Identification and execution of subsets of a plurality of instructions in a more secure execution environment

Patent metadata

Field	Value
Publication number	US-9465946-B2
Application number	US-201213997899-A
Country	US
Kind code	B2
Filing date	Jun 1, 2012
Priority date	Jun 1, 2012
Publication date	Oct 11, 2016
Grant date	Oct 11, 2016

Abstract

Embodiments of apparatus, computer-implemented methods, systems, devices, and computer-readable media are described herein for identifying and encrypting a subset of a plurality of instructions, for execution in a more secure execution environment. In various embodiments, the subset may include a single entry point and a single exit point. In various embodiments, one or more instructions of the plurality of instructions that precede or follow the subset may be executed in a first execution environment with a first security level. In various embodiments, the subset may be executed in a second execution environment with a second security level that is more secure than the first security level.

First claim

What is claimed is:

1. At least one non-transitory computer-readable medium having computer-readable code embodied therein, the computer-readable code configured to enable a computing device, in response to execution of the code, to:
identify and encrypt a first subset of a first plurality of instructions, wherein the first subset comprises a basic block including a second plurality of instructions of the first plurality of instructions, wherein the basic block includes only a single entry point and only a single exit point, to enable one or more instructions of the first plurality of instructions that precede or follow the first subset to be executed in a first execution environment with a first security level, and to enable the first subset to be executed in a second execution environment with a second security level that is more secure than the first security level;
identify and encrypt a second subset; and
concatenate the first and second subsets, the first and second subsets to be executed in the second execution environment; and
generate an index of the concatenated first and second subsets, the index to include a relative virtual address associated with at least one of the first and second subsets.

2. The at least one computer-readable medium of claim 1 , wherein the code, in response to execution by the computing device, further enables the computing device to associate, with the first subset, one or more instructions to return execution from the second execution environment to the first execution environment.

3. The at least one computer-readable medium of claim 1 , wherein the code, in response to execution by the computing device, further enables the computing device to add, to the first plurality of instructions before the first subset, one or more instructions to initialize the second execution environment.

4. The at least one computer-readable medium of claim 1 , wherein the code, in response to execution by the computing device, further enables the computing device to add, to the first plurality of instructions, one or more instructions to preserve an execution context prior to redirection of execution from the first execution environment to the second execution environment.

5. The at least one computer-readable medium of claim 4 , wherein the code, in response to execution by the computing device, further enables the computing device to add, to the first plurality of instructions, one or more instructions to restore the execution context after execution returns to the first execution environment from the second execution environment.

6. The at least one computer-readable medium of claim 1 , wherein the code, in response to execution by the computing device, further enables the computing device to generate an index of the concatenated first and second subsets, the index to include a size and offset associated with at least one of the first and second subsets.

7. The at least one computer-readable medium of claim 1 , wherein the code, in response to execution by the computing device, further enables the computing device to generate a dispatcher routine to be invoked upon redirection of execution into the second execution environment, the dispatcher routine to invoke the first subset and redirect execution back to the first execution environment after execution of the second subset.

8. At least one non-transitory computer-readable medium having computer-readable code embodied therein, the computer-readable code comprising:
a first set of instructions to be executed in a first execution environment of a computing device with a first security level;
a second set of instructions, that includes a plurality of instructions, wherein the plurality of instructions includes only a single entry point and only a single exit point, to be executed in a second execution environment of the computing device with a second security level that is more secure than the first security level;
a third set of instructions, that includes a single entry point and a single exit point, to be executed in the second execution environment, wherein the second and third sets of instructions are encrypted and concatenated; and
an index of the concatenated second and third sets of instructions that comprises a relative virtual address associated with at least one of the second and third sets; and
wherein the first set of instructions includes at least one instruction to redirect execution to the second execution environment and at least one instruction to preserve an execution context prior to redirection of execution to the second execution environment, and wherein the second set of instructions includes at least one instruction to restore the execution context.

9. The at least one computer-readable medium of claim 8 , wherein the first set of instructions includes, prior to the at least one instruction to redirect execution to the second execution environment, one or more instructions to initialize the second execution environment.

10. The at least one computer-readable medium of claim 8 , wherein the index further comprises a size and offset associated with at least one of the first and second sets.

11. The at least one computer-readable medium of claim 8 , further comprising one or more instructions that form a dispatcher routine, the dispatcher routine to be invoked upon redirection of execution into the second execution environment, the dispatcher routine to invoke the second set of instructions and redirect execution back to the first execution environment after execution of the second set of instructions.

12. The at least one computer-readable medium of claim 11 , wherein the second set of instructions is encrypted, the medium further comprising one or more instructions that form an initializer routine to be executed in the second execution environment, the initializer routine to decrypt the second set of instructions.

13. The at least one computer-readable medium of claim 12 , wherein the dispatcher routine includes one or more instructions to restore an execution context prior to invocation of the second set of instructions and to preserve the execution context after execution of the second set of instructions.

14. A computer-implemented method, comprising:
identifying and extracting, by a computing device, a first subset of a first plurality of instructions, wherein the first subset comprises a basic block including a second plurality of instructions, wherein the basic block includes only a single entry point and only a single exit point;
adding, by the computing device, to the first plurality of instructions in place of the extracted first subset, one or more instructions to redirect execution from a first execution environment with a first security level to a second execution environment with a second security level that is more secure than the first security level;
adding, by the computing device, the first subset to a third plurality of instructions to be executed in the second execution environment, wherein the first plurality of instructions is to be executed in the first execution environment;
encrypting, by the computing device, the first subset;
identifying and encrypting, by the computing device, a second subset of the plurality of instructions; and
concatenating, by the computing device, the first and second subsets;
generating, by the computing device, an index of the concatenated first and second subsets, the index to include a relative virtual address associated with at least one of the first and second subsets; and
adding, by the computing device, to the third plurality of instructions, one or more instructions to redirect executio

Assignees

• Goffman Sergei
• Berenzon Alex
• Lenz Oron
• Devor Tevi
• Zhang Bo
• Zahavi Yoram
• Maor Moshe
• Intel Corp

Inventors

• Goffman Sergei
• Berenzon Alex
• Lenz Oron
• Devor Tevi
• Zhang Bo
• Zahavi Yoram
• Maor Moshe

Classifications

• G06F21/125 Primary

  by manipulating the program code, e.g. source code, compiled code, interpreted code, machine code · CPC title

• G06F21/53

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• G06F21/54

  by adding security routines or objects to programs · CPC title

• G06F21/602 Primary

  Providing cryptographic facilities or services · CPC title