Method and apparatus to provide secure application execution

Patent metadata

Field	Value
Publication number	US-10885202-B2
Application number	US-201816123593-A
Country	US
Kind code	B2
Filing date	Sep 6, 2018
Priority date	Dec 22, 2009
Publication date	Jan 5, 2021
Grant date	Jan 5, 2021

Abstract

A technique to enable secure application and data integrity within a computer system. In one embodiment, one or more secure enclaves are established in which an application and data may be stored and executed.

First claim

What is claimed is:

1. A system comprising:
a memory to store an instruction; and
a processor, the processor including:
decode logic circuitry to decode the instruction, the instruction including an opcode to indicate a page is to be removed from an enclave page cache (EPC), and
execution logic circuitry to execute the decoded instruction to remove the page from the EPC and set a zero flag in a flags register to zero when the page is removed, wherein the instruction is to run in a protected mode.

2. The system of claim 1 , wherein the processor further comprises a security map (SMAP) is to help ensure integrity of the program when the program is stored in a hard disk drive or protected memory.

3. The system of claim 1 , wherein an effective address of the page to remove by the execution logic circuitry is stored in a register encoded as an operand of the instruction.

4. The system of claim 1 , wherein the execution logic circuitry is further to determine that the page belongs to a valid secure enclave by accessing a secure enclave control structure.

5. The system of claim 1 , wherein the execution logic circuitry is further to perform a first instruction to report a state of a secure enclave stored in memory to either a local or remote agent.

6. The system of claim 1 , wherein the processor further comprises:
a hierarchical protection tree, SMAP, to enable multiple memory updates within a secure enclave in a single processor cycle.

7. The system of claim 1 , wherein the execution logic circuitry is to set the zero flag to 1when there is a faulting condition during execution.

8. The system of claim 1 , wherein to remove the page from the EPC, the page is unassociated with a corresponding secure enclave control structure.

9. The system of claim 1 , wherein the execution logic circuitry is to not remove the page when the page is in use by another instruction.

10. A processor comprising:
decode logic circuitry to decode an instruction, the instruction including an opcode to indicate a page is to be removed from an enclave page cache (EPC); and
execution logic circuitry to execute the decoded instruction to remove the page from the EPC and set a zero flag in a flags register to zero when the page is removed.

11. The processor of claim 10 , further comprising:
a security map (SMAP) is to help ensure integrity of the program when the program is stored in a hard disk drive or protected memory.

12. The processor of claim 10 , wherein an effective address of the page to remove by the execution logic circuitry is stored in a register encoded as an operand of the instruction.

13. The processor of claim 10 , wherein the execution logic circuitry is further to determine that the page belongs to a valid secure enclave by accessing a secure enclave control structure.

14. The processor of claim 10 , wherein the execution logic circuitry is further to perform a first instruction to report a state of a secure enclave stored in memory to either a local or remote agent.

15. The processor of claim 10 , wherein the processor further comprises:
a hierarchical protection tree, SMAP, to enable multiple memory updates within a secure enclave in a single processor cycle.

16. The processor of claim 10 , wherein the execution logic circuitry is to set the zero flag to 1 when there is a faulting condition during execution.

17. The processor of claim 10 , wherein to remove the page from the EPC, the page is unassociated with a corresponding secure enclave control structure.

18. The processor of claim 10 , wherein the execution logic circuitry is to not remove the page when the page is in use by another instruction.

Assignees

• Intel Corp

Inventors

• Mckeen Francis X
• Rozas Carlos V
• Savagaonkar Uday R
• Johnson Simon P
• Scarlata Vincent
• Goldsmith Michael A
• Brickell Ernie
• Li Jiang Tao
• Herbert Howard C
• Dewan Prashant
• Tolopka Stephen J
• Neiger Gilbert
• Durham David
• Graunke Gary
• Lint Bernard
• Van Dyke Don A
• Cihula Joseph
• Jeyasingh Stalinselvaraj
• Van Doren Stephen R
• Rodgers Dion
• Garney John
• Altman Asher

Classifications

• G06F21/72 Primary

  in cryptographic circuits · CPC title

• G06F21/53

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• G06F21/60 Primary

  Protecting data · CPC title