Processor extensions for execution of secure embedded containers

Patent metadata

Field	Value
Publication number	US-9442865-B2
Application number	US-201615000081-A
Country	US
Kind code	B2
Filing date	Jan 19, 2016
Priority date	Dec 31, 2008
Publication date	Sep 13, 2016
Grant date	Sep 13, 2016

Abstract

Methods and apparatus relating to processor extensions for execution of secure embedded containers are described. In an embodiment, a scalable solution for manageability function is provided, e.g., for UMPC environments or otherwise where utilizing a dedicated processor or microcontroller for manageability is inappropriate or impractical. For example, in an embodiment, an OS (Operating System) or VMM (Virtual Machine Manager) Independent (generally referred to herein as “OI”) architecture involves creating one or more containers on a processor by dynamically partitioning resources (such as processor cycles, memory, devices) between the HOST OS/VMM and the OI container. Other embodiments are also described and claimed.

First claim

What is claimed is:

1. A processor system comprising:
one or more processor cores;
a secure memory to store a key page mapped to physical addresses from an Operating System (OS) independent memory partition, having an execution environment that is managed independent of an operating system and a virtual machine manager; and
a cryptographic processor key configured to be accessed by an OS Independent (OI) Resource Manager (OIRM) to perform cryptographic operations, wherein an application running on the processor from outside the OI memory partition can invoke a blob service provided by the OIRM to create a key blob to access the key page inside the OI memory partition.

2. The processor system of claim 1 , wherein the OIRM is to dynamically partition cycles of the processor between executing operations or instructions from inside the OI memory partition and from outside the OI memory partition.

3. The processor system of claim 2 , wherein the OIRM is to allocate a minimum guaranteed execution duration for one or more instructions stored in the OI memory partition based on a determination that OIRM has failed to schedule the one or more instructions for execution within a select time period.

4. The processor system of claim 1 , wherein responsive to an instruction for loading the key page from said application running on the processor from outside the OI memory partition, the OIRM is to copy data from the key page into the secure memory and decrypt the data in the secure memory using said key blob.

5. The processor system of claim 4 , wherein further responsive to the instruction for loading the key page from said application running on the processor from outside the OI memory partition, the OIRM is to update an extended page table (EPT) to redirect accesses, from the physical addresses mapped to the key page in the OI memory partition, to physical addresses mapped to the secure memory.

6. The processor system of claim 4 , wherein further responsive to the instruction for loading the key page from said application running on the processor from outside the OI memory partition, the OIRM is to decrypt said key blob using the cryptographic processor key and decrypt the data in the on-package memory using the decrypted key blob.

7. The processor system of claim 1 , wherein responsive to an instruction for storing the key page from said application running on the processor from outside the OI memory partition, the OIRM is to encrypt the data in the secure memory using said key blob and copy the encrypted data from the secure memory to the key page in the OI memory partition.

8. The processor system of claim 7 , wherein further responsive to the instruction for storing the key page from said application running on the processor from outside the OI memory partition, the OIRM is to decrypt said key blob using the cryptographic processor key and encrypt the data in the secure memory using the decrypted key blob.

9. The processor system of claim 1 , wherein the OIRM is to maintain an integrity check value array to store data corresponding to one or more pages of the OI memory partition, wherein each entry in the array is to indicate a secure hash algorithm value, a validity, and direct memory access of a corresponding page in the OI memory partition.

10. The processor system of claim 9 , wherein the OIRM is to determine integrity of the one or more pages of the first partition based on values stored in a corresponding entry of the integrity check value array.

11. The processor system of claim 10 , wherein the OIRM is to cause an update to a value stored in the integrity check value array in response to detection of a modification to a corresponding page of the OI memory partition.

12. A computer-implemented method comprising:
storing, in a secure memory, a key page mapped to physical addresses from an Operating System (OS) independent memory partition, having an execution environment that is managed independent of an operating system and a virtual machine manager;
accessing a cryptographic processor key by an OS Independent (OI) Resource Manager (OIRM) to perform a cryptographic operation;
storing said key page inside the OI memory partition; and
invoking a blob service provided by the OIRM for an application from outside the OI memory partition to create a key blob to access said key page mapped to physical addresses inside the OI memory partition.

13. The computer-implemented method of claim 12 , wherein the OIRM is to maintain an integrity check value array to store data corresponding to one or more pages of the OI memory partition, wherein each entry in the array is to indicate a secure hash algorithm value, a validity, and direct memory access of a corresponding page in the OI memory partition.

14. The computer-implemented method of claim 13 , wherein the OIRM is to determine integrity of the one or more pages of the first partition based on values stored in a corresponding entry of the integrity check value array.

15. The computer-implemented method of claim 13 , wherein the OIRM is to cause an update to a value stored in the integrity check value array in response to detection of a modification to a corresponding page of the OI memory partition.

Assignees

• Intel Corp

Inventors

• Shanbhogue Vedvyas
• Kumar Arvind
• Goel Purushottam

Classifications

• H04L9/14

  using a plurality of keys or algorithms · CPC title

• G06F2009/45579

  I/O management, e.g. providing access to device drivers or storage · CPC title

• H04L63/168

  above the transport layer · CPC title

• H04L9/3242

  involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC · CPC title

• G06F9/5077

  Logical partitioning of resources; Management or configuration of virtualized resources (specific details on emulation or internal functioning of virtual machines G06F9/455) · CPC title