Techniques and technologies to address malicious single-stepping and zero-stepping of trusted execution environments

Patent metadata

Field	Value
Publication number	US-2022012369-A1
Application number	US-202117485077-A
Country	US
Kind code	A1
Filing date	Sep 24, 2021
Priority date	Sep 24, 2021
Publication date	Jan 13, 2022
Grant date	—

Abstract

In one embodiment, an apparatus comprises a processing circuitry to detect an occurrence of at least one of a single-stepping event or a zero-stepping event in an execution thread on an architecturally protected enclave and in response to the occurrence, implement at least one mitigation process to inhibit further occurrences of the at least one of a single-stepping event or a zero-stepping event in the architecturally protected enclave.

First claim

What is claimed is:

1 . An apparatus comprising a processing circuitry to:
detect an occurrence of at least one of a single-stepping event or a zero-stepping event in an execution thread on an architecturally protected enclave; and in response to the occurrence, implement at least one mitigation process to inhibit further occurrences of the at least one of a single-stepping event or a zero-stepping event in the architecturally protected enclave.

2 . The apparatus of claim 1 , comprising circuitry to:
implement a counter to monitor forward progress of the compute process which is to execute in the architecturally protected enclave; and generate an error signal when the counter indicates that the forward progress is less than a threshold.

3 . The apparatus of claim 1 , comprising circuitry to:
monitor a frequency of fault events in the execution thread on the architecturally protected enclave; monitor a number instructions that execute between an occurrence of fault events in the execution thread on the architecturally protected enclave; and generate an error signal when a frequency of the fault events is greater than a threshold.

4 . The apparatus processor of claim 1 , comprising circuitry to:
detect a page fault within a locked region of a computer-readable memory in the architecturally protected enclave; and in response to the page fault, generate an error signal.

5 . The apparatus of claim 1 , comprising circuitry to:
implement a counter to monitor a number of asynchronous enclave exit (AEX) events that occur in the architecturally protected enclave; and generate an error signal when the number of asynchronous enclave exit (AEX) events is greater than a threshold.

6 . The apparatus of claim 1 , comprising circuitry to:
determine one or more memory addresses to be accessed by one or more instructions to be executed by the architecturally protected enclave following an asynchronous enclave exit (AEX) event on the architecturally protected enclave; and initiate a prefetch operation to access the one or more memory addresses.

7 . The apparatus of claim 1 , comprising circuitry to:
initiate a branch speculation process for the execution thread to warm up a cache memory.

8 . A method comprising:
detecting an occurrence of at least one of a single-stepping event or a zero-stepping event in an execution thread on an architecturally protected enclave; and in response to the occurrence, implementing at least one mitigation process to inhibit further occurrences of the at least one of a single-stepping event or a zero-stepping event in the architecturally protected enclave.

9 . The method of claim 8 , further comprising:
implementing a counter to monitor forward progress of the compute process which is to execute in the architecturally protected enclave; and generating an error signal when the counter indicates that the forward progress is less than a threshold.

10 . The method of claim 8 , further comprising:
monitoring a frequency of fault events in the execution thread on the architecturally protected enclave; monitoring a number instructions that execute between an occurrence of fault events in the execution thread on the architecturally protected enclave; and generating an error signal when a frequency of the fault events is greater than a threshold.

11 . The method of claim 8 , further comprising:
detecting a page fault within a locked region of a computer-readable memory in the architecturally protected enclave; and in response to the page fault, generating an error signal.

12 . The method of claim 8 , further comprising:
implementing a counter to monitor a number of asynchronous enclave exit (AEX) events that occur in the architecturally protected enclave; and generating an error signal when the number of asynchronous enclave exit (AEX) events is greater than a threshold.

13 . The method of claim 8 , further comprising:
determining one or more memory addresses to be accessed by one or more instructions to be executed by the architecturally protected enclave following an asynchronous enclave exit (AEX) event on the architecturally protected enclave; and initiating a prefetch operation to access the one or more memory addresses.

14 . The method of claim 8 , further comprising:
initiating a branch speculation process for the execution thread to warm up a cache memory.

15 . A non-transitory machine readable medium that stores code that when executed by a machine causes the machine to:
detect an occurrence of at least one of a single-stepping event or a zero-stepping event in an execution thread on an architecturally protected enclave; and in response to the occurrence, implement at least one mitigation process to inhibit further occurrences of the at least one of a single-stepping event or a zero-stepping event in the architecturally protected enclave.

16 . The non-transitory machine readable medium of claim 15 , comprising code that when executed by a machine causes the machine to:
implement a counter to monitor forward progress of the compute process which is to execute in the architecturally protected enclave; and generate an error signal when the counter indicates that the forward progress is less than a threshold.

17 . The non-transitory machine readable medium of claim 15 , comprising code that when executed by a machine causes the machine to:
monitor a frequency of fault events in the execution thread on the architecturally protected enclave; monitor a number instructions that execute between an occurrence of fault events in the execution thread on the architecturally protected enclave; and generate an error signal when a frequency of the fault events is greater than a threshold.

18 . The non-transitory machine readable medium of claim 15 , comprising code that when executed by a machine causes the machine to:
detect a page fault within a locked region of a computer-readable memory in the architecturally protected enclave; and in response to the page fault, generate an error signal.

19 . The non-transitory machine readable medium of claim 15 , comprising code that when executed by a machine causes the machine to:
implement a counter to monitor a number of asynchronous enclave exit (AEX) events that occur in the architecturally protected enclave; and generate an error signal when the number of asynchronous enclave exit (AEX) events is greater than a threshold.

20 . The non-transitory machine readable medium of claim 15 , comprising code that when executed by a machine causes the machine to:
determine one or more memory addresses to be accessed by one or more instructions to be executed by the architecturally protected enclave following an asynchronous enclave exit (AEX) event on the architecturally protected enclave; and initiate a prefetch operation to access the one or more memory addresses.

21 . The non-transitory machine readable medium of claim 15 , comprising code that when executed by a machine causes the machine to:
initiate a branch speculation process for the execution thread to warm up a cache memory.

Assignees

• Intel Corp

Inventors

• Constable Scott
• Xiao Yuan
• Xing Bin
• Vij Mona
• Shanahan Mark

Classifications

• G06F2201/88

  Monitoring involving counting · CPC title

• G06F21/554

  involving event detection and direct action · CPC title

• G06F21/52

  during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} · CPC title

• G06F12/0811

  with multilevel cache hierarchies · CPC title

• G06F12/0842

  for multiprocessing or multitasking · CPC title