Technique for supporting multiple secure enclaves

• US 8,972,746 B2
• Filed: 12/17/2010
• Issued: 03/03/2015
• Est. Priority Date: 12/17/2010
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Johnson, Simon P., Savagaonkar, Uday R., Scarlata, Vincent R., McKeen, Francis X., Rozas, Carlos V.
• Primary Examiner(s): Pwu, Jeffrey
• Assistant Examiner(s): AMORIN, CARLOS E
• Application Number:
  US12/972,406
• Publication Number:
  US 20120159184A1
• Time in Patent Office: 1,537 Days
• US Class Current: 713/189
• CPC Class Codes: G06F 12/1466 Key-lock mechanism
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 21/645 using a third party

Abstract

A technique to enable secure application and data integrity within a computer system. In one embodiment, one or more secure enclaves are established in which an application and data may be stored and executed.

Claims

1. A system comprising:

hardware logic to generate a platform-level key to provide for a secure enclave corresponding to a plurality of processors, wherein the platform-level key is to be derived from a plurality of processor-level keys corresponding to the plurality of processors, wherein each of the plurality of processors is to store a plurality of package-unique symmetric keys (PUSKs) and a plurality of package-specific asymmetric keys (PASKs), and wherein the secure enclave is to be executed from an enclave page cache in which data is to be protected using access control mechanisms to be provided by at least one processor of the plurality of processors having an instruction set architecture including a plurality of secure enclave instructions.

2. The system of claim 1, Wherein the plurality of processors is contained within a plurality of processor packages.

3. The system of claim 1, wherein the plurality of processors is contained within a single processor package.

4. A method comprising:

generating, by hardware logic, a multi-package secure enclave key, common to a plurality of processors;

storing the multi-package secure enclave key;

storing a package-unique symmetric key (PUSK) into the plurality of processors to be

used in a multi-package secure enclave, and

creating a plurality of package-specific asymmetric keys (PASKs) for each of the plurality of processors,

wherein a secure enclave is to be executed from an enclave page cache in which data is to

be protected using access control mechanisms to be provided by at least one processor of

the plurality of processors having an instruction set architecture including a plurality of

secure enclave instructions.