Hardware trusted execution environment reduces latency

Abstract

A processing system apparatus, method, program, and storage medium are provided that reduce latency when providing a trusted execution environment (TEE). In one embodiment, the TEE initialization phase involves multiple steps before the TEE begins execution. In addition to workload-specific initialization, workload-independent initialization, such as adding memory to the TEE, is performed. In a Function-as-a-Service (FaaS) environment, the majority of the TEE is workload-independent and, therefore, is executed before receiving a workload. For a particular class of workload, the specific steps executed during TEE initialization are identical. Thus, the common portion of the TEE initialization sequence is executed before the TEE is requested. When a TEE is requested for a workload within a class and the portion that specializes the TEE for that particular purpose is known, the final step of initializing the TEE is performed.

Description

[Technical field]

[0001] The subject matter disclosed herein generally relates to a hardware Trusted Execution Environment (TEE). In particular, the present disclosure addresses a system and method for reducing latency in a hardware TEE. [Background technology]

[0002] Hardware privilege levels may be used by the processor to limit memory access by applications running on the device. An operating system runs at a higher privilege level and can access all memory of the device and can define memory ranges for other applications. Applications running at lower privilege levels are limited to accessing memory within ranges defined by the operating system and cannot access the memory of other applications or the operating system. However, applications have no protection from a malicious or compromised operating system.

[0003] The TEE is enabled with processor protection that ensures that code and data loaded into the TEE is protected from access by code running outside the TEE. Thus, the TEE provides an isolated execution environment that prevents access to the data and code contained in the TEE at the hardware level from malicious software, including the operating system. [Brief description of the drawings]

[0004] Certain embodiments are illustrated by way of example, and not by way of limitation, in the figures of the accompanying drawings and in which:

[0005] [Figure 1]FIG. 1 is a network diagram illustrating a network environment suitable for a server to provide function-as-a-service using a TEE, according to some exemplary embodiments.

[0006] [Diagram 2] FIG. 1 is a block diagram of a Function-as-a-Service server, according to some exemplary embodiments, suitable for reducing latency of a TEE, according to some exemplary embodiments.

[0007] [Diagram 3] FIG. 1 is a block diagram of prior art ring-based memory protection.

[0008] [Figure 4] FIG. 1 is a block diagram of enclave-based memory protection suitable for reducing latency in a TEE according to some example embodiments.

[0009] [Diagram 5] FIG. 1 is a block diagram of a database schema, according to some example embodiments, suitable for use in reducing latency in a TEE.

[0010] [Figure 6] FIG. 1 is a block diagram of a sequence of operations performed in constructing a TEE according to some exemplary embodiments.

[0011] [Figure 7] 1 is a flowchart illustrating operations of a method suitable for initializing and providing access to a TEE, according to some exemplary embodiments.

[0012] [Figure 8] 1 is a flowchart illustrating operations of a method suitable for initializing and providing access to a TEE, according to some exemplary embodiments.

[0013] [Figure 9]1 is a flowchart illustrating operations of a method suitable for initializing and providing access to a TEE, according to some exemplary embodiments.

[0014] [Figure 10] FIG. 2 is a block diagram illustrating an example of a software architecture for a computing device.

[0015] [Figure 11] FIG. 1 is a block diagram of a machine in the example form of a computer system within which instructions may be executed to cause the machine to perform any one or more of the methodologies described herein. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0016] Exemplary methods and systems are directed to reducing latency in providing a TEE. In the most general sense, a TEE is any trusted execution environment, regardless of how that trust is obtained. However, as used herein, a TEE is provided by executing code within a portion of memory that is protected from access by processes outside the TEE, even if those processes are running at a high privilege level. Exemplary TEEs include enclaves created by Intel® Software Guard Extensions (SGX) and trust domains created by Intel® Trust Domain Extensions (TDX).

[0017] A TEE may be used to enable secure processing of sensitive information by protecting that information from all software outside the TEE. A TEE may be used for modular programming, where each module contains everything needed for its own functionality without exposure to vulnerabilities due to other modules. For example, a successful code injection attack against one TEE cannot affect the code of another TEE.

[0018] Total Memory Encryption (TME) protects data in memory from being accessed by bypassing the processor. The system generates an encryption key in the processor at boot time and does not store the key outside the processor. TME encryption keys are ephemeral because they do not persist across reboots and are not stored outside the processor. All data written to memory by the processor is encrypted using the encryption key and decrypted when read back from memory. Thus, hardware-based attacks that attempt to read data directly from memory without going through the processor will fail.

[0019] Multi-key TME (MKTME) extends TME to use multiple keys. Individual memory pages may be encrypted using either TME's ephemeral keys or using a software-provided key. This may provide more security than TME with respect to software-based attacks because an attacker must identify the specific key used by the target software, rather than having the processor automatically decrypt any memory accessed by the attacking software.

[0020] Initializing a TEE requires multiple steps before the TEE can begin execution, introducing latency for applications that repeatedly create and destroy TEEs. In addition to workload-specific initialization, workload-independent initialization, such as adding memory to the enclave, is performed. In function-as-a-service (FaaS) environments, most of the TEE is workload-independent and thus may be run before it receives any workload.

[0021] FaaS platforms provide cloud computing services that run application logic but do not store data. In contrast to platform-as-a-service (PaaS) hosting providers, FaaS platforms do not have server processes running constantly. As a result, an initial request to a FaaS platform may take longer to process than an equivalent request to a PaaS host, but it offers the benefits of reduced idle time and increased scalability. As described herein, reducing the latency of processing an initial request increases the attractiveness of a FaaS solution.

[0022] For a particular class of workload, certain steps performed during enclave initialization are identical. For example, each enclave in the class may use heap memory. Thus, the common parts of the enclave initialization sequence (e.g., adding heap memory) may be performed before the enclave is requested. The final steps of initializing the enclave are performed when an enclave is requested for a workload in the class and the parts that specialize the enclave for that particular purpose are known. This reduces latency compared to performing all initialization steps in response to an enclave request.

[0023] For a particular workload, a TEE may be initialized in advance. The TEE is considered a template TEE. When a TEE for a workload is requested, the template TEE is forked and a new copy is provided as the requested TEE. Forking an existing TEE is faster than creating a new TEE from scratch, reducing latency.

[0024] For a particular workload, a TEE may be pre-initialized and marked as read-only. The TEE is considered a template TEE. When a TEE for a workload is requested, a new TEE is created with read-only access to the template TEE. As long as the template TEE is read-only, multiple TEEs can safely access the template TEE. Latency is reduced because accessing the template TEE to create a new TEE is faster than creating a new TEE from scratch with all of the template TEE's code and data.

[0025] In some example embodiments, a FaaS image is used to create a TEE with a short-term key, as described herein. When a FaaS TEE is requested, an access-controlled key identifier is assigned to the short-term key, allowing rapid provisioning of the TEE in response.

[0026] Compared to existing methods of initializing enclaves, the methods and systems described herein reduce latency. The reduced latency may allow for additional functionality to be secured in the TEE, or for a more granular TEE to be used, or both, enhancing system security. Considering these effects in their entirety, one or more of the methodologies described herein may eliminate the need for certain efforts or resources that would otherwise be associated with initializing a TEE. Computing resources used by one or more machines, databases, or networks may be reduced as well. Examples of such computing resources include processor cycles, network traffic, memory usage, data storage capacity, power consumption, and cooling capacity.

[0027] FIG. 1 is a network diagram illustrating a network environment 100 suitable for a server providing function-as-a-service using a TEE, according to some example embodiments. The network environment 100 includes FaaS servers 110A and 110B, client devices 120A and 120B, and a network 130. The FaaS servers 110A and 110B provide functionality to the client devices 120A and 120B over the network 130. The client devices 120A and 120B may be devices of different tenants, such that each tenant wants to prevent other tenants from accessing its tenant-specific data and code. Thus, the FaaS servers 110A and 110B may use enclaves for each FaaS provided.

[0028] To reduce latency in providing functionality, systems and methods described herein for reducing latency in creating a TEE may be used. For example, a TEE for a functionality may be partially or entirely created by the FaaS server 110 before the functionality is requested by a client device 120.

[0029] FaaS servers 110A and 110B and client devices 120A and 120B, respectively, may be implemented in whole or in part on a computer system, as described below with respect to Figure 9. FaaS servers 110A and 110B may be collectively referred to as FaaS server 110, or generally as FaaS server 110. Client devices 120A and 120B may be collectively referred to as client devices 120, or generally as client devices 120.

[0030] Any of the machines, databases, or devices shown in FIG. 1 may be implemented in a general-purpose computer that is modified (e.g., configured or programmed) with software to become a special-purpose computer that performs the functions described herein for that machine, database, or device. For example, a computer system that may implement any one or more of the methodologies described herein is described below with respect to FIG. 9. As used herein, a "database" is a data storage resource that may store data structured as a text file, a table, a spreadsheet, a relational database (e.g., an object-relational database), a triple store, a hierarchical data store, a document-oriented NoSQL database, a file store, or any suitable combination thereof. A database may be an in-memory database. Furthermore, any two or more of the machines, databases, or devices shown in FIG. 1 may be combined into a single machine, database, or device, and the functionality described herein for any single machine, database, or device may be subdivided among multiple machines, databases, or devices.

[0031] The FaaS server 110 and the client devices 120 are connected by a network 130. The network 130 may be any network that enables communication between machines, databases, and devices. Thus, the network 130 may be a wired network, a wireless network (e.g., a mobile network or a cellular network), or any suitable combination thereof. The network 130 may include one or more portions that constitute a private network, a public network (e.g., the Internet), or any suitable combination thereof.

[0032] FIG. 2 is a block diagram of a FaaS server 110A according to some exemplary embodiments suitable for reducing the latency of a TEE according to some exemplary embodiments. The FaaS server 110A is shown as including a communication module 210, an untrusted component of an application 220, a trusted component of an application 230, a trust domain module 240, a quoting enclave 250, a shared memory 260, and a private memory 270, all configured to communicate with each other (e.g., via a bus, a shared memory, or a switch). Any one or more of the modules described herein may be implemented using hardware (e.g., a processor of a machine). For example, any module described herein may be implemented by a processor configured to perform the operations described herein for that module. Furthermore, any two or more of these modules may be combined into a single module, and the functionality described herein for a single module may be subdivided among multiple modules. Furthermore, according to various exemplary embodiments, modules described herein as being implemented within a single machine, database, or device may be distributed across multiple machines, databases, or devices.

[0033] The communications module 210 receives data sent to and transmits data from the FaaS server 110A. For example, the communications module 210 may receive a request to perform a function from the client device 120A. After the function is performed, the results of the function are provided to the client device 120A by the communications module 210. Communications sent and received by the communications module 210 may be mediated by the network 130.

[0034] Untrusted components 220 run outside the enclave, and are therefore vulnerable to attack if the operating system or other untrusted components are compromised. Trusted components 230 run inside the enclave, and therefore the data and code of trusted components 230 remain safe, even if the operating system or untrusted components 220 are compromised.

[0035] The trust domain module 240 creates and protects the enclave and is responsible for transferring execution between the untrusted component 220 and the trusted component 230. The trust domain module 240 may be provided with signed code and verifies that the code has not been modified since it was signed. The signed code is loaded into a portion of physical memory that is marked as part of the enclave. Hardware protection then prevents untrusted software from accessing, modifying, executing the enclave memory, or any suitable combination thereof. The code may be encrypted using a key available only to the trust domain module 240.

[0036] Once the trusted component 230 is initialized, the untrusted component 220 can invoke functions of the trusted component 230 using special processor instructions of the trust domain module 240 that transition from untrusted to trusted mode. The trusted component 230 performs parameter validation, and if the parameters are valid, performs the requested function and returns control to the untrusted component 220 via the trust domain module 240.

[0037] The trust domain module 240 may be implemented as one or more components of an Intel® hardware processor that provides Intel® SGX, Intel® TDX, AMD® Secure Encrypted Virtualization (SEV), ARM® TrustZone, or any suitable combination thereof. In Intel® SGX, attestation is a mechanism by which a third entity establishes that a software entity is running on an Intel® SGX-enabled platform that is protected inside an enclave, prior to provisioning secrets and protected data to that software. Attestation relies on the platform's ability to generate credentials that accurately reflect the signature of the enclave, including information about the safety of the enclave. The Intel® SGX architecture provides mechanisms to support two forms of attestation. There is a mechanism to create basic assertions between enclaves running on the same platform, supporting local attestation or intra-platform attestation, and another mechanism that then provides a foundation for attestation between the enclave and a remote third party.

[0038] The quoting enclave 250 generates an attestation for the enclave (e.g., the trusted component 230). The attestation is an evidence structure that uses asymmetric encryption and is supported by built-in processor capabilities to uniquely identify the attested enclave and the host (e.g., the FaaS server 110A). The attestation may be provided to the client device 120 via the communication module 210, allowing the client device 120 to verify that the trusted component 230 has not been compromised. For example, the processor may be manufactured with a built-in private key using hardware that prevents access to the key. Using this private key, the attestation structure may be signed by the processor, and the signature may be verified by the client device 120 using a corresponding public key issued by the hardware manufacturer. This allows the client device 120 to be assured that the enclave on the remote device (e.g., the FaaS server 110A) was indeed created without tampering.

[0039] Both untrusted components 220 and trusted components 230 can access and modify the shared memory 260, but only trusted components 230 can access and modify the private memory 270. Although only one untrusted component 220, one trusted component 230, and one private memory 270 are shown in FIG. 2, each application may have multiple trusted components 230, each with a corresponding private memory 270, and multiple untrusted components 220 that cannot access any of the private memories 270. Furthermore, multiple applications may run in separate memory spaces and thus separate shared memories 260. In this context, "shared" refers to memory that is accessible to all software and hardware that has access to the memory space (e.g., the application and its operating system), not necessarily all applications running on the system.

[0040] 3 is a block diagram 300 of prior art ring-based memory protection. Block diagram 300 includes applications 310 and 320 and an operating system 330. Operating system 330 executes processor commands at ring 0 (Intel® and AMD® processors), exception level 1 (ARM® processors), or an equivalent privilege level. Applications 310 and 320 execute processor commands at ring 3 (Intel® and AMD® processors), exception level 0 (ARM® processors), or an equivalent privilege level.

[0041] The hardware processor prevents code running at a lower privilege level from accessing memory outside of the memory range defined by the operating system. Thus, the code of application 310 cannot directly access the memory of application 320 or operating system 330 (as indicated by the "X" in FIG. 3). Operating system 330 exposes some functionality to applications 310 and 320 by predefining certain access points (e.g., call gates, SYSENTER / SYSEXIT instructions on Intel processors, SYSCALL / SYSRET instructions on AMD processors, or any suitable combination thereof or equivalent).

[0042] Because operating system 330 has access to all of the memory, applications 310 and 320 have no protection from a malicious operating system. For example, a competitor may modify the operating system before running application 310 in order to access the code and data of application 310, allowing reverse engineering.

[0043] Furthermore, if an application exploits a vulnerability in the operating system 330 and is able to elevate to the privilege level of the operating system, the application will be able to access all of the memory. For example, application 310, which normally cannot access the memory of application 320 (as shown by the X between applications 310 and 320 in FIG. 3), will be able to access the memory of application 320 after elevating to ring 0 or exception level 1. Thus, if a user is tricked into running a malicious program (e.g., application 310), the user's or application provider's private data may be accessed directly from the memory (e.g., bank passwords used by application 320).

[0044] 4 is a block diagram 400 of enclave-based memory protection suitable for reducing latency of a TEE according to some example embodiments. Block diagram 400 includes an application 410, an enclave 420, and an operating system 430. Operating system 430 executes processor commands at ring 0 (Intel® and AMD® processors), exception level 1 (ARM® processors), or an equivalent privilege level. Application 410 and enclave 420 execute processor commands at ring 3 (Intel® and AMD® processors), exception level 0 (ARM® processors), or an equivalent privilege level.

[0045] Operating system 430 allocates memory for enclave 420 and indicates to the processor the code and data to be loaded into enclave 420. However, once instantiated, operating system 430 cannot access the memory of enclave 420. Thus, even if operating system 430 is malicious or compromised, the code and data of enclave 420 remains safe.

[0046] Enclave 420 may provide functionality to application 410. Operating system 430 may control whether application 410 is permitted to call functions of enclave 420 (e.g., by using the ECALL instruction). Thus, a malicious application may be able to gain the ability to call functions of enclave 420 by compromising operating system 430. Nevertheless, the hardware processor prevents the malicious application from directly accessing the memory or code of enclave 420. Thus, while code within enclave 420 cannot assume that functions are being called correctly or by a non-attacker, code within enclave 420 has full control over parameter checking and other internal security measures and is only subject to its internal security vulnerabilities.

[0047] 5 is a block diagram of a database schema according to some example embodiments suitable for use in reducing latency in a TEE. Database schema 500 includes an enclave table 510. Enclave table 510 includes rows 530A, 530B, 530C, and 530D of format 520.

[0048] The format 520 of the enclave table 510 includes an enclave identifier field, a status field, a read-only field, and a template identifier field. Each of the rows 530A-530D stores data for a single enclave. The enclave identifier is a unique identifier for the enclave. For example, when an enclave is created, the trust domain module 240 may assign the next unused identifier to the created enclave. The status field indicates the status of the enclave, such as initializing (created but not yet ready for use), initialized (ready for use but not yet used), allocated (in use), etc. The read-only field indicates whether the enclave is read-only. The template identifier field contains the enclave identifier of another enclave to which this enclave has read-only access.

[0049] Thus, in the example of FIG. 5, four enclaves are shown in enclave table 510. One of the enclaves is initializing, two are initialized, and one is allocated. Enclave 0, row 530A, is a read-only enclave and is used as a template for enclave 1, row 530B. Thus, the processor prevents enclave 0 from executing, but enclave 1 can access enclave 0's data and code. Further enclaves may be created that also use enclave 0 as a template, allowing multiple enclaves to access enclave 0's data and code without increasing the amount of memory consumed. Enclaves 1-3, rows 530B-530D, are not read-only and thus may be executed.

[0050] 6 is a block diagram 600 of a sequence of operations performed by the trust domain module 240 in constructing a TEE, according to some example embodiments. As shown in FIG. 6, the sequence of operations includes ECREATE, EADD / EEXTEND, EINIT, EENTER, and FUNCTION START. The ECREATE operation creates the enclave. The EADD operation adds initial heap memory to the enclave. More memory may be added using the EEXTEND operation. The EINIT operation initializes the TEE for execution. The untrusted component 220 then transfers execution to the TEE by requesting the trust domain module 240 to perform an EENTER operation. Trusted FUNCTIONS of the TEE are executed by executing code within the TEE in response to a FUNCTION START CALL.

[0051] As shown in Figure 6, these operations may be divided in at least two ways. One division indicates that the ECREATE, EADD / EEXTEND, and EINIT operations are performed by the host application (e.g., untrusted component 220), and the EENTER operation transfers control to the TEE, which executes the FUNCTION. The other division indicates that the creation of the TEE and the allocation of heap memory for the TEE may be performed without regard to the particular code and data that is added to the TEE ("workload-independent operations"), but the initialization of the TEE and the subsequent invocation of TEE functions depend on the particular code and data that is loaded ("workload-dependent operations").

[0052] A pool of TEEs may be pre-initialized by performing workload independent operations before the TEE is requested. As used herein, a pre-initialized TEE is a TEE that has at least one operation started before the TEE is requested by an application. For example, a TEE may be created by an ECREATE operation before the TEE is requested. The workload dependent operations are performed in response to receiving a request for the TEE. Latency is reduced compared to solutions that do not perform workload independent operations before the request is received. In some example embodiments, the operations to pre-initialize the TEE are performed in parallel with receiving a request for the TEE. For example, an ECREATE operation for the TEE may be initiated and the request for the TEE is received before the ECREATE operation is completed. Thus, pre-initialization is defined not by completing workload independent operations a particular time before the request for the TEE is received, but by initiating workload independent operations before the request for the TEE is received.

[0053] In a FaaS environment, functions may share a common runtime environment that is workload independent and initialized before any workload-dependent operations are executed. The startup time of a FaaS function is an important metric for a FaaS service, because the shorter the startup time, the more adaptable the service can be.

[0054] 7 is a flow chart illustrating operations of a method 700 suitable for initializing and providing access to a TEE, according to some example embodiments. Method 700 includes operations 710, 720, 730, and 740. By way of example and not limitation, method 700 may be performed by FaaS server 110A of FIG. 1 using the modules, databases, and structures illustrated in FIGS. 2-4.

[0055] In operation 710, the trust domain module 240 pre-initializes a pool of enclaves. For example, the operations of creating an enclave and allocating heap memory for the enclave may be performed for each enclave in the pool of enclaves. In some example embodiments, the pool of enclaves includes between 16 and 512 enclaves, 16 enclaves, 32 enclaves, or 128 enclaves.

[0056] In various exemplary embodiments, enclaves in a pool of enclaves are partially pre-initialized or fully pre-initialized. A fully pre-initialized enclave has at least one workload-specific operation executed before the enclave is requested. A partially pre-initialized enclave has only workload-independent operations executed before the enclave is requested. Pre-initialized enclaves reduce the time to result for any enclave, but are particularly beneficial for transient, short-lived enclaves (e.g., FaaS workloads) where initialization overhead dominates the overall execution time.

[0057] A pre-initialized enclave may be created by forking or copying a template enclave. First, the template enclave is created with the desired state of the pre-initialized enclave. Then, for each of the enclaves in the pre-initialized pool, the template enclave is forked or copied. In some exemplary embodiments, the template enclave itself is part of the pool. In other exemplary embodiments, the template enclave is read-only, not executable, and is kept as a template for later use. The template enclave may contain the memory contents and layout of the FaaS.

[0058] The memory of each enclave in the pool of enclaves may be encrypted using a key stored in the processor. The key may be an ephemeral key (e.g., a TME ephemeral key) or a key with a key identifier accessible outside the processor. The trust domain module 240 or the MKTME module may generate the key and assign it to the enclave. Thus, the key itself is never exposed outside the processor. The enclave is assigned a portion of the physical memory. Memory access requests coming from the enclave's physical memory are associated with the enclave's key identifier and therefore the key. The processor does not apply the enclave's key to memory accesses from outside the enclave's physical memory. As a result, memory accesses by untrusted applications or components (e.g., untrusted component 220) can only receive the enclave's encrypted data or code.

[0059] In some example embodiments, a different ephemeral key without a key identifier (e.g., an MKTME key) is used to encrypt each enclave in the pool of enclaves. Then, when a FaaS enclave is requested, an access-controlled key identifier is assigned to the ephemeral key by the trust domain module 240, enabling rapid provisioning of the enclave in response.

[0060] At operation 720, the request for the enclave is received by the trust domain module 240. For example, the untrusted component 220 of the application may provide data identifying the enclave to the trust domain module 240 as part of the request. The data identifying the enclave may include a pointer to an address in the shared memory 260 that the untrusted component 220 can access.

[0061] The request may include a pre-computed hash value of the enclave and may indicate the portion of shared memory 260 that contains the enclave's code and data (e.g., a portion identified by an address and size included in the request). The trust domain module 240 may run a hash function on the binary memory state (e.g., the portion of shared memory 260 indicated in the request) to verify that the hash value provided in the request matches the calculated hash value. If the hash values ​​match, the trust domain module 240 has already verified that the indicated memory does in fact contain the requested enclave's code and data, and method 700 may continue. If the hash values ​​do not match, the trust domain module 240 may return an error value to prevent the modified memory from being loaded into the enclave.

[0062] In some example embodiments, the request includes an identifier for the template enclave. The trust domain module 240 creates the requested enclave with read-only permission to access the template enclave. This allows the requested enclave to read the template enclave's data and perform the template enclave's functions without modifying the template enclave's data or code. Thus, multiple enclaves may access the template enclave without contention, and the template enclave's data and code are stored only once (rather than once for each of multiple enclaves). As a result, less memory is copied during the creation of the accessing enclave, reducing latency.

[0063] In operation 730, trust domain module 240 selects an enclave from the pool of pre-initialized enclaves in response to the received request. Trust domain module 240 may modify the selected enclave by performing further operations on the selected enclave based on the data identifying the enclave received with the request, such as the workload-specific operations shown in FIG. 4. The further operations may include copying data or code from an address in shared memory 260 indicated in the request to private memory 270 allocated to the enclave.

[0064] In some example embodiments, the further operations include re-encrypting the physical memory allocated to the enclave with the new key. For example, in a pre-initialization step, the enclave's physical memory may have been encrypted using an ephemeral key, and the enclave may be re-encrypted using the enclave's unique key along with a corresponding unique key identifier. In systems where key identifiers are a finite resource (e.g., with a fixed number of available key identifiers), using the pre-initialized enclave's ephemeral key may increase the maximum size of the enclave's pool (e.g., to a size greater than the fixed number of available key identifiers). The further operations may include creating a secure extended page table (EPT) branch of the selected TEE that derives code mappings from the template TEE.

[0065] The trust domain module 240 responds to the request by providing access to the selected enclave (operation 740). For example, a unique identifier for the initialized enclave may be returned that can be used as a parameter to a subsequent request to the trust domain module 240 to execute a function within the enclave (e.g., an EENTER command).

[0066] Thereafter, the trust domain module 240 may determine that execution of the selected enclave is complete (e.g., in response to receiving an enclave termination command). Memory allocated to the completed enclave may be freed. Alternatively, the state of the completed enclave may be restored to a pre-initialized state and the enclave may be returned to the pool. For example, a template enclave may be copied onto the enclave, undo workload-specific operations may be performed, a checkpoint of the enclave may be performed before the workload-specific operations are performed, and a checkpoint restore may be performed after execution is complete, or any suitable combination thereof.

[0067] Compared to prior art implementations that do not perform pre-initialization of the enclave (operation 710) before receiving a request for the enclave (operation 720), the delay between receiving the request and providing access (operation 740) is reduced. The reduced latency allows for additional functionality to be secured in the enclave, or for more granular enclaves to be used, or both, thereby increasing system security. Furthermore, when the enclave is invoked by the client device 120 over the network 130, fewer processor cycles of the client device 120 are used while waiting for a response from the FaaS server 110, improving responsiveness and reducing power consumption.

[0068] 8 is a flow chart illustrating operations of a method 800 suitable for initializing and providing access to a TEE, according to some example embodiments. Method 800 includes operations 810, 820, 830, and 840. By way of example and not limitation, method 800 may be performed by FaaS server 110A of FIG. 1 using the modules, databases, and structures illustrated in FIGS. 2-4.

[0069] In operation 810, the trust domain module 240 creates a template enclave that is marked as read-only. For example, an enclave may be created entirely with code and data loaded into private memory 270. However, because template enclaves are read-only, the functionality of the template enclave cannot be directly invoked by untrusted components 220. Referring to enclave table 310 in Figure 3, row 330A shows a read-only template enclave.

[0070] At operation 820, the request for the enclave is received by the trust domain module 240. For example, the untrusted component 220 of the application may provide data identifying the enclave to the trust domain module 240 as part of the request. The data identifying the enclave may include a pointer to an address in the shared memory 260 that the untrusted component 220 can access.

[0071] In operation 830, in response to the received request, trust domain module 240 copies the template enclave to create the requested enclave. For example, trust domain module 240 may determine that the data identifying the enclave indicates that the requested enclave is for the same code and data as the template enclave. This determination may be based on a signature of the enclave code and data, a message authentication code (MAC) of the enclave code and data, asymmetric encryption, or any suitable combination thereof.

[0072] The trust domain module 240 responds to the request by providing access to the selected enclave (operation 840). For example, a unique identifier for the initialized enclave may be returned that can be used as a parameter for a subsequent request to the trust domain module 240 to execute a function within the enclave (e.g., an EENTER command).

[0073] Compared to prior art implementations that create an enclave in response to receiving a request for an enclave (operation 820) instead of creating the requested enclave by copying a template enclave (operation 830), the delay between receiving the request and providing access (operation 840) is reduced. The reduced latency allows for additional functionality to be secured in the enclave, or for more granular enclaves to be used, or both, thereby increasing system security. Furthermore, when an enclave is invoked by a client device 120 over the network 130, fewer processor cycles of the client device 120 are used while waiting for a response from the FaaS server 110, improving responsiveness and reducing power consumption.

[0074] 9 is a flow chart illustrating operations of a method 900 suitable for initializing and providing access to a TEE, according to some example embodiments. Method 900 includes operations 910, 920, 930, and 940. By way of example and not limitation, method 900 may be performed by FaaS server 110A of FIG. 1 using the modules, databases, and structures illustrated in FIGS. 2-4.

[0075] In operation 910, the trust domain module 240 pre-initializes a first pool of enclaves of a first class and a second pool of enclaves of a second class. Pre-initialization may be full or partial. For full initialization, the enclaves in the pool are fully prepared for use and have their code and data already loaded. Hence, all members of the class are identical. For partial initialization, the enclaves in the pool share one or more properties, e.g., the amount of heap memory used. The enclaves are initialized with respect to the shared properties, but the actual code and data of the enclaves are not loaded during pre-initialization. Furthermore, further customization may be performed in a later step. Thus, different enclaves may be members of the class if partial initialization is performed.

[0076] At operation 920, the trust domain module 240 receives a request for a first class enclave. For example, the untrusted component 220 of the application may provide data identifying the enclave to the trust domain module 240 as part of the request. The data identifying the enclave may include a pointer to an address in shared memory 260 that the untrusted component 220 can access. Data identifying the class of the enclave may be included in the enclave or in the request.

[0077] In operation 930, the trust domain module 240 selects an enclave from the pool of enclaves pre-initialized for the first class in response to the received request. The trust domain module 240 may modify the selected enclave by performing further operations on the selected enclave based on the data identifying the enclave received with the request, such as the workload-specific operations shown in FIG. 4. The further operations may include copying data or code from an address in the shared memory 260 indicated in the request to the private memory 270 allocated to the enclave.

[0078] The trust domain module 240 responds to the request by providing access to the selected enclave (operation 940). For example, a unique identifier for the initialized enclave may be returned that can be used as a parameter to a subsequent request to the trust domain module 240 to execute a function within the enclave (e.g., an EENTER command).

[0079] By using different pools for different classes, similar but relatively low demand enclaves can be partially pre-initialized by placing them in a common class, reducing latency while consuming resources only in proportion to the enclave's demand, while at the same time, high demand enclaves can be fully pre-initialized, reducing latency even further.

[0080] In view of the above-described implementations of the subject matter, the present application discloses the following case studies, where one feature of an example taken in isolation, or more than one feature of an example taken in combination, optionally in combination with one or more features of one or more additional examples, are additional examples that are also included in the present disclosure.

[0081] Example 1 is a system for providing a trusted execution environment (TEE), comprising a processor and a storage device coupled to the processor for storing instructions that, when executed by the processor, cause the processor to pre-initialize a pool of TEEs, where the pre-initializing each TEE in the pool of TEEs includes allocating memory of the storage device to the TEE, receive a request for a TEE after pre-initializing the pool of TEEs, select the TEE from the pre-initialized pool of TEEs, and provide access to the selected TEE in response to the request.

[0082] In Example 2, the subject matter of Example 1 includes the instructions further causing the processor to modify the selected TEE based on information in the request prior to providing access to the selected TEE.

[0083] In Example 3, the subject matter of Example 2 includes where modifying the selected TEE includes starting the selected TEE.

[0084] In Example 4, the subject matter of Examples 2 and 3 includes where modifying the selected TEE includes copying data or code to the memory allocated to the TEE.

[0085] In Example 5, the subject matter of Examples 2-4 includes where modifying the selected TEE includes assigning an encryption key to the selected TEE and encrypting the memory allocated to the TEE using the encryption key.

[0086] In Example 6, the subject matter of Examples 1-5 includes where pre-initializing the pool of TEEs includes copying a state of a template TEE to each TEE in the pool of TEEs.

[0087] In Example 7, the subject matter of Examples 1-6 further includes the instructions causing the processor to restore the selected TEE to a state of a template TEE based on a determination that execution of the selected TEE is complete.

[0088] In Example 8, the subject matter of Examples 1-7 further includes the instructions causing the processor to receive a request to release the selected TEE and, in response to the request to release the selected TEE, return the selected TEE to the pool of TEEs.

[0089] In Example 9, the subject matter of Examples 1-8 further includes the instructions causing the processor to receive a pre-computed hash value, determine a hash value of a binary memory state, and copy the binary memory state from unsecured memory to the selected TEE based on the determined hash value and the pre-computed hash value.

[0090] Example 10 is a system for providing a TEE, comprising a processor and a storage device coupled to the processor that stores instructions that, when executed by the processor, cause the processor to pre-initialize a pool of TEEs, create a template TEE that is stored in the storage device and marked as read-only, receive a request, and, in response to the request, copy the template TEE to create a TEE and provide access to the created TEE.

[0091] In Example 11, the subject matter of Example 10 includes wherein the template TEE includes initial memory content and layout for a Function as a Service (FaaS).

[0092] In Example 12, the subject matter of Examples 10 and 11 includes the processor preventing execution of the template TEE.

[0093] Example 13 is a method of providing a TEE, the method comprising: a processor pre-initializing a pool of TEEs, where the pre-initializing each TEE of the pool of TEEs comprises allocating memory of a storage device to the TEE; and after the pre-initializing the pool of TEEs, the processor receiving a request, and in response to the request, the processor selecting a TEE from the pre-initialized pool of TEEs and the processor providing access to the selected TEE.

[0094] In Example 15, the subject matter of Example 14 includes modifying the selected TEE based on information in the request prior to the providing access to the selected TEE.

[0095] In Example 16, the subject matter of Example 15 includes wherein modifying the selected TEE includes initiating the selected TEE.

[0096] In Example 17, the subject matter of Examples 15 and 16 includes where modifying the selected TEE comprises copying data or code to the memory allocated to the TEE.

[0097] In Example 18, the subject matter of Examples 15 to 17 includes the step of modifying the selected TEE comprising assigning an encryption key to the selected TEE and encrypting the memory allocated to the TEE using the encryption key.

[0098] In Example 19, the subject matter of Examples 14-18 includes where pre-initializing the pool of TEEs includes copying a state of a template TEE to each TEE in the pool of TEEs.

[0099] In Example 20, the subject matter of Examples 14-19 includes restoring the selected TEE to a state of a template TEE based on a determination that execution of the selected TEE is complete.

[0100] In Example 21, the subject matter of Examples 14 to 20 includes receiving a request to release the selected TEE, and returning the selected TEE to the pool of TEEs in response to the request to release the selected TEE.

[0101] In Example 22, the subject matter of Examples 14 through 21 includes receiving a pre-computed hash value, determining a hash value of a binary memory state, and copying the binary memory state from an unsecured memory to the selected TEE based on the determined hash value and the pre-computed hash value.

[0102] Example 23 is a method of providing a trusted execution environment (TEE) that includes a processor creating a template TEE that is stored in a storage device and marked as read-only, the processor receiving a request, and in response to the request, copying the template TEE to create a TEE and providing access to the created TEE.

[0103] In Example 24, the subject matter of Example 23 includes wherein the template TEE includes initial memory contents and layout for a Function as a Service (FaaS).

[0104] In Example 25, the subject matter of Examples 23 and 24 includes the processor preventing execution of the template TEE.

[0105] Example 26 is a method of providing a TEE, the method including: a processor encrypting data and code using a first encryption key, storing the encrypted data and code in a storage device, the processor receiving a request, and in response to the request, assigning a second encryption key to a TEE, decrypting the encrypted data and code using the first encryption key, encrypting the decrypted data and code using the second encryption key, and providing access to the TEE.

[0106] Example 27 is a non-transitory computer-readable medium comprising instructions that cause a processor to provide a TEE by performing operations including: pre-initializing a pool of TEEs, where the pre-initializing each TEE of the pool of TEEs includes allocating memory of a storage device to the TEE, and, after the pre-initializing the pool of TEEs, receiving a request for a TEE, selecting the TEE from the pre-initialized pool of TEEs, and providing access to the selected TEE in response to the request.

[0107] In Example 28, the subject matter of Example 27 includes the operations further including an operation of modifying the selected TEE based on information in the request prior to the operation of providing access to the selected TEE.

[0108] In Example 29, the subject matter of Example 28 includes where the act of modifying the selected TEE includes an act of starting the selected TEE.

[0109] In Example 30, the subject matter of Examples 28 and 29 includes where the operation of modifying the selected TEE includes an operation of copying data or code to the memory allocated to the TEE.

[0110] In Example 31, the subject matter of Examples 28-30 includes the operation of modifying the selected TEE includes the operations of assigning an encryption key to the selected TEE and encrypting the memory allocated to the TEE using the encryption key.

[0111] In Example 32, the subject matter of Examples 27-31 includes where the act of pre-initializing the pool of TEEs includes an act of copying a state of a template TEE to each TEE in the pool of TEEs.

[0112] In Example 33, the subject matter of Examples 27 to 32 includes the operations further including, based on a determination that execution of the selected TEE is complete, restoring the selected TEE to a state of a template TEE.

[0113] In Example 34, the subject matter of Examples 27 to 33 includes the operations further including receiving a request to release the selected TEE, and returning the selected TEE to the pool of TEEs in response to the request to release the selected TEE.

[0114] In Example 35, the subject matter of Examples 27 through 34 includes the operations further including receiving a pre-computed hash value, determining a hash value of a binary memory state, and copying the binary memory state from unsecured memory to the selected TEE based on the determined hash value and the pre-computed hash value.

[0115] Example 36 is a non-transitory computer-readable medium comprising instructions that cause a processor to provide a TEE by performing operations including creating a template TEE, where the template TEE is stored in a storage device and is marked as read-only, receiving a request, and, in response to the request, copying the template TEE to create a TEE, and providing access to the created TEE.

[0116] In Example 37, the subject matter of Example 36 includes wherein the template TEE includes initial memory contents and layout for a Function as a Service (FaaS).

[0117] In Example 38, the subject matter of Examples 36 and 37 includes where the operations further include an operation of preventing execution of the template TEE.

[0118] Example 39 is a non-transitory computer-readable medium comprising instructions that cause a processor to provide a TEE by performing operations including encrypting data and code using a first encryption key, storing the encrypted data and code in a storage device, receiving a request, and, in response to the request, assigning a second encryption key to a TEE, decrypting the encrypted data and code using the first encryption key, encrypting the decrypted data and code using the second encryption key, and providing access to the TEE.

[0119] Example 40 is a system for providing a TEE, the system including a storage means and a processing means for pre-initializing a pool of TEEs, where the pre-initializing each TEE of the pool of TEEs includes allocating memory of the storage means to the TEE, receiving a request for a TEE, selecting the TEE from the pre-initialized pool of TEEs, and providing access to the selected TEE in response to the request.

[0120] In Example 41, the subject matter of Example 40 includes wherein the processing means is further for modifying the selected TEE based on information in the request prior to providing access to the selected TEE.

[0121] In Example 42, the subject matter of Example 41 includes where modifying the selected TEE includes starting the selected TEE.

[0122] In Example 43, the subject matter of Examples 41 and 42 includes where modifying the selected TEE includes copying data or code to the memory allocated to the TEE.

[0123] In Example 44, the subject matter of Examples 41 to 43 includes where modifying the selected TEE includes assigning an encryption key to the selected TEE and encrypting the memory allocated to the TEE using the encryption key.

[0124] In Example 45, the subject matter of Examples 40-44 includes where pre-initializing the pool of TEEs includes copying a state of a template TEE to each TEE in the pool of TEEs.

[0125] In Example 46, the subject matter of Examples 40 to 45 includes the processing means further being for restoring the selected TEE to a state of a template TEE based on a determination that execution of the selected TEE is complete.

[0126] In Example 47, the subject matter of Examples 40 to 46 includes the processing means being further for receiving a request to release the selected TEE and, in response to the request to release the selected TEE, returning the selected TEE to the pool of TEEs.

[0127] In Example 48, the subject matter of Examples 40 to 47 includes wherein the processing means is further for receiving a pre-computed hash value, determining a hash value of a binary memory state, and copying the binary memory state from the unsecured memory to the selected TEE based on the determined hash value and the pre-computed hash value.

[0128] Example 49 is a system for providing a TEE, the system including a storage means and a processing means for creating a template TEE, the template TEE being stored in the storage means and marked as read-only, receiving a request, and in response to the request, copying the template TEE to create a TEE and providing access to the TEE.

[0129] In Example 50, the subject matter of Example 49 includes wherein the template TEE includes initial memory contents and layout for a Function as a Service (FaaS).

[0130] In Example 51, the subject matter of Examples 49 and 50 includes the processing means preventing execution of the template TEE.

[0131] Example 52 is a system for providing a TEE, the system including a storage means and a processing means for encrypting data and code using a first encryption key, storing the encrypted data and code in the storage means, receiving a request, and in response to the request, assigning a second encryption key to a TEE, decrypting the encrypted data and code using the first encryption key, encrypting the decrypted data and code using the second encryption key, and providing access to the TEE.

[0132] Example 53 is at least one machine-readable medium comprising instructions that, when executed by a processing circuit, cause the processing circuit to perform operations to implement any of examples 1-52.

[0133] Example 54 is an apparatus including means for implementing any of examples 1 to 52.

[0134] Example 55 is a system that implements any of Examples 1 to 52.

[0135] Example 56 is a method of implementing any of Examples 1 to 52.

[0136] 10 is a block diagram 1000 illustrating an example of a software architecture 1002 of a computing device. The architecture 1002 may be used in conjunction with various hardware architectures, for example, as described herein. FIG. 10 is merely a non-limiting example of a software architecture, and many other architectures may be implemented to facilitate the functionality described herein. A representative hardware layer 1004 is shown, which may represent, for example, any of the computing devices referenced above. In some examples, the hardware layer 1004 may be implemented according to the computer system architecture of FIG. 10.

[0137] The exemplary hardware layer 1004 includes one or more processing units 1006 having associated executable instructions 1008. The executable instructions 1008 represent the executable instructions of the software architecture 1002, including implementations of the methods, modules, subsystems, components, etc. described herein, and may include memory and / or storage modules 1010 that also have the executable instructions 1008. The hardware layer 1004 may include other hardware, as illustrated by other hardware 1012, which represents any other hardware in the hardware layer 1004, such as other hardware illustrated as part of the software architecture 1002.

[0138] In the exemplary architecture of FIG. 10, the software architecture 1002 may be conceptualized as a stack of layers, with each layer providing a particular functionality. For example, the software architecture 1002 may include layers such as an operating system 1014, libraries 1016, framework / middleware 1018, applications 1020, and a presentation layer 1044. In operation, applications 1020 and / or other components within these layers may invoke application programming interface (API) calls 1024 through the software stack and may access responses and return values, such as those shown as messages 1026, in response to the API calls 1024. The layers shown are representative in nature, and not all layers are present in all software architectures. For example, some mobile or special purpose operating systems may not provide a framework / middleware layer 1018, while others may provide such a layer. Other software architectures may include additional or different layers.

[0139] The operating system 1014 may manage hardware resources and provide common services. The operating system 1014 may include, for example, a kernel 1028, services 1030, and drivers 1032. The kernel 1028 may act as an abstraction layer between the hardware and other software layers. For example, the kernel 1028 may be responsible for memory management, processor management (e.g., scheduling), component management, networking, security configuration, and the like. The services 1030 may provide other common services to the other software layers. In some examples, the services 1030 include an interrupt service. The interrupt service may detect receipt of an interrupt and, in response, cause the architecture 1002 to suspend a current process and execute an interrupt service routine (ISR) when the interrupt is accessed.

[0140] Drivers 1032 may be responsible for controlling or interfacing with the underlying hardware. For example, drivers 1032 may include a display driver, a camera driver, a Bluetooth driver, a flash memory driver, a serial communications driver (e.g., a Universal Serial Bus (USB) driver, a Wi-Fi driver, an NFC driver, an audio driver, and a power management driver, depending on the hardware configuration.

[0141] Libraries 1016 may provide a common infrastructure that may be utilized by applications 1020 and / or other components and / or layers. Libraries 1016 typically provide functionality that allows other software modules to perform tasks in an easier manner than by directly interfacing with the underlying operating system 1014 functionality (e.g., kernel 1028, services 1030, and / or drivers 1032). Libraries 1016 may include system libraries 1034 (e.g., C standard libraries), which may provide functions such as memory allocation functions, string manipulation functions, mathematical functions, and the like. Additionally, libraries 1016 may include API libraries 1036, such as a media library (e.g., a library supporting the presentation and manipulation of various media formats, such as MPEG4, H.264, MP3, AAC, AMR, JPG, PNG, etc.), a graphics library (e.g., an OpenGL framework that may be used to render two-dimensional and three-dimensional graphical content on a display), a database library (e.g., SQLite that may provide various relational database functions), and a web library (e.g., WebKit that may provide web browsing functionality), etc. Libraries 1016 may include a wide variety of other libraries 1038 to provide many other APIs to applications 1020 and other software components / modules.

[0142] The framework / middleware 1018 may provide a higher level common infrastructure that may be utilized by the applications 1020 and / or other software components / modules. For example, the framework / middleware 1018 may provide various graphic user interface (GUI) functionality, high level resource management, high level location services, etc. The framework / middleware 1018 may provide a wide range of other APIs, some of which may be specific to a particular operating system or platform, that may be utilized by the applications 1020 and / or other software components / modules.

[0143] The applications 1020 include built-in applications 1040 and / or third-party applications 1042. Representative examples of built-in applications 1040 may include, but are not limited to, a contacts application, a browser application, a book reader application, a location application, a media application, a messaging application, and / or a gaming application. The third-party applications 1042 may include the built-in applications 1040 and any of a wide variety of other applications. In a particular example, the third-party applications 1042 (e.g., applications developed using an Android® or iOS® software development kit (SDK) by an entity other than a particular platform vendor) may be mobile software running on a mobile operating system, such as iOS®, Android®, Windows® Phone, or other mobile computing device operating system. In this example, the third-party applications 1042 may invoke API calls 1024 provided by a mobile operating system, such as the operating system 1014, to facilitate the functionality described herein.

[0144] Applications 1020 may utilize built-in operating system facilities (e.g., kernel 1028, services 1030, and / or drivers 1032), libraries (e.g., system libraries 1034, API libraries 1036, and other libraries 1038), frameworks / middleware 1018 to create a user interface that interacts with a user of the system. Alternatively or additionally, in some systems, interaction with the user may occur through a presentation layer, such as presentation layer 1044. In these systems, the application / module "logic" may be separated from the aspects of the application / module that interact with the user.

[0145] Some software architectures utilize virtual machines. In the example of FIG. 10, this is illustrated by virtual machine 1048. A virtual machine creates a software environment in which applications / modules can be executed as if they were executing on a hardware computing device. A virtual machine is hosted by a host operating system (operating system 1014) and typically, but not always, has a virtual machine monitor 1046 that manages the operation of the virtual machine 1048 and the interface with the host operating system (i.e., operating system 1014). A software architecture executes within the virtual machine 1048, such as operating system 1050, libraries 1052, frameworks / middleware 1054, applications 1056, and / or presentation layer 1058. These layers of the software architecture executing within the virtual machine 1048 may be the same as the corresponding layers discussed above, or may be different. [Modules, Components, and Logic]

[0146] Certain embodiments are described herein as including logic or some components, modules, or mechanisms. A module may constitute a software module (e.g., code embodied on (1) a non-transitory machine-readable medium or (2) in a transmission signal) or a hardware-implemented module. A hardware-implemented module is a tangible unit that can perform certain operations and may be configured or arranged in a particular manner. In an exemplary embodiment, one or more computer systems (e.g., standalone computer systems, client computer systems, or server computer systems) or one or more hardware processors may be configured with software (e.g., applications or application portions) as hardware-implemented modules that operate to perform certain operations as described herein.

[0147] In various embodiments, a hardware-implemented module may be implemented mechanically or electronically. For example, a hardware-implemented module may include dedicated circuitry or logic that is permanently configured (e.g., as a special purpose processor such as a field programmable gate array (FPGA) or application specific integrated circuit (ASIC)) to perform certain operations. A hardware-implemented module may also include programmable logic or circuitry that is temporarily configured by software to perform certain operations (e.g., as contained within a general purpose processor or another programmable processor). It will be appreciated that the decision to mechanically implement a hardware-implemented module in dedicated permanently configured circuitry or temporarily configured (e.g., configured by software) circuitry may be influenced by cost and time considerations.

[0148] Thus, the term "hardware-implemented module" should be understood to encompass a tangible entity that is either physically constructed or permanently configured (e.g., built into hardware) or temporarily or transiently configured (e.g., programmed) to operate in a particular manner and / or to perform particular operations described herein. Given embodiments in which the hardware-implemented modules are temporarily configured (e.g., programmed), it is not necessary that each of the hardware-implemented modules be configured or instantiated at any one time. For example, if a general-purpose processor that is configured using software is included in the hardware-implemented modules, the general-purpose processor may be configured at different times as each of the different hardware-implemented modules. Thus, the software may configure the processor, for example, to configure a particular hardware-implemented module at one time and to configure a different hardware-implemented module at a different time.

[0149] Hardware-implemented modules can provide information to and receive information from other hardware-implemented modules. Thus, the described hardware-implemented modules may be considered to be communicatively coupled. When multiple of such hardware-implemented modules are present simultaneously, communication may be achieved through signal transmission (e.g., via appropriate circuits and buses connecting the hardware-implemented modules). In embodiments in which multiple hardware-implemented modules are configured or instantiated at different times, communication between such hardware-implemented modules may be achieved, for example, through storage and retrieval of information in a memory structure accessible to the multiple hardware-implemented modules. For example, one hardware-implemented module may perform an operation and store the output of that operation in a memory device to which it is communicatively coupled. An additional hardware-implemented module may then access the memory device at a later time to retrieve and process the stored output. A hardware-implemented module may initiate communication with an input device or an output device and may operate on a resource (e.g., a collection of information).

[0150] Various operations of the example methods described herein may be performed, at least in part, by one or more processors that are temporarily or permanently configured (e.g., by software) to perform the associated operations. Such processors, whether temporarily or permanently configured, may constitute processor-implemented modules that operate to perform one or more operations or functions. Modules referred to herein may, in some example embodiments, include processor-implemented modules.

[0151] Similarly, the methods described herein may be at least partially processor-implemented. For example, at least some of the operations of the methods may be performed by one or more processors or processor-implemented modules. The execution of some of these operations may be distributed among one or more processors that are not only present in a single machine, but also spread across several machines. In some exemplary embodiments, one or more processors may be located in a single location (e.g., in a residential environment, an office environment, or a server farm), while in other embodiments, multiple processors may be distributed across several locations.

[0152] The one or more processors may operate to support execution of associated operations in a "cloud computing" environment or as "software as a service" (SaaS). For example, at least some of these operations may be performed by a collection of computers (as examples of machines that include the processors), and these operations are accessible via a network (e.g., the Internet) and one or more suitable interfaces (e.g., APIs). [Electronic Equipment and Systems]

[0153] Exemplary embodiments may be implemented in digital electronic circuitry, or in computer hardware, firmware, or software, or in combinations of them. Exemplary embodiments may be implemented using a computer program product, such as a computer program tangibly embodied in an information carrier, e.g., a machine-readable medium, for execution by or to control the operation of a data processing apparatus (e.g., a programmable processor, computer, or multiple computers).

[0154] The computer program may be written in any type of programming language, including compiled or interpreted languages, and may be deployed in any form, either as a stand-alone program or as a module, subroutine, or other unit suitable for use in a computing environment. The computer program may be deployed to be executed on one computer or on multiple computers at one site, or distributed across multiple sites and interconnected by a communication network.

[0155] In the exemplary embodiments, the operations may be performed by one or more programmable processors executing computer programs to perform functions by operating on input data and generating output. The operations of the methods may be performed by, and apparatus of the exemplary embodiments may be implemented as, special purpose logic circuitry, e.g., an FPGA or an ASIC.

[0156] A computing system may include clients and servers. Clients and servers are generally remote from each other and typically interact through a communications network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. It will be appreciated that in embodiments deploying a programmable computing system, both hardware and software architectures are worthy of consideration. In particular, it will be appreciated that the choice of whether to implement a particular functionality in permanently configured hardware (e.g., ASICs), temporarily configured hardware (e.g., a combination of software and programmable processors), or a combination of permanently and temporarily configured hardware may be a design choice. The following describes hardware (e.g., machine) and software architectures that may be deployed in various exemplary embodiments. [Exemplary Machine Architecture and Machine-Readable Medium]

[0157] FIG. 11 is a block diagram of a machine in the exemplary form of a computer system 1100 on which instructions 1124 for causing the machine to perform any one or more of the methodologies described herein may be executed. In alternative embodiments, the machine may operate as a standalone device or may be connected (e.g., networked) to other machines. In a networked deployment, the machine may operate as a server or client machine in a server-client network environment, or as a peer machine in a peer-to-peer (or distributed) network environment. The machine may be a personal computer (PC), a tablet PC, a set-top box (STB), a personal digital assistant (PDA), a mobile phone, a web appliance, a network router, switch, or bridge, or any machine capable of executing instructions (sequential or otherwise) that specify operations to be performed by the machine. Furthermore, although only a single machine is illustrated, the term "machine" shall also be construed to include any collection of machines that individually or jointly execute a set (or sets) of instructions to perform any one or more of the methodologies described herein.

[0158] The exemplary computer system 1100 includes a processor 1102 (e.g., a central processing unit (CPU), a graphics processing unit (GPU), or both), a main memory 1104, and a static memory 1106, which communicate with each other via a bus 1108. The computer system 1100 may further include a video display unit 1110 (e.g., a liquid crystal display (LCD) or a cathode ray tube (CRT)). The computer system 1100 also includes an alphanumeric input device 1112 (e.g., a keyboard or a touch-sensitive display screen), a user interface (UI) navigation (or cursor control) device 1114 (e.g., a mouse), a storage unit 1116, a signal generation device 1118 (e.g., a speaker), and a network interface device 1120. [Machine-readable medium]

[0159] The storage unit 1116 includes a machine-readable medium 1122 on which is stored one or more sets of data structures and instructions 1124 (e.g., software) that embody or are utilized by any one or more of the methodologies or functions described herein. The instructions 1124 may reside, completely or at least partially, within the main memory 1104 and / or within the processor 1102 during execution by the computer system 1100, with the main memory 1104 and the processor 1102 also constituting the machine-readable medium 1122.

[0160] While in an example embodiment, the machine-readable medium 1122 is depicted as a single medium, the term "machine-readable medium" may include a single medium or multiple media (e.g., a centralized or distributed database, and / or associated caches and servers) that store one or more instructions 1124 or data structures. The term "machine-readable medium" should also be taken to include any tangible medium that can store, encode, or carry instructions 1124 for execution by a machine and cause the machine to perform any one or more of the methodologies of the present disclosure, or store, encode, or carry data structures used by or associated with such instructions 1124. Accordingly, the term "machine-readable medium" should be taken to include, but is not limited to, solid-state memory, optical media, and magnetic media. Specific examples of the machine-readable medium 1122 include non-volatile memory, including by way of example only semiconductor memory devices (e.g., erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM)) and flash memory devices, magnetic disks, such as internal hard disks and removable disks, magneto-optical disks, and disks such as compact disk-read-only memory (CD-ROM) and digital versatile disk-read-only memory (DVD-ROM). Machine-readable media are not transmission media. [Transmission medium]

[0161] The instructions 1124 may further be transmitted or received over a communications network 1126 using a transmission medium. The instructions 1124 may be transmitted using a network interface device 1120 and any one of several well-known transfer protocols (e.g., Hypertext Transport Protocol (HTTP)). Examples of communications networks include a local area network (LAN), a wide area network (WAN), the Internet, a cellular network, a plain old telephone (POTS) network, and wireless data networks (e.g., Wi-Fi and WiMax networks). The term "transmission medium" shall be taken to include any intangible medium, including digital or analog communications signals or other intangible media, capable of storing, encoding, or carrying instructions 1124 for execution by a machine and facilitating communication of such software.

[0162] While certain exemplary embodiments have been described herein, it will be apparent that various modifications and changes may be made thereto without departing from the broader spirit and scope of the present disclosure. Thus, the specification and drawings should be regarded in an illustrative and not restrictive sense. The accompanying drawings, which form a part of this specification, show, by way of example, and not by way of limitation, specific embodiments in which the subject matter may be practiced. The illustrated embodiments are described in sufficient detail to enable those skilled in the art to practice the teachings disclosed herein. Other embodiments may be utilized and derived therefrom, such that structural and logical substitutions and changes may be made without departing from the scope of the present disclosure. Thus, this detailed description is not to be construed in a limiting sense, and the scope of the various embodiments is defined solely by the appended claims, along with the full scope of equivalents to which such claims are entitled.

[0163] Such embodiments of the subject matter of the present invention may be referred to herein individually and / or collectively under the term "invention" merely for convenience, and are not intended to spontaneously limit the scope of the present application to any single invention or inventive concept when in fact more than one is disclosed. Thus, although specific embodiments have been illustrated and described herein, it should be understood that any arrangement calculated to achieve the same purpose may be substituted for the specific embodiment shown. The present disclosure is intended to cover any and all adaptations or modifications of the various embodiments. In reviewing the above description, combinations of the above-described embodiments with other embodiments not specifically described herein will be apparent to one of ordinary skill in the art.

[0164] Some portions of the subject matter described herein may be presented in terms of algorithms or symbolic representations of operations on data stored as bits or binary digital signals in a machine memory (e.g., computer memory). Such algorithms or symbolic representations are examples of techniques used by those skilled in the data processing arts to convey the substance of their work to others skilled in the art. As used herein, an "algorithm" is a self-consistent sequence of operations or similar processes that produce a desired result. Algorithms and operations in this context involve physical manipulations of physical quantities. Usually, though not necessarily, such quantities may take the form of electrical, magnetic, or optical signals that can be stored, accessed, transferred, combined, compared, or otherwise manipulated in a machine. Primarily for reasons of common usage, it is sometimes convenient to use words such as "data," "contents," "bits," "values," "elements," "symbols," "characters," "terms," ​​"numbers," or "digits" in reference to such signals. However, these words are merely convenient labels and should be associated with the appropriate physical quantities.

[0165] Unless otherwise indicated, descriptions herein using words such as "processing," "computing," "calculating," "determining," "presenting," or "displaying" may refer to machine (e.g., computer) operations or processes that manipulate or transform data represented as physical (e.g., electronic, magnetic, or optical) quantities in one or more memories (e.g., volatile memory, non-volatile memory, or any suitable combination thereof), registers, or other machine components that receive, store, transmit, or display information. Additionally, unless otherwise indicated, the terms "a" and "an" are used herein to include one or more than one example, as found in patent literature. Finally, as used herein, the conjunction "or" refers to a non-exclusive "or" unless otherwise indicated. [Other possible items] (Item 1) A processor; a storage device coupled to the processor for storing instructions; A system comprising: The instructions, when executed by the processor, cause the processor to: pre-initializing a pool of trusted execution environments (TEEs), where pre-initializing each TEE of the pool of TEEs includes allocating memory of the storage device to the TEE; receiving a request for a TEE after the pre-initializing the pool of TEEs; selecting said TEE from said pool of pre-initialized TEEs; providing access to the selected TEE in response to the request; To carry out system. (Item 2) The instructions further cause the processor to: modifying the selected TEE based on information in the request prior to providing access to the selected TEE. Item 1. The system according to item 1. (Item 3) 3. The system of claim 2, wherein modifying the selected TEE includes starting the selected TEE. (Item 4) 3. The system of claim 2, wherein modifying the selected TEE includes copying data or code into the memory allocated to the TEE. (Item 5) The modifying the selected TEE comprises: assigning an encryption key to the selected TEE; and encrypting the memory allocated to the TEE using the encryption key; 3. The system according to item 2, comprising: (Item 6) The modifying the selected TEE comprises: assigning a cryptographic key identifier to the selected TEE; and encrypting the memory allocated to the TEE using an encryption key corresponding to the encryption key identifier; 3. The system according to item 2, comprising: (Item 7) The modifying the selected TEE comprises: Creating a secure Extended Page Table (EPT) branch of the selected TEE that derives code mappings from the template TEE. 3. The system according to item 2, comprising: (Item 8) The pre-initializing of the pool of TEEs includes copying a state of a template TEE to each TEE in the pool of TEEs. Item 1. The system according to item 1. (Item 9) 9. The system of claim 8, wherein copying the state of the template TEE to each TEE in the pool of TEEs includes encrypting the copied state with a different ephemeral key for each TEE in the pool of TEEs. (Item 10) The said order further states: and restoring the selected TEE to a state of a template TEE based on a determination that execution of the selected TEE has completed. Item 1. The system according to item 1. (Item 11) The instructions further cause the processor to: receiving a request to release the selected TEE; returning the selected TEE to the pool of TEEs in response to the request to release the selected TEE; The system according to item 1, (Item 12) The instructions further cause the processor to: receiving a precomputed hash value; determining a hash value of the binary memory state; copying the binary memory state from an unsecured memory to the selected TEE based on the determined hash value and the pre-computed hash value; The system according to item 1, (Item 13) The instructions further cause the processor to: assigning an access-controlled key identifier to the selected TEE; preventing the assigned access-controlled key identifier from being assigned to any other TEE during the lifetime of the selected TEE; Item 13. The system according to item 12, (Item 14) a processor pre-initializing a pool of trusted execution environments (TEEs), the pre-initializing each TEE of the pool of TEEs comprising allocating memory of a storage device to the TEE; receiving a request by the processor after the pre-initializing the pool of TEEs; In response to the above request, the processor selects a TEE from the pool of pre-initialized TEEs; and The processor provides access to the selected TEE. Stages and A method for providing the above. (Item 15) modifying the selected TEE based on information in the request prior to the step of providing access to the selected TEE. 15. The method of claim 14, further comprising: (Item 16) 16. The method of claim 15, wherein modifying the selected TEE comprises initiating the selected TEE. (Item 17) A non-transitory computer-readable medium comprising instructions, the instructions causing a processor to: acts of pre-initializing a pool of trusted execution environments (TEEs), each TEE of the pool of TEEs comprising allocating memory of a storage device to the TEE; receiving a request for a TEE after said pre-initializing the pool of TEEs; selecting said TEE from said pool of pre-initialized TEEs; providing access to the selected TEE in response to the request; A non-transitory computer-readable medium for causing a computer to perform operations including: (Item 18) The above operation further includes: modifying the selected TEE based on information in the request prior to the act of providing access to the selected TEE. 20. The non-transitory computer-readable medium of item 17, comprising: (Item 19) 20. The non-transitory computer-readable medium of claim 18, wherein the operation of modifying the selected TEE includes an operation of starting the selected TEE. (Item 20) 20. The non-transitory computer-readable medium of claim 18, wherein the operation of modifying the selected TEE includes an operation of copying data or code to the memory allocated to the TEE. (Item 21) The operation of modifying the selected TEE includes: assigning an encryption key to the selected TEE; and encrypting said memory allocated to said TEE using said encryption key; 20. The non-transitory computer-readable medium of item 18, comprising: (Item 22) The pre-initializing of the pool of TEEs includes copying a state of a template TEE to each TEE of the pool of TEEs. Item 18. The non-transitory computer-readable medium of item 17. (Item 23) The above operation further includes: and restoring the selected TEE to a state of a template TEE based on a determination that execution of the selected TEE has completed. 20. The non-transitory computer-readable medium of item 17, comprising: (Item 24) The above operation further includes: receiving a request to release the selected TEE; returning the selected TEE to the pool of TEEs in response to the request to release the selected TEE. 20. The non-transitory computer-readable medium of item 17, comprising: (Item 25) The above operation further includes: receiving a precomputed hash value; determining a hash value of the binary memory state; copying the binary memory state from an unsecured memory to the selected TEE based on the determined hash value and the pre-computed hash value; 20. The non-transitory computer-readable medium of item 17, comprising: [Item 1] 1. A system for providing a trusted execution environment (TEE), comprising: A processor; a storage device coupled to the processor for storing instructions; Equipped with The instructions, when executed by the processor, cause the processor to: pre-initializing a pool of TEEs, where the pre-initializing each TEE of the pool of TEEs includes allocating memory of the storage device to the TEE; receiving a request for a TEE after the pre-initializing the pool of TEEs; selecting the TEE from the pool of pre-initialized TEEs; in response to the request, providing access to the selected TEE; and To carry out system. [Item 2] The instructions further cause the processor to: modifying the selected TEE based on information in the request prior to providing access to the selected TEE. Item 1. The system according to item 1. [Item 3] 3. The system of claim 2, wherein modifying the selected TEE includes starting the selected TEE. [Item 4] 4. The system of claim 2 or 3, wherein modifying the selected TEE includes copying data or code into the memory allocated to the TEE. [Item 5] The modifying the selected TEE comprises: assigning an encryption key to the selected TEE; encrypting the memory allocated to the TEE using the encryption key; 5. The system according to any one of items 2 to 4, comprising: [Item 6] The modifying the selected TEE comprises: assigning a cryptographic key identifier to the selected TEE; encrypting the memory allocated to the TEE using an encryption key corresponding to the encryption key identifier; 6. The system according to any one of items 2 to 5, comprising: [Item 7] The modifying the selected TEE comprises: creating a secure extended page table (EPT) branch of the selected TEE that derives code mappings from the template TEE; 7. The system according to any one of items 2 to 6, comprising: [Item 8] The pre-initializing of the pool of TEEs includes copying a state of a template TEE to each TEE in the pool of TEEs. 8. A system according to any one of items 1 to 7. [Item 9] 9. The system of claim 8, wherein copying the state of the template TEE to each TEE in the pool of TEEs includes encrypting the copied state with a different ephemeral key for each TEE in the pool of TEEs. [Item 10] The instructions may further include: and restoring the selected TEE to a state of a template TEE based on a determination that execution of the selected TEE has completed. 10. The system according to any one of items 1 to 9. [Item 11] The instructions further cause the processor to: receiving a request to release the selected TEE; returning the selected TEE to the pool of TEEs in response to the request to release the selected TEE; 11. The system according to any one of items 1 to 10, [Item 12] The instructions further cause the processor to: receiving a precomputed hash value; determining a hash value of the binary memory state; copying the binary memory state from an unsecured memory to the selected TEE based on the determined hash value and the pre-computed hash value; 12. The system according to any one of items 1 to 11, [Item 13] The instructions further cause the processor to: assigning an access-controlled key identifier to the selected TEE; preventing the assigned access-controlled key identifier from being assigned to any other TEE during the lifetime of the selected TEE; Item 13. The system according to item 12, [Item 14] 1. A system for providing a trusted execution environment (TEE), comprising: A processor; a storage device coupled to the processor for storing instructions; Equipped with The instructions, when executed by the processor, cause the processor to: Pre-initializing a pool of TEEs; creating a template TEE, which is stored on the storage device and marked as read-only; Receiving a request; and In response to said request, Copy the template TEE to create a TEE; and Provide access to the created TEE And To carry out system. [Item 15] 15. The system of claim 14, wherein the template TEE includes an initial memory content and layout for a Function as a Service (FaaS). [Item 16] 16. The system of claim 14, wherein the processor prevents execution of the template TEE. [Item 17] 1. A method for providing a trusted execution environment (TEE), comprising: a processor encrypting the data and the code using a first encryption key; storing the encrypted data and code in a storage device; receiving a request by the processor; In response to said request, assigning a second encryption key to the TEE; decrypting the encrypted data and code using the first encryption key; encrypting the decrypted data and code using the second encryption key; providing access to the TEE; A method for providing the above. [Item 18] modifying the selected TEE based on information in the request prior to the step of providing access to the selected TEE. Item 18. The method of item 17, further comprising: [Item 19] 1. A method for providing a trusted execution environment (TEE), comprising: a processor pre-initializing a pool of TEEs, the pre-initializing each TEE of the pool of TEEs comprising allocating memory of a storage device to the TEE; receiving a request by the processor after the pre-initializing the pool of TEEs; In response to said request, the processor selecting a TEE from the pool of pre-initialized TEEs; the processor providing access to the selected TEE; A method for providing the above. [Item 20] modifying the selected TEE based on information in the request prior to the step of providing access to the selected TEE. 20. The method of claim 19, further comprising: [Item 21] 21. The method of claim 20, wherein the step of modifying the selected TEE comprises the step of initiating the selected TEE. [Item 22] 22. The method of claim 20 or 21, wherein the step of modifying the selected TEE comprises copying data or code into the memory allocated to the TEE. [Item 23] The step of modifying the selected TEE comprises: assigning an encryption key to the selected TEE; encrypting the memory allocated to the TEE using the encryption key; 23. The method according to any one of items 20 to 22, comprising: [Item 24] The step of pre-initializing the pool of TEEs comprises copying a state of a template TEE to each TEE in the pool of TEEs. 24. The method according to any one of items 19 to 23. [Item 25] restoring the selected TEE to a state of a template TEE based on a determination that execution of the selected TEE is complete. 25. The method of any one of items 19 to 24, further comprising:

Claims

1. A memory circuit; a processing circuit; and a processing system comprising: The processing circuitry includes: allocating resources of the processing circuitry to create a plurality of trusted execution environments (TEEs); initializing each TEE of the plurality of TEEs by allocating an isolated memory space to each TEE in the memory circuit and by enabling each TEE to execute a workload on the processing circuit, wherein each TEE of the plurality of TEEs is initialized to support independent scheduling and execution of a plurality of different types of workloads; receiving a request to execute a workload after each TEE of the plurality of TEEs is initialized; and In response to the request, the processing system is configured to cause a particular TEE of the initialized plurality of TEEs to execute the workload.

2. 2. The processing system of claim 1, wherein the processing circuitry includes at least one graphical processing unit (GPU), and each TEE of the plurality of TEEs is configured to execute the workload using a portion of the at least one GPU.

3. 3. The processing system of claim 2, wherein the at least one GPU is a single GPU, and each TEE of the plurality of TEEs is protected and isolated within the single GPU.

4. The processing system of claim 1 , wherein the plurality of TEEs are allocated among a plurality of users, and the TEE on which the workload is to be executed is isolated to a particular user of the plurality of users.

5. 5. The processing system of claim 4, wherein during execution of the workload, other TEEs of the plurality of TEEs are available to execute other workloads of other users of the plurality of users.

6. The processing circuitry further comprises: assigning an encryption key to the TEE that is to execute the workload; and 2. The processing system of claim 1, configured to: encrypt the memory space of the TEE in which the workload is to be executed with the encryption key.

7. allocating resources of processing circuitry of a processing system to create a plurality of trusted execution environments (TEEs); initializing each TEE of the plurality of TEEs by (i) allocating an isolated memory space to each TEE in a memory circuit of the processing system, and (ii) enabling each TEE to execute a workload on the processing circuit, wherein each TEE of the plurality of TEEs is initialized to support independent scheduling and execution of a plurality of different types of workloads; receiving a request to execute a workload after each TEE of the plurality of TEEs has been initialized; in response to the request, causing a particular TEE of the initialized plurality of TEEs to execute the workload.

8. 8. The method of claim 7, wherein the processing circuitry includes at least one graphical processing unit (GPU), and each TEE of the plurality of TEEs is configured to execute the workload using a portion of the at least one GPU.

9. 9. The method of claim 8, wherein the at least one GPU is a single GPU, and each TEE of the plurality of TEEs is protected and isolated within the single GPU.

10. The method of claim 7 , wherein the plurality of TEEs are allocated among a plurality of users, and the TEE on which the workload is to be executed is isolated to a particular user of the plurality of users.

11. The method of claim 10 , wherein during execution of the workload, other TEEs of the plurality of TEEs are available to execute other workloads of other users of the plurality of users.

12. assigning an encryption key to the TEE that is to execute the workload; 8. The method of claim 7, further comprising: encrypting the memory space of the TEE in which the workload is to execute with the encryption key.

13. A computer program for causing a processing circuit to carry out the method according to any one of claims 7 to 12.

14. Apparatus comprising means for carrying out the method according to any one of claims 7 to 12.

15. A non-transitory computer readable storage medium storing the computer program of claim 13.

Images