device during a boot procedure, before permitting the processor to execute the software code.
2. 12. A cryptographic device comprising: a first integrated circuit device including a cryptographic engine and a memory to contain firmware and a root certification key; and a second integrated circuit device including logic circuitry to execute firmware to authenticate retrieved basic input/output system (BIOS) code loaded into the first integrated circuit device along with a BIOS signature and a BIOS certificate before permitting execution of the BIOS code during a standard boot procedure.
3. 16. A method comprising: performing an instruction fetch to an address mapped to an internal memory of a cryptographic device during a power-on reset, the instruction fetch to occur before a boot procedure; authenticating a basic input output system (BIOS) code during the power-on reset before permitting the BIOS code to be executed, the authenticating of the BIOS code includes initiating a data cycle to fetch the BIOS code and disguising a data fetch over the data cycle as an instruction fetch so that the data fetch appears as the instruction fetch to a controller of an electronic system employing the cryptographic device; and generating a soft reset by the cryptographic device to enable the boot procedure to proceed.