Technique for supporting multiple secure enclaves

Patent metadata

Field	Value
Publication number	US-8972746-B2
Application number	US-97240610-A
Country	US
Kind code	B2
Filing date	Dec 17, 2010
Priority date	Dec 17, 2010
Publication date	Mar 3, 2015
Grant date	Mar 3, 2015

Abstract

A technique to enable secure application and data integrity within a computer system. In one embodiment, one or more secure enclaves are established in which an application and data may be stored and executed.

First claim

The invention claimed is:

1. A system comprising:
hardware logic to generate a platform-level key to provide for a secure enclave corresponding to a plurality of processors, wherein the platform-level key is to be derived from a plurality of processor-level keys corresponding to the plurality of processors, wherein each of the plurality of processors is to store a plurality of package-unique symmetric keys (PUSKs) and a plurality of package-specific asymmetric keys (PASKs), and wherein the secure enclave is to be executed from an enclave page cache in which data is to be protected using access control mechanisms to be provided by at least one processor of the plurality of processors having an instruction set architecture including a plurality of secure enclave instructions.

2. The system of claim 1 , Wherein the plurality of processors is contained within a plurality of processor packages.

3. The system of claim 1 , wherein the plurality of processors is contained within a single processor package.

4. A method comprising:
generating, by hardware logic, a multi-package secure enclave key, common to a plurality of processors;
storing the multi-package secure enclave key;
storing a package-unique symmetric key (PUSK) into the plurality of processors to be
used in a multi-package secure enclave, and

creating a plurality of package-specific asymmetric keys (PASKs) for each of the plurality of processors,
wherein a secure enclave is to be executed from an enclave page cache in which data is to
be protected using access control mechanisms to be provided by at least one processor of
the plurality of processors having an instruction set architecture including a plurality of
secure enclave instructions.

Assignees

• Johnson Simon P
• Savagaonkar Uday R
• Scarlata Vincent R
• Mckeen Francis X
• Rozas Carlos V
• Intel Corp

Inventors

• Johnson Simon P
• Savagaonkar Uday R
• Scarlata Vincent R
• Mckeen Francis X
• Rozas Carlos V

Classifications

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• G06F12/1466 Primary

  Key-lock mechanism · CPC title

• G06F21/645

  using a third party · CPC title

• G06F21/53

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• G06F21/64

  Protecting data integrity, e.g. using checksums, certificates or signatures · CPC title