Technique for supporting multiple secure enclaves

• US 9,904,632 B2
• Filed: 03/15/2013
• Issued: 02/27/2018
• Est. Priority Date: 12/17/2010
• Status: Expired due to Fees

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Johnson, Simon P., Savagaonkar, Uday R., Scarlata, Vincent R., McKeen, Francis X., Rozas, Carlos V.
• Primary Examiner(s): Rahman, Mahfuzur
• Assistant Examiner(s): AMORIN, CARLOS E
• Application Number:
  US13/838,237
• Publication Number:
  US 20130232344A1
• Time in Patent Office: 1,810 Days
• Field of Search: 713189
• CPC Class Codes: G06F 12/1466 Key-lock mechanism
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 21/645 using a third party

Abstract

A technique to enable secure application and data integrity within a computer system. In one embodiment, one or more secure enclaves are established in which an application and data may be stored and executed.

Claims

1. A processor comprising:

a first processor-level key;

instruction hardware to support an instruction set architecture including a plurality secure enclave instructions, the plurality of secure enclave instructions including a first instruction to create a secure enclave and at least a second instruction to manage an enclave page cache;

execution hardware to execute the secure enclave from the enclave page cache;

access control hardware to protect data in the enclave page cache; and

key generation hardware to generate a platform-level key to provide for the secure enclave to correspond to a plurality of processors including the processor, wherein the platform-level key is to be derived from a plurality of processor-level keys corresponding to the plurality of processors and including the first processor-level key, wherein each of the plurality of processors is to store a plurality a package-unique symmetric keys (PUSKs) and a plurality of package-specific asymmetric keys (PASKs).

2. The processor of claim 1, wherein the plurality of processors is contained within a plurality of processor packages.

3. The processor of claim 1, wherein the plurality of processors is contained within a single processor package.