Methods and apparatus to initialize enclaves on target processors

• US 10,354,095 B2
• Filed: 03/31/2016
• Issued: 07/16/2019
• Est. Priority Date: 03/31/2016
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Xing, Bin
• Primary Examiner(s): Bansal, Gurtej
• Application Number:
  US15/087,029
• Publication Number:
  US 20170286721A1
• Time in Patent Office: 1,202 Days
• CPC Class Codes: G06F 12/00 Accessing, addressing or allocating within memory systems or architectures digital input from, or digital output to record carriers, e.g. to disk storage units, G06F3/06
• CPC Class Codes: G06F 21/71 to assure secure computing or processing of information
• CPC Class Codes: G06F 21/74 operating in dual or compartmented mode, i.e. at least one secure mode
• CPC Class Codes: G06F 9/44505 Configuring for program initiating, e.g. using registry, configuration files

Abstract

Methods, apparatus, systems and articles of manufacture are disclosed to initialize enclaves on target processors. An example apparatus includes an image file retriever to retrieve configuration parameters associated with an enclave file, and an address space manager to calculate a minimum virtual address space value for an enclave image layout based on the configuration parameters, and generate an optimized enclave image layout to allow enclave image execution on unknown target processor types by multiplying the minimum address space value with a virtual address factor to determine an optimized virtual address space value for the optimized enclave image layout.

Claims

1. An apparatus to generate a processor agnostic enclave image layout, comprising:

an image file retriever to retrieve configuration parameters associated with an enclave file; and

an address space manager to;

calculate a minimum virtual address space value for an enclave image layout based on the configuration parameters; and

generate an optimized enclave image layout to allow enclave image execution on unknown target processor types by multiplying the minimum address space value with a virtual address factor to determine an optimized virtual address space value for the optimized enclave image layout.

2. An apparatus as defined in claim 1, wherein the address space manager is to generate the optimized enclave image layout with static enclave components and the optimized virtual address space value prior to an instantiation phase to facilitate a measurement of the optimized enclave image layout.

3. An apparatus as defined in claim 1, further including a software guard extension (SGX) identifier to determine a type of a respective one of the unknown processor types.

4. An apparatus as defined in claim 3, wherein the type of the respective one of the unknown processor types includes at least one of a static SGX processor or a dynamic SGX processor.

5. An apparatus as defined in claim 1, wherein the image file retriever is to retrieve a number of candidate threads associated with the enclave file.

6. An apparatus as defined in claim 5, wherein the configuration parameters include a static heap size associated with the number of candidate threads associated with the enclave file.

7. An apparatus as defined in claim 6, wherein the address space manager is to calculate the minimum virtual address space value based on the number of candidate threads and the static heap size.

8. A method to generate a processor agnostic enclave image layout, comprising:

retrieving configuration parameters associated with an enclave file;

calculating a minimum virtual address space value for an enclave image layout based on the configuration parameters; and

generating an optimized enclave image layout to allow enclave image execution on unknown target processor types by multiplying the minimum address space value with a virtual address factor to determine an optimized virtual address space value for the optimized enclave image layout.

9. A method as defined in claim 8, further including determining a type of a respective one of the unknown processor types.

10. A method as defined in claim 8, further including generating the optimized enclave image layout with static enclave components and the optimized virtual address space value prior to an instantiation phase to facilitate a measurement of the optimized enclave image layout.

11. A method as defined in claim 10, wherein the measurement of the optimized enclave image layout is the same for all of the unknown processor types.

12. A method as defined in claim 8, further including retrieving a number of candidate threads associated with the enclave file.

13. A method as defined in claim 12, wherein the configuration parameters include a static heap size associated with the number of candidate threads associated with the enclave file.

14. A method as defined in claim 13, further including calculating the minimum virtual address space value based on the number of candidate threads and the static heap size.

15. At least one tangible computer-readable storage disk or storage device comprising instructions which, when executed, cause a processor to at least:

retrieve configuration parameters associated with an enclave file;

calculate a minimum virtual address space value for an enclave image layout based on the configuration parameters; and

generate an optimized enclave image layout to allow enclave image execution on unknown target processor types by multiplying the minimum address space value with a virtual address factor to determine an optimized virtual address space value for the optimized enclave image layout.

16. A tangible computer-readable storage disk or storage device as defined in claim 15, wherein the instructions, when executed, further cause the processor to retrieve a number of candidate threads associated with the enclave file.

17. A tangible computer-readable storage disk or storage device as defined in claim 15, wherein the instructions, when executed, further cause the processor to generate the optimized enclave image layout with static enclave components and the optimized virtual address space value prior to an instantiation phase to facilitate a measurement of the optimized enclave image layout.

18. A tangible computer-readable storage disk or storage device as defined in claim 17, wherein the instructions, when executed, further cause the processor to create the measurement of the optimized enclave image layout as the same for all of the unknown processor types.

19. A tangible computer-readable storage disk or storage device as defined in claim 15, wherein the instructions, when executed, further cause the processor to determine a type of a respective one of the unknown processor types.

20. A tangible computer-readable storage disk or storage device as defined in claim 19, wherein the instructions, when executed, further cause the processor to associate the optimized enclave image layout with a target enclave instruction set based on the determined type of the respective one of the unknown processor types.