User mode heap swapping

• US 9,678,687 B2
• Filed: 09/25/2015
• Issued: 06/13/2017
• Est. Priority Date: 09/25/2015
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Sambandam, Venkata Ramanan, Woodward, Carl D., Rubakha, Dmitri
• Primary Examiner(s): Bertram, Ryan
• Application Number:
  US14/866,295
• Publication Number:
  US 20170090821A1
• Time in Patent Office: 627 Days
• CPC Class Codes: G06F 12/023 Free address space management
• CPC Class Codes: G06F 12/08 in hierarchically structured memory systems, e.g. virtual memory systems
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 12/1491 in a hierarchical protection system, e.g. privilege levels, memory rings
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/74 operating in dual or compartmented mode, i.e. at least one secure mode
• CPC Class Codes: G06F 2212/1016 Performance improvement
• CPC Class Codes: G06F 2212/1052 Security improvement
• CPC Class Codes: G06F 2212/152 Virtualized environment, e.g. logically partitioned system
• CPC Class Codes: G06F 3/0623 in relation to content
• CPC Class Codes: G06F 3/0631 by allocating resources to storage systems
• CPC Class Codes: G06F 3/064 Management of blocks
• CPC Class Codes: G06F 3/0647 Migration mechanisms
• CPC Class Codes: G06F 3/0656 Data buffering arrangements
• CPC Class Codes: G06F 3/0659 Command handling arrangements, e.g. command buffers, queues, command scheduling
• CPC Class Codes: G06F 3/0673 Single storage device
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853

Abstract

In an example, there is disclosed a computing apparatus, including a processor, including a trusted execution instruction set; a memory having an enclave portion, wherein the enclave is accessible only via the trusted execution instruction set; a swap file; and a memory management engine operable to: allocate a buffer within the enclave; receive a scope directive to indicate that the buffer is in scope; and protect the buffer from swapping to the swap file while the buffer is in scope. There is further disclosed an method of providing a memory management engine, and one or more computer-readable storage mediums having stored thereon executable instructions for providing the memory management engine.

Claims

1. A computing apparatus, comprising:

a processor to provide a trusted execution instruction set;

a memory having an enclave portion, wherein the enclave is accessible only via the trusted execution instruction set;

a swap file; and

one or more logic elements comprising a memory management engine operable to;

allocate a buffer within the enclave;

receive a scope directive to indicate that the buffer is in scope; and

protect the buffer from swapping to the swap file while the buffer is in scope.

2. The computing apparatus of claim 1, wherein the memory management engine is operable to detect that the buffer is out of scope, and to enable swapping of the buffer to the swap file.

3. The computing apparatus of claim 2, wherein the memory management engine is operable to swap the buffer to the swap file.

4. The computing apparatus of claim 3, wherein swapping the buffer to the swap file comprises encrypting the buffer.

5. The computing apparatus of claim 1, wherein the memory management engine is operable to:

determine that the buffer has been swapped to the swap file; and

retrieve the buffer from the swap file.

6. The computing apparatus of claim 5, wherein retrieving the buffer from the swap file comprises decrypting the buffer.

7. The computing apparatus of claim 1, wherein the memory management engine comprises a framework.

8. The computing apparatus of claim 7, wherein the framework is configured to encapsulate a pointer to the buffer.

9. The computing apparatus of claim 8, wherein encapsulating the pointer to the buffer comprises determining that the pointer previously pointed to a first memory location, determining that after having been swapped the pointer now points to a second memory location different from the first memory location, and updating the pointer to point to the second memory location.

10. The computing apparatus of claim 1, wherein the memory management engine is further operable to determine that the buffer was tampered with while swapped, and acting on the determining.

11. The computing apparatus of claim 10, wherein acting on the determining comprises taking a security action.

12. The computing apparatus of claim 11, wherein the security action is selected from the group consisting of crashing the application, throwing an exception, and reporting the tampering.

13. The computing apparatus of claim 1, wherein the memory management engine is further operable to allocate a plurality of heaps.

14. One or more tangible, non-transitory computer-readable storage mediums having stored thereon executable instructions for providing a memory management engine for a memory enclave accessible only via a trusted execution instruction set, the memory management engine operable to:

allocate a buffer within the enclave;

receive a scope directive to indicate that the buffer is in scope; and

protect the buffer from swapping to a swap file while the buffer is in scope.

15. The one or more tangible, non-transitory computer-readable mediums of claim 14, wherein the memory management engine is operable to detect that the buffer is out of scope, and to enable swapping of the buffer to the swap file.

16. The one or more tangible, non-transitory computer-readable mediums of claim 15, wherein the memory management engine is operable to swap the buffer to the swap file.

17. The one or more tangible, non-transitory computer-readable mediums of claim 16, wherein swapping the buffer to the swap file comprises encrypting the buffer.

18. The one or more tangible, non-transitory computer-readable mediums of claim 15, wherein the memory management engine is operable to:

determine that the buffer has been swapped to the swap file; and

retrieve the buffer from the swap file.

19. The one or more tangible, non-transitory computer-readable mediums of claim 18, wherein retrieving the buffer from the swap file comprises decrypting the buffer.

20. The one or more tangible, non-transitory computer-readable mediums of claim 14, wherein the memory management engine comprises a framework.

21. The one or more tangible, non-transitory computer-readable mediums of claim 20, wherein the framework is configured to encapsulate a pointer to the buffer.

22. The one or more tangible, non-transitory computer-readable mediums of claim 21, wherein encapsulating the pointer to the buffer comprises determining that the pointer previously pointed to a first memory location, determining that after having been swapped the pointer now points to a second memory location different from the first memory location, and updating the pointer to point to the second memory location.

23. The one or more tangible, non-transitory computer-readable mediums of claim 14, wherein the memory management engine is further operable to determine that the buffer was tampered with while swapped, and taking a security action.

24. A method of providing a memory management engine for a memory enclave accessible only via a trusted execution instruction set, comprising:

allocating a buffer within the enclave;

receiving a scope directive to indicate that the buffer is in scope; and

protecting the buffer from swapping to a swap file while the buffer is in scope.

25. The method of claim 24, further comprising detecting that the buffer is out of scope, and enabling swapping of the buffer to the swap file.