Management Engine or Manageability Engine (ME or IME) is a tiny microcontroller coprocessor integrated within all Intel's own chipsets that provide the necessary functionality needed for remote corporate asset management, Boot Guard, SGX EPID provisioning and attestation services, platform trust technology (PTT), anti-theft (AT) technology, and protected audio visual path (PAVP) services. ME was originally introduced into the chipset in 2006 and has been present on all Intel mainstream mobile and desktop products ever since.

Overview

Intel's Management Engine (ME or IME) is a coprocessor implemented as a dedicated microcontroller embedded into the same die as the chipset. ME provides all the necessary functionality needed to provide many of Intel's advanced security and many of the root of trust services. ME was originally integrated into the MCH as bar of Intel's 965 Express chipset which were introduced back in June 2006. Since the 2009, with the introduction of the Core family, ME can be found in all PCHs, meaning it is present on all Intel embedded, mobile, and desktop parts.

Mechanism

ME is an independent coprocessor, relying on just itself. ME shares the flash with the BIOS, but is otherwise independent. ME can remain active during power off, idle states, and reboots of the main processor. ME has a dedicated connection to the network interface, in theory allowing it to intercept, send, and receive data without the processor's knowledge (or any software/OS knowledge).

Historical Mechanism

Originally, ME was a 32-bit ARCompact microcontroller running ThreadX, a read-time OS. The firmware that was running was developed internally by Intel and provided key management support, access control, and other administrative services. The MCU supported SRAM and DRAM that is isolated from the host processor. Persistent data was stored in flash memory which was accessible by the SPI bus which stored things such as Intel's AT-d metadata. Data is encrypted in AES-CTR mode using the platform container key (PCK).

ME was connected to both the host driver through an internal bus called the Host Embedded Controller Interface (HECI) . HECI is bidirectional bus that offers a direct line of communication between the Management Engine and the host OS. ME can also control various aspects of the Virtualization Engine directly over the ME Command Interface (MECI). ME also has access to the on-board network interface devices and Intel noted that ME has access to those interfaces even when the system is in low-power states and Sleep mode. Network resources are shared between the ME and the host OS without the host OS ever being aware of this (although Intel stated that some special monitoring tools can be used to detect it).

Secure Coprocessors

• Intel: Management Engine (ME)
• AMD: Secure Processor (SP)
• Apple: Secure Enclave Processor (SEP)

References

• REcon 2014, "Intel Management Engine Secrets", Igor Skochinsky.
• Libreboot, https://libreboot.org/faq.html#intelme, Frequently Asked Questions
• me_cleaner