Mechanism to secure an execution environment in processor cores

Patent metadata

Field	Value
Publication number	US-12223064-B2
Application number	US-202217933866-A
Country	US
Kind code	B2
Filing date	Sep 21, 2022
Priority date	Sep 21, 2022
Publication date	Feb 11, 2025
Grant date	Feb 11, 2025

Abstract

Various embodiments include methods and devices for a secure execution environment in computing devices. Embodiments may include generating a binary executable file for execution in the secure execution environment by generating hashes of instructions of a function, inserting a start hash instruction and a stop hash instruction in object code of the function, and generating a binary executable having the function including the start hash instruction and the stop hash instruction. Embodiments may include implementing the secure execution environment by generating hashes of instructions of a function in parallel with executing the function, comparing the generated hashes of the instructions of the function to stored hashes of instructions of the function, and issuing an exception indicating to a processor that execution of the function is not secure for any difference between the generated hashes of the instructions of the function and the stored hashes of the instructions of the function.

First claim

What is claimed is:

1. A method of generating a binary executable for execution in a secure execution environment, comprising:
generating hashes of instructions of a function using an assembler;
inserting a start hash instruction and a stop hash instruction in object code of the function; and
generating a binary executable having the function including the start hash instruction and the stop hash instruction.

2. The method of claim 1 , wherein inserting the start hash instruction and the stop hash instruction in the object code of the function includes:
inserting the start hash instruction in a prologue of the function; and
inserting the stop hash instruction in an epilogue of the function.

3. The method of claim 1 , further comprising:
encrypting a program header for the hashes of the instructions of the function; and
storing the encrypted program header for the hashes of the instructions of the function to a dedicated memory.

4. The method of claim 1 , further comprising receiving an indication of a hash algorithm using a software development toolchain, wherein generating the hashes of the instructions of the function comprises generating the hashes of the instructions of the function using the indicated hash algorithm.

5. The method of claim 1 , further compromising:
receiving a private key using a software development toolchain; and
encrypting a program header for the hashes of the instructions of the function using an encryption algorithm and the private key.

6. The method of claim 1 , further compromising:
receiving an indication of an encryption algorithm using a software development toolchain; and
encrypting a program header for the hashes of the instructions of the function using the indicated encryption algorithm.

7. The method of claim 1 , wherein;
inserting the start hash instruction and the stop hash instruction in the object code of the function comprises inserting the start hash instruction and the stop hash instruction in the object code of the function using the assembler; and
generating the binary executable having the function including the start hash instruction and the stop hash instruction comprises generating the binary executable having the function including the start hash instruction and the stop hash instruction using a linker.

8. A computing device, comprising:
a memory; and
a processor coupled to the memory and configured to:
generate hashes of instructions of a function using an assembler;
insert a start hash instruction and a stop hash instruction in object code of the function; and
generate a binary executable having the function including the start hash instruction and the stop hash instruction.

9. The computing device of claim 8 , wherein the processor is further configured to cause the processor to insert the start hash instruction and the stop hash instruction in the object code of the function in a manner that:
inserts the start hash instruction in a prologue of the function; and
inserts the stop hash instruction in an epilogue of the function.

10. The computing device of claim 8 , wherein the processor is further configured to:
encrypt a program header for the hashes of the instructions of the function; and
store the encrypted program header for the hashes of the instructions of the function in the memory.

11. The computing device of claim 8 , wherein the processor is further configured to:
receive an indication of a hash algorithm at a software development toolchain; and
generate the hashes of the instructions of the function using the indicated hash algorithm.

12. The computing device of claim 8 , wherein the processor is further configured to:
receive a private key at a software development toolchain; and
encrypt a program header for the hashes of the instructions of the function using an encryption algorithm and the private key.

13. The computing device of claim 8 , wherein the processor is further configured to:
receive an indication of an encryption algorithm at a software development toolchain; and
encrypt a program header for the hashes of the instructions of the function using the indicated encryption algorithm.

14. The computing device of claim 8 , wherein the processor is further configured to:
insert the start hash instruction and the stop hash instruction in the object code of the function using the assembler; and
generate the binary executable having the function including the start hash instruction and the stop hash instruction using a linker.

Assignees

• Qualcomm Inc

Inventors

• Kumar Sachin

Classifications

• G06F21/54

  by adding security routines or objects to programs · CPC title

• G06F21/53

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• G06F21/107

  License processing; Key processing · CPC title

• G06F21/602 Primary

  Providing cryptographic facilities or services · CPC title

• G06F21/57 Primary

  Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities · CPC title