TECHNIQUE FOR SUPPORTING MULTIPLE SECURE ENCLAVES

• US 20130232344A1
• Filed: 03/15/2013
• Published: 09/05/2013
• Est. Priority Date: 12/17/2010
• Status: Active Grant

• Current Assignee: Carlos V. Rozas, Francis X. Mckeen, Simon P. Johnson, Uday R. Savagaonkar, Vincent R. Scarlata
• Original Assignee: Carlos V. Rozas, Francis X. Mckeen, Simon P. Johnson, Uday R. Savagaonkar, Vincent R. Scarlata
• Inventors: Johnson, Simon P., Savagaonkar, Uday R., Scarlata, Vincent R., McKeen, Francis X., Rozas, Carlos V.
• Granted Patent: US 9,904,632 B2
• Time in Patent Office: Days
• US Class Current: 713/193
• CPC Class Codes: G06F 12/1466 Key-lock mechanism
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 21/645 using a third party

Abstract

A technique to enable secure application and data integrity within a computer system. In one embodiment, one or more secure enclaves are established in which an application and data may be stored and executed.

Claims

1. A system comprising:

logic to generate a platform-level key to provide for a secure enclave corresponding to a plurality of processors, wherein the platform-level key is derived from a plurality of processor-level keys corresponding to the plurality of processors.

2. The system of claim 1, wherein the plurality of processor-level keys correspond to a plurality of processor-level information, including current security version information, key recovery transformations, provisioning fuse key information and seal fuse key information.

3. The system of claim 2, wherein a portion of the processor-level information is to be used to derive a plurality of base ops keys and a plurality of platform wrap keys corresponding to the plurality of processors.

4. The system of claim 3, wherein the plurality of base ops keys and the plurality of platform wrap keys are to be used to generate the platform-level key.

5. The system of claim 1, wherein the plurality of processors is contained within a plurality of processor packages.

6. The system of claim 1, wherein the plurality of processors is contained within a single processor package.

7. The system of claim 1, wherein each of the plurality of processors is to store a plurality of package-unique symmetric keys (PUSKs).

8. The system of claim 7, wherein each of the plurality of processors is to store a plurality of package-specific asymmetric keys (PASKs).

9. The system of claim 8, wherein each of the plurality of processors is to store a plurality of device-unique provisioning identifications (DPIDs).

10. The system of claim 9, wherein the plurality of DPIDs is to be derived from the plurality of PUSKs.

11. A method comprising:

generating a multi-package secure enclave key, common to a plurality of a processors;

storing the multi-package secure enclave key.

12. The method of claim 11 further comprising storing a package unique symmetric key (PUSK) into the plurality of processors to be used in the multi-package secure enclave.

13. The method of claim 12, further comprising creating a plurality of package-specific asymmetric keys (PASKs) for each of the plurality of processors.

14. The method of claim 13, further comprising encrypting the plurality of PASKs using a key derived from the corresponding plurality of PUSKs and a corresponding plurality of device-unique provisioning identifiers (DPIDs).

15. The method of claim 14, further comprising exposing the plurality of DPIDs and PUSKs to software by storing them into a storage area accessible by the software.

16. The method of claim 15, further comprising sending a common key to each of the plurality of processors.

17. The method of claim 16, further comprising authenticating each of the plurality of processors and creating a shared secret code among the plurality of processors.

18. The method of claim 17, wherein each of the plurality of processors uses a key derived from the PUSK to authenticate the common key.

19. The method of claim 18, furthering comprising using the information derived from the common key to secure a platform identity key.