Uniform enclave interface

Patent metadata

Field	Value
Publication number	US-11494485-B2
Application number	US-201817046593-A
Country	US
Kind code	B2
Filing date	Jul 18, 2018
Priority date	Apr 30, 2018
Publication date	Nov 8, 2022
Grant date	Nov 8, 2022

Abstract

A uniform enclave interface is provided for creating and operating enclaves across multiple different types of backends and system configurations. For instance, an enclave manager may be created in an untrusted environment of a host computing device. The enclave manager may include instructions for creating one or more enclaves. An enclave may be generated in memory of the host computing device using the enclave manager. One or more enclave clients of the enclave may be generated by the enclave manager such that the enclave clients configured to provide one or more entry points into the enclave. One or more trusted application instances may be created in the enclave.

First claim

The invention claimed is:

1. A method for creating trusted applications stored in memory of a host computing device, the method comprising:
creating, by one or more processors of the host computing device, an enclave manager in an untrusted environment of the host computing device, the enclave manager including instructions for creating one or more enclaves, wherein the enclave manager is created by an application running in the untrusted environment and implemented on the one or more processors;
generating, by the one or more processors, an enclave in memory of the host computing device using the enclave manager;
generating, by the enclave manager implemented on the one or more processors, one or more enclave clients of the enclave in the untrusted environment, the one or more enclave clients configured to provide one or more entry points into the enclave; and
creating, by the one or more processors, one or more trusted application instances in the enclave.

2. The method of claim 1 , wherein the entry points include a plurality of different functions.

3. The method of claim 2 , wherein the plurality of different functions include one or more of an initialize function, a finalize function, a run function, a donate thread function, a handle signal function, and a destroy function.

4. The method of claim 3 , wherein the initialize function allows the one or more enclave clients to take system resources to run the one or more trusted application instances.

5. The method of claim 3 , wherein the finalize function allows the one or more enclave clients to relinquish system resources.

6. The method of claim 3 , wherein the run function allows the one or more enclave clients to execute functions of the one or more trusted application instances.

7. The method of claim 3 , wherein the donate thread function allows the one or more enclave clients to have an operating system of the host computing device provide a thread to enter the enclave.

8. The method of claim 3 , wherein the handle signal function allows the one or more enclave clients handle signals sent to the one or more trusted application instances.

9. The method of claim 3 , wherein the destroy function allows the one or more enclave clients to terminate the enclave.

10. The method of claim 1 , wherein the one or more enclave clients are further configured to allow code to run in the enclave.

11. The method of claim 1 , wherein generating the enclave includes using an application having a trusted application designation.

12. The method of claim 1 , further comprising using the enclave manager to maintain a hierarchical namespace by binding the enclave to an identifier in the hierarchical namespace.

13. The method of claim 1 , wherein the one or more trusted application instances includes code that stores sensitive data of an application running in the untrusted environment.

14. The method of claim 13 , wherein the one or more trusted application instances includes code that executes the sensitive data of the application.

15. The method of claim 1 , further comprising, using the enclave manager to provide platform services including a software-based clock.

16. The method of claim 1 , wherein the enclave is generated in a system having an isolation kernel and isolation capable hardware.

17. The method of claim 1 , wherein the enclave is generated in a system having hardware secure execution primitives and isolation capable hardware.

18. The method of claim 1 , wherein the enclave is generated in a system having a hardware secure element.

19. The method of claim 1 , wherein the enclave is generated in a system remote from the untrusted environment.

Assignees

• Google Llc

Inventors

• Gingell Matthew
• Gonda Peter
• Cope Alexander Thomas
• Karamov Sergey
• Moyer Keith
• Savagaonkar Uday
• Cai Chong

Classifications

• G06F21/12

  Protecting executable software · CPC title

• G06F21/62

  Protecting access to data via a platform, e.g. using keys or access control rules · CPC title

• H04L9/0897

  involving additional devices, e.g. trusted platform module [TPM], smartcard or USB · CPC title

• G06F21/74

  operating in dual or compartmented mode, i.e. at least one secure mode · CPC title

• G06F21/71

  to assure secure computing or processing of information · CPC title