Technologies for mutual application isolation with processor-enforced secure enclaves

Patent metadata

Field	Value
Publication number	US-10055577-B2
Application number	US-201615083983-A
Country	US
Kind code	B2
Filing date	Mar 29, 2016
Priority date	Mar 29, 2016
Publication date	Aug 21, 2018
Grant date	Aug 21, 2018

Abstract

Technologies for mutual application isolation include a computing device having a processor with secure enclave support. The computing device loads an application image to a memory range within a predefined virtual address range and creates a secure enclave with the predefined virtual address range assigned to the secure enclave. The computing device validates control flow integrity of the secure enclave. To validate control flow integrity the computing device may validate that the memory pages of the secure enclave synchronously exit only to an allowed address. Additionally, to validate control flow integrity the computing device may validate an asynchronous exit point associated with an enclave entry instruction. After validating the control flow integrity, the computing device executes the secure enclave, which includes enforcing mutual isolation of the application image and the secure enclave using the secure enclave support of the processor. Other embodiments are described and claimed.

First claim

The invention claimed is:

1. A computing device for mutual application isolation, the computing device comprising:
a processor with secure enclave support;
an operating system loader module to load an application image to a memory range within a predefined virtual address range;
an enclave loader module to (i) create a secure enclave, wherein the predefined virtual address range is assigned to the secure enclave and (ii) validate control flow integrity of the secure enclave in response to creation of the secure enclave; and
a mutual isolation module to execute the secure enclave in response to validation of the control flow integrity of the secure enclave, wherein to execute the secure enclave comprises to enforce mutual isolation of the secure enclave and the application image with the secure enclave support of the processor.

2. The computing device of claim 1 , wherein to enforce mutual isolation of the secure enclave and the application image comprises to generate abort transaction semantics by the processor in response to a memory access from the application image into the enclave secure enclave.

3. The computing device of claim 1 , wherein to enforce mutual isolation of the secure enclave and the application image comprises to generate a fault by the processor in response to a memory access from the secure enclave into the application image.

4. The computing device of claim 1 , wherein to validate the control flow integrity of the secure enclave comprises to validate one or more secure enclave memory pages associated with the secure enclave to ensure that the secure enclave synchronously exits to an allowed address.

5. The computing device of claim 4 , wherein to validate the one or more secure enclave memory pages comprises to statically analyze the one or more secure enclave memory pages.

6. The computing device of claim 5 , wherein to validate the one or more secure enclave memory pages further comprises to validate that an exit address associated with an enclave exit instruction is an allowed address.

7. The computing device of claim 6 , wherein to validate that the exit address associated with the enclave exit instruction is an allowed address comprises to determine whether the exit address is at a predefined address within the application image or to determine whether the exit address is at a predefined offset from a base address of the secure enclave.

8. The computing device of claim 4 , wherein to validate the one or more secure enclave memory pages comprises to verify that each executable secure enclave memory page is not writable.

9. The computing device of claim 1 , wherein to validate the control flow integrity of the secure enclave comprises to validate an asynchronous exit point associated with an enclave entry instruction.

10. The computing device of claim 9 , wherein to validate the asynchronous exit point associated with the enclave entry instruction comprises to determine whether the asynchronous exit point is associated with a code segment of the application image that ends with an enclave resume instruction.

11. The computing device of claim 1 , wherein the mutual isolation module is further to share data stored in an untrusted memory buffer between the application image and the secure enclave, wherein the untrusted memory buffer is located outside of the predefined virtual address range.

12. The computing device of claim 1 , wherein:
to load the application image comprises to load an untrusted application image that is not trusted by an operating system of the computing device; and
to validate the control flow integrity of the secure enclave comprises to validate that the untrusted application image does not include an enclave entry instruction.

13. The computing device of claim 12 , wherein the operating system loader module is further to execute the untrusted application image within a sandbox established by the operating system in response to loading of the untrusted application image.

14. A method for mutual application isolation, the method comprising:
loading, by a computing device, an application image to a memory range within a predefined virtual address range;
creating, by the computing device, a secure enclave, wherein the predefined virtual address range is assigned to the secure enclave;
validating, by the computing device, control flow integrity of the secure enclave in response to creating the secure enclave; and
executing, by the computing device, the secure enclave in response to validating the control flow integrity of the secure enclave, wherein executing the secure enclave comprises enforcing mutual isolation of the secure enclave and the application image with secure enclave support of a processor of the computing device.

15. The method of claim 14 , wherein validating the control flow integrity of the secure enclave comprises validating one or more secure enclave memory pages associated with the secure enclave to ensure that the secure enclave synchronously exits to an allowed address.

16. The method of claim 15 , wherein validating the one or more secure enclave memory pages comprises verifying that each executable secure enclave memory page is not writable.

17. The method of claim 14 , wherein validating the control flow integrity of the secure enclave comprises validating an asynchronous exit point associated with an enclave entry instruction.

18. The method of claim 14 , wherein:
loading the application image comprises loading an untrusted application image that is not trusted by an operating system of the computing device; and
validating the control flow integrity of the secure enclave comprises validating that the untrusted application image does not include an enclave entry instruction.

19. One or more non-transitory, computer-readable storage media comprising a plurality of instructions that in response to being executed cause a computing device to:
load an application image to a memory range within a predefined virtual address range;
create a secure enclave, wherein the predefined virtual address range is assigned to the secure enclave;
validate control flow integrity of the secure enclave in response to creating the secure enclave; and
execute the secure enclave in response to validating the control flow integrity of the secure enclave, wherein executing the secure enclave comprises enforcing mutual isolation of the secure enclave and the application image with secure enclave support of a processor of the computing device.

20. The one or more non-transitory, computer-readable storage media of claim 19 , wherein to validate the control flow integrity of the secure enclave comprises to validate one or more secure enclave memory pages associated with the secure enclave to ensure that the secure enclave synchronously exits to an allowed address.

21. The one or more non-transitory, computer-readable storage media of claim 20 , wherein to validate the one or more secure enclave memory pages comprises to statically analyze the one or more secure enclave memory pages.

22. The one or more non-transitory, computer-readable storage media of claim 20 , wherein to validate the one or more secure enclave memory pages comprises to verify that each executable secure enclave memory page is not writable.

23. The one or more non-transitory, computer-readable storage media of claim 19 , wherein to validate the control flow integrity of the secure enclave comprises to validate an asynchronous exit point associat

Assignees

• Shanahan Mark W
• Intel Corp

Inventors

• Shanahan Mark W

Classifications

• G06F21/53 Primary

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title