Memory isolation in a trusted execution environment

Abstract

To provide a system and a method for isolating a memory within a reliable execution environment TEE.SOLUTION: In a function as a service (FaaS) environment, a plurality of functions are installed within a single TEE on an FaaS server without data consistency of each function being exposed to a risk. Use of expanded page table EPT different for each function allows a virtual address space of the function to be separately held and mapped in non-overlapping different physical address spaces. The partial overlapping is permitted and the function shears a part of data while protecting other data. A memory for each function is encrypted by using a different encryption key.SELECTED DRAWING: Figure 6

Description

TECHNICAL FIELD

[0001] The subject matter disclosed in the present specification generally relates to a trusted execution environment (TEE) of hardware. Specifically, the present disclosure addresses systems and methods for isolating memory within a TEE.

BACKGROUND ART

[0002] Hardware privilege levels may be used by a processor to limit memory access by applications running on a device. An operating system runs at a higher privilege level, can access all memory of the device, and can define the memory ranges of other applications. Applications running at lower privilege levels are restricted to accessing memory within the ranges defined by the operating system, and cannot access the memory of other applications or the operating system.

BRIEF DESCRIPTION OF THE DRAWINGS

[0003] By way of example and not limitation, several embodiments are illustrated in the figures of the accompanying drawings.

[0004] [Figure 1] FIG. 2 is a network diagram illustrating a network environment suitable for a server that provides function-as-a-service using a TEE, according to some exemplary embodiments.

[0005] [Figure 2] FIG. 3 is a block diagram of a function-as-a-service server, according to some exemplary embodiments, suitable for use in isolating memory within a TEE.

[0006] [Figure 3] FIG. 4 is a block diagram of prior art ring-based memory protection.

[0007] [Figure 4] This is a block diagram of an enclave-based memory protection suitable for reducing TEE latency according to several exemplary embodiments.

[0008] [Figure 5] This is a block diagram of an address mapping using an extended page table, according to several exemplary embodiments, suitable for use when isolating memory within a TEE.

[0009] [Figure 6] This is a block diagram of a communication sequence between a virtual machine manager (VMM) and a secure arbitration mode (SEAM) module, and the resulting memory space of the TEE, according to several exemplary embodiments.

[0010] [Figure 7] This is a block diagram of a communication sequence between a VMM and a TDX module and the resulting memory space of a TEE, according to several exemplary embodiments.

[0011] [Figure 8] This flowchart shows the operation of a suitable method for a server to perform when isolating memory within a TEE, according to several exemplary embodiments.

[0012] [Figure 9] A block diagram showing an example of a software architecture for computing devices.

[0013] [Figure 10] This is a block diagram of a machine representing an exemplary form of a computer system in which instructions for causing the machine to perform one or more of the methodologies described herein can be executed. [Modes for carrying out the invention]

[0014] The exemplary methods and systems are intended to reduce latency in providing a TEE. In the most common sense, a TEE is any trusted execution environment, regardless of how its trust is obtained. However, as used herein, a TEE is provided by executing code within an enclave. An enclave is a portion of memory that is protected from access by processes outside the enclave, even if those processes are running at a high privilege level.

[0015] Enclaves are enabled by processor protection, which ensures that the code and data loaded into the enclave are protected from access by code running outside the enclave. Therefore, enclaves provide an isolated execution environment that prevents malicious software, including the operating system, from accessing the data and code contained within the enclave at the hardware level.

[0016] A TEE may be used to ensure the secure handling of sensitive information by protecting it from all software outside the TEE. A TEE may be used in modular programming, where each module contains everything necessary for its own functionality without being exposed to vulnerabilities caused by other modules. For example, a successful injection attack against one TEE cannot affect the code of another TEE.

[0017] Total Memory Encryption (TME) protects data in memory from being accessed by bypassing the processor. The system generates an encryption key within the processor at startup and does not store the key outside the processor. Because the TME encryption key does not persist across reboots and is not stored outside the processor, it is a short-term key. All data written to memory by the processor is encrypted using the encryption key and decrypted when read back from memory. Therefore, hardware-based attacks attempting to read data directly from memory without going through the processor will fail.

[0018] Multi-key TME (MKTME) extends TME to use multiple keys. Individual memory pages may be encrypted using the TME's short-term key or a software-provided key. This can provide higher security against software-based attacks than TME because an attacker needs to identify the specific key used by the target software, rather than having the processor automatically decrypt any memory accessed by the attacking software.

[0019] In a Function-as-a-Service (FaaS) environment, clients use functions that are running within a TEE (Technical Element) on the FaaS server. A FaaS platform provides cloud computing services that execute application logic but do not store data. Before providing sensitive data to a function, the client verifies that the function is running on the TEE and, consequently, that other functions not part of the trusted environment cannot access the sensitive data.

[0020] To minimize the TCB for each function, each function may be placed in a separate TEE. However, this incurs the overhead of creating a TEE for each function. As described herein, multiple functions may be placed in a single TEE without compromising the data integrity of each function. For example, by using different Extended Page Tables (EPTs) for each function, the virtual address spaces of the functions are kept separate and mapped to distinct, non-overlapping physical address spaces. Alternatively, partial overlap can be permitted to allow functions to share some data while protecting other data.

[0021] Alternatively or additionally, the memory for each function may be encrypted using a different encryption key. Therefore, even if a function accesses memory associated with a different function, that function cannot decrypt the data.

[0022] Multiple tenants of a FaaS platform may provide functions executed by the FaaS platform via a gateway. A tenant is a group of users that share common access to data, such as users having accounts linked to a particular company. Protection of data between tenants may be a goal of the tenants and the FaaS platform. In one or more data centers, the FaaS platform includes one or more FaaS servers. Accordingly, the gateway may include a load balancer or other functionality for distributed computing. Since the FaaS platform provides functionality to multiple tenants via the gateway, no single tenant can take control of the gateway.

[0023] As described herein, each tenant may provide code and data for any number of functions that execute in any number of TEEs on the FaaS platform and are accessed via the gateway. Using the systems and methods described herein, the number of TEEs that can be created per tenant can be reduced (e.g., one TEE per tenant).

[0024] Compared to existing methods for protecting memory within a TEE, the methods and systems described herein enable the use of a single TEE with multiple memory spaces, and allow for protection within the TEE. Since the overhead of a single TEE does not increase when multiple functions are performed within the TEE, computational overhead is reduced. Considering these effects as a whole, one or more of the methodologies described herein can eliminate certain efforts or resource requirements that would otherwise be associated with creating a TEE or providing a FaaS platform. Computing resources used by one or more machines, databases, or networks may also be reduced. Examples of such computing resources include processor cycles, network traffic, memory usage, data storage capacity, power consumption, and cooling capacity.

[0025] Figure 1 is a network diagram showing a network environment 100 suitable for a server providing Function-as-a-Service (FaaS) using TEE, according to several exemplary embodiments. The network environment 100 includes FaaS servers 110A and 110B, client devices 120A and 120B, and network 130. FaaS servers 110A to 110B provide functionality to client devices 120A to 120B via network 130. FaaS servers 110A and 110B may be collectively referred to as FaaS server 120, or more commonly as FaaS server 120. Client devices 120A and 120B may be collectively referred to as client device 120, or more commonly as client device 120.

[0026] Client devices 120A and 120B may be devices of different tenants, and as a result, each tenant will want to prevent other tenants from accessing its tenant-specific data and code. Therefore, FaaS servers 110A to 110B may use enclaves for each FaaS provided, or for each tenant, or for any appropriate combination thereof. FaaS servers 110A to 110B and client devices 120A and 120B may be implemented in a computer system, either entirely or partially, as described below with respect to Figure 8.

[0027] Any of the machines, databases, or devices shown in Figure 1 may be implemented on a general-purpose computer modified by software (e.g., configured or programmed) to perform the functions described herein for that machine, database, or device, making it a special-purpose computer. For example, with respect to Figure 8, a computer system that can implement one or more of the methodologies described herein will be described below. As used herein, “database” is a data storage resource that may store structured data as text files, tables, spreadsheets, relational databases (e.g., object-relational databases), triple stores, hierarchical data stores, document-oriented NoSQL databases, file stores, or any suitable combination thereof. The database may be an in-memory database. Furthermore, any two or more of the machines, databases, or devices shown in Figure 1 may be combined to form a single machine, database, or device, and the functions described herein for any single machine, database, or device may be subdivided among multiple machines, databases, or devices.

[0028] The FaaS server 110 and client devices 120 are connected by a network 130. Network 130 may be any network that enables communication between machines, databases, and devices. Thus, network 130 may be a wired network, a wireless network (e.g., a mobile network or cellular network), or any suitable combination thereof. Network 130 may include one or more parts that constitute a private network, a public network (e.g., the Internet), or any suitable combination thereof. Each of these devices is connected to network 130 using a network interface.

[0029] Figure 2 is a block diagram 200 of a FaaS server 110A according to several exemplary embodiments suitable for use when isolating memory within a TEE. The FaaS server 110A is shown to include a communication module 210, an untrusted component of the application 220, a trusted component of the application 230, a trusted domain module 240, shared memory 250, and private memory 260, all of which are configured to communicate with each other (e.g., via a bus, shared memory, or switch). One or more of the modules described herein may be implemented using hardware (e.g., the machine's processor). For example, any module described herein may be implemented by a processor configured to perform the operations described herein for that module. Furthermore, two or more of these modules may be combined into a single module, and the functions described herein for a single module may be subdivided among multiple modules. Furthermore, according to various exemplary embodiments, modules described herein as being implemented inside a single machine, database, or device may be distributed across multiple machines, databases, or devices.

[0030] The communication module 210 receives data to be sent to the FaaS server 110A and transmits data from the FaaS server 110A. For example, the communication module 210 may receive a request from the client device 130A to perform a function. After the function is performed, the result of the function is provided to the client device 130A by the communication module 210. The communication sent and received by the communication module 210 may be mediated by the network 130. The invoked function may be mediated by another function. For example, the communication module 210 may provide a URL to an untrusted component 220. The untrusted component 220 parses the URL and invokes a function in the trusted component 230.

[0031] The untrusted component 220 may run outside the enclave. Therefore, if the operating system or other untrusted components are compromised, the untrusted component 220 is vulnerable to attack. The trusted component 230 runs inside the enclave. Therefore, even if the operating system or the untrusted component 220 is compromised, the data and code of the trusted component 230 remain safe.

[0032] The trusted domain module 240 creates and protects the enclave and is responsible for the transition of execution between the untrusted component 220 and the trusted component 230. The trusted domain module 240 may be provided with signed code, which verifies that the code has not been modified since it was signed. The signed code is loaded into a portion of physical memory that is marked as part of the enclave. Hardware protection then prevents untrusted software from accessing, modifying, executing, or any appropriate combination thereof of the enclave memory. The code may be encrypted using a key available only to the trusted domain module 240.

[0033] Once a trusted component 230 is initialized, an untrusted component 220 can invoke the functions of the trusted component 230 using special processor instructions of the trusted domain module 240, which transition from untrusted mode to trusted mode or between trusted enclaves. The trusted component 230 performs parameter verification, and if the parameters are valid, executes the requested function and returns control to the untrusted component 220 via the trusted domain module 240. Multiple trusted components 230 may be instantiated on the FaaS server 110A, and each of these components 230 may provide one or more functions.

[0034] The Trust Domain Module 240 may be implemented as one or more components of an Intel® hardware processor that provides Intel® Software Guard Extensions (SGX), Intel® Trust Domain Extensions (TDX), or both.

[0035] Both the untrusted component 220 and the trusted component 230 can access and modify the shared memory 250, but only the trusted component 230 can access and modify the private memory 260. Figure 2 shows only one trusted component 230 and one private memory 260, but each tenant may have multiple trusted components 230, each of which has a corresponding private memory 260. In some exemplary embodiments, multiple trusted components 230 reside within a single enclave. Furthermore, multiple applications may run in separate memory spaces, and consequently, separate shared memory 250. In this context, “shared” refers to memory accessible to all software and hardware that can access a memory space (e.g., an application and its operating system) that is not necessarily accessible to all applications running on the system.

[0036] Figure 3 is a block diagram 300 of a conventional ring-based memory protection. Block diagram 300 includes applications 310 and 320 and an operating system 330. The operating system 330 executes processor commands at ring 0 (Intel® and AMD® processors), exception level 1 (ARM® processors), or an equivalent privilege level. Applications 310 and 320 execute processor commands at ring 3 (Intel® and AMD® processors), exception level 0 (ARM® processors), or an equivalent privilege level.

[0037] The hardware processor prevents code running at a lower privilege level from accessing memory outside the memory range defined by the operating system. Therefore, (as shown by "X" in Figure 3) the code of application 310 cannot directly access the memory of application 320 or operating system 330. Operating system 330 exposes certain functionality to applications 310 and 320 by predefining specific access points (for example, call gates, SYSENTER / SYSEXIT instructions on Intel® processors, SYSCALL / SYSRET instructions on AMD® processors, or any appropriate combination or equivalent thereof).

[0038] Since operating system 330 has access to all memory, applications 310 and 320 have no protection from a malicious operating system. For example, a competitor could modify the operating system before running application 310 in order to access the code and data of application 310, enabling retrospective analysis.

[0039] Furthermore, if an application exploits a vulnerability in operating system 330 and can escalate to the operating system's privilege level, it may gain access to all of the memory. For example, application 310, which normally cannot access application 320's memory (as shown by X between applications 310 and 320 in Figure 3), may be able to access application 320's memory after escalating to ring 0 or exception level 1. Therefore, if a user is tricked into executing a malicious program (e.g., application 310), private data belonging to the user or application provider may be accessed directly from memory (e.g., bank passwords used by application 320).

[0040] Figure 4 is a block diagram 400 of an enclave-based memory protection suitable for reducing TEE latency according to several exemplary embodiments. Block diagram 400 includes an application 410, an enclave 420, and an operating system 430. The operating system 430 executes processor commands at ring 0 (Intel® and AMD® processors), exception level 1 (ARM® processors), or an equivalent privilege level. The application 410 and enclave 420 execute processor commands at ring 3 (Intel® and AMD® processors), exception level 0 (ARM® processors), or an equivalent privilege level.

[0041] The operating system 430 allocates memory for the enclave 420 and directs the processor to load the code and data into the enclave 420. However, once instantiated, the operating system 430 cannot access the memory of the enclave 420. Therefore, even if the operating system 430 is malicious or compromised, the code and data in the enclave 420 remain secure.

[0042] Enclave 420 may provide functionality to application 410. The operating system 430 may control whether application 410 is permitted to invoke the functionality of enclave 420 (for example, by using the ECALL instruction). Therefore, a malicious application may gain the ability to invoke the functionality of enclave 420 by compromising the operating system 430. Nevertheless, the hardware processor prevents the malicious application from directly accessing the memory or code of enclave 420. Therefore, the code within enclave 420 cannot assume that the functionality is being invoked correctly or by a non-attacker, but the code within enclave 420 has complete control over parameter checks and other internal security measures and is only affected by its internal security vulnerabilities.

[0043] Figure 5 is a block diagram 500 of address mapping using an extended page table, representing several exemplary embodiments suitable for use when isolating memory within a TEE. Block diagram 500 shows a virtual machine 510 running processes 520A and 520B. Each of processes 520A-520B uses a corresponding set of virtual addresses 530A or 530B. The virtual addresses used by the processes are mapped to the virtual physical addresses of the virtual machines using page tables 540A and 540B. The virtual physical addresses of the virtual machines are mapped to the host physical addresses using EPT550.

[0044] Figure 5 shows a single virtual machine 510, but multiple virtual machines may reside on a single physical host. Each virtual machine has its own EPT controlled by the physical host. In an embodiment where the host assigns a physical address to only one EPT, each virtual machine cannot access the memory of other virtual machines. Therefore, when different processes are running on different virtual machines, the memory of each process is protected.

[0045] Similarly, virtual machine 510 protects the memory of processes 520A and 520B by using different page tables 540A-540B. Each of processes 520A-520B uses an independent virtual address space mapped to a different virtual physical address of virtual machine 510 by page tables 540A-540B. In an embodiment where virtual machine 510 allocates virtual physical addresses to only a single page table, each process 520A or 520B cannot access the memory of the other process. Therefore, running different processes in different virtual memory ensures that the memory of each process is protected.

[0046] However, if a malicious process can identify and exploit the vulnerability in virtual machine 510, the process may be able to modify the page table, allowing it to access the memory of a different process. This vulnerability can be mitigated by keeping each process in a separate TEE, but this comes at the cost of creating a separate TEE for each function.

[0047] Figure 6 is a block diagram 600 of a communication sequence between VMM610 and TDX module 620 and the resulting memory space of TEE630, according to several exemplary embodiments. The memory of TEE630 is protected using a single encryption key 650. Within TEE630 are functions 640A, 640B, and 640C, each with its own data. In contrast to block diagram 500, where all processes 520A-520B share a single EPT 550, each of functions 640A-640C has a separate EPT 660A, 660B, or 660C. Furthermore, the FaaS runtime of TEE630 has a separate EPT 660D. The FaaS runtime of TEE630 may be a guest operating system configured to call one or more of functions 640A-640C (e.g., using VMFunc instructions).

[0048] Further security may be provided to mitigate the risk of a function using VMFunc to modify its own EPT and access physical memory allocated to a different function. For example, Control-Flow Enforcement Technology (CET) could be used to impose strict restrictions on the memory from which VMFunc instructions can be issued, allowing the guest operating system to issue VMFunc instructions while preventing functions 640A-640C from doing so.

[0049] To create a TEE630, the VMM610 invokes the functions of the hardware TDX module 620, which is integrated into the hardware processor. The VMM610 can create a new guest TD by allocating initialization to a TD Root (TDR) control structure (for example, using the TDH.MNG.CREATE function, provided by Intel® TDX and shown as TD.CREATE in Figure 6). As input to the creation function, the VMM610 may assign a memory protection key identifier, also known as a Host Key ID (HKID), to the TD. The HKID can be used by the CPU to tag memory accesses performed by the TD and by MKTME to select an encryption / decryption key. The key itself is not exposed to the VMM610. The VMM610 may program the HKID into the MKTME cryptographic engine (for example, by using the TDH.MNG.KEY.CONFIG function, provided by Intel® TDX).

[0050] After the TD is created, the VMM610 may construct the TD Control Structure (TDCS) by adding and initializing control structure pages (for example, using the TDH.MNG.ADDCX and TDH.MNG.INIIT functions provided by Intel® TDX). The VMM610 may construct the Secure EPT tree by adding one or more Secure EPT pages (for example, using the TDH.MEM.SEPT.ADD function provided by Intel® TDX and shown as MEM.SEPT.ADD in Figure 6). An initial set of TD private pages may be added (for example, using the TDH.MEM.PAGE.ADD function provided by Intel® TDX and shown as MEM.PAGE.ADD in Figure 6). The initial set of TD private pages may include Virtual Basic Input / Output System (BIOS) code and data, and several clear pages for the stack and heap. Further code and data per function may be loaded.

[0051] After allocation, TD private pages may be removed (for example, using the TDH.MEM.PAGE.REMOVE function, provided by Intel® TDX and shown as MEM.PAGE.REMOVE in Figure 6). Similarly, Secure EPT pages may be removed (for example, using the TDH.MEM.SEPT.REMOVE function, provided by Intel® TDX and shown as MEM.SEPT.REMOVE in Figure 6). Therefore, VMM610 can control the creation and sizing of TEE630 and create separate Secure EPT pages for each of functions 640A-640C to mitigate the risk that a compromised function may be used to access the code and data of another function. Because the TDX module 620, and by extension the hardware processor, controls access to EPT660A-660D, malicious code still cannot access the physical memory of other functions. This is true even if a single encryption key 650 is used for all memory allocated to TEE630.

[0052] If these two functions reside in different parts of memory, using different EPTs, a normal jump or call command to get one function to execute the other will fail. Instead, a SEAM function call is made to enter the other memory space. Similarly, the return of control to the calling function is mediated by the processor's SEAM. As a result, SEAM provides further protection to the separate memory spaces (for example, by clearing the processor pipeline, registers, other internal state, or any appropriate combination thereof) to reduce the ability of malicious code using one EPT to affect code using the other EPT.

[0053] Each of functions 640A to 640C is shown using a separate EPT660A to 660C, but SEAM provides the ability to add memory to an existing EPT. Therefore, functions may share an EPT as needed. This allows two closely related functions to share direct access to each other's memory, and a higher level of isolation and security may be traded off for improved performance. For example, function 640A may have its own EPT660A, while functions 640B and 640C share EPT660B.

[0054] EPT generally controls access to physical memory at the page level. On many systems, a page is 4 kilobytes, but other page sizes may be used. Access to memory by functions 640A-640C may be controlled at a granularity smaller than a page. For example, when a page of memory is added to the EPT, a flag may be set in the SEAM command to indicate that subpage access control is desired. If this flag is set, a further 64-bit vector is provided (e.g., at a memory address or as part of the command), where each bit in the vector indicates whether the corresponding 1 / 64 portion of the page (e.g., 64 bytes) is allocated to other functions within the TEE or remains private. Other levels of granularity may be provided using vectors of other sizes (e.g., a 4-bit vector controlling access in quarters of a page (e.g., 1028 bytes)).

[0055] As an alternative to calling the SEAM function, a TDCALL call or a VMFunc call may be used. Each of these is a different hardware implementation that provides processor-based protection to the TEE.

[0056] In some exemplary embodiments, the TDX module 620 may, in addition to switching the EPT when switching between functions 640A to 640C (or instead), switch other registers, such as control register 3 (CR3) containing the base physical address of the paging structure hierarchy, the instruction pointer register (RIP), or a control structure containing multiple registers, such as Intel® Virtual Machine Control Structure (VMCS).

[0057] Figure 7 is a block diagram 700 of a communication sequence between VMM710 and TDX module 720 and the resulting memory space of TEE730, according to several exemplary embodiments. Within TEE730 are functions 740A, 740B, and 740C, each with its own data. In contrast to block diagram 600, where all functions 640A-640C share a single encryption key 650, each of functions 740A-740C has a separate encryption key 750A, 750B, or 750C. Furthermore, the FaaS runtime of TEE730 has a separate encryption key 750D. Each of functions 740A-740C and the FaaS runtime has a separate EPT 760A, 760B, 760C, or 760D. The FaaS runtime of TEE730 may be a guest operating system configured to invoke one or more of functions 740A to 740C.

[0058] In the implementation shown in Figure 7, the TDX module 720 derives unique encryption keys 750A-750D for functions 740A-740C and the FaaS runtime. The memory allocated to each function is encrypted using the corresponding encryption key. Therefore, even if malicious code is injected into a function and can somehow bypass the security provided by using separate EPTs 760A-760D, the malicious code will not be able to decrypt the accessed memory, as an additional layer of security is provided.

[0059] Figure 8 is a flowchart illustrating the operation of Method 800, suitable for a server to perform when isolating memory within a TEE, according to several exemplary embodiments. Method 800 includes operations 810, 820, and 830. As an example, and not an limitation, Method 800 may be performed by the FaaS server 110A in Figure 1, using the modules, databases, and structures shown in Figures 2 to 7.

[0060] In operation 810, the hardware processor of the FaaS server 110A (for example, the TDX module 620 or 720 in Figures 6 and 7, which operates as the trusted domain module 240 in Figure 2) creates the TEE. For example, the TEE 630 or 730 in Figures 6 and 7 may be created.

[0061] In operation 820, the hardware processor allocates multiple parts of memory, including a first part and a second part, to the TEE. For example, EPT660A-660D or 760A-760D may be allocated to the TEE along with further physical pages referenced by EPT660A-660D or 760A-760D. The first and second parts may be allocated to different functions (e.g., functions 640A and 640B or 740A and 740B) and may use different encryption keys (e.g., encryption keys 750A and 750B) or the same encryption key (e.g., a single encryption key 650).

[0062] In operation 830, the hardware processor prevents instructions executed in the first part from accessing data in the second part. For example, the code for function 640A is loaded into the first part of the memory associated with function 640A. Instructions that access memory, executed from within function 640A, are processed using EPT660A. Since physical pages referenced by the other EPT660B-660D are not referenced by EPT660A, instructions executed within function 640A are prevented from accessing data associated with the other functions 640B and 640C, and either of the other functions 640B or 640C may be considered the second function of operation 830.

[0063] As another example, the code for function 740A is loaded into the first portion of memory associated with function 740A using encryption key 750A. Instructions that access memory, executed from within function 740A, are processed using EPT760A. Since physical pages referenced by the other EPT760B-760D are not referenced by EPT760A, instructions executed within function 740A are prevented from accessing data associated with the other functions 740B and 740C, and either of the other functions 740B or 740C may be considered the second function of operation 830. Furthermore, even if this security is bypassed, the hardware processor further prevents instructions executed in the first portion from accessing data in the second portion because the processor applies encryption key 750A (or the corresponding decryption key in the case of asymmetric encryption) to the accessed data. Since different encryption keys (e.g., encryption key 750B or 750C) were used to encrypt the data by other functions, the decrypted data is meaningless, and access to the second part of the data is prevented.

[0064] Therefore, by using method 800, the FaaS server 110A can run any number of functions within a single TEE without losing the security advantage of using separate EPTs for each function. Reducing the number of TEEs used reduces the overhead of creating and tearing down TEEs, allowing a single server to provide more functionality.

[0065] In consideration of the above-mentioned implementation of the subject matter, the Application discloses the following set of examples. Here, one feature of an isolated example, or more than one feature of an example captured in combination with one or more features of one or more further examples, is a further example similarly included in the Disclosure.

[0066] Example 1 is a system for isolating memory in a trusted execution environment (TEE), the system comprising a processor and memory for storing instructions, wherein when an instruction is executed by the processor, the system causes the processor to perform an operation that includes allocating multiple parts of memory, including a first part and a second part, to the TEE, and an operation that prevents instructions being executed in the first part from accessing data stored in the second part.

[0067] In Example 2, the subject of Example 1 further includes an operation that, in response to a Safety Arbitration Mode (SEAM) function call, switches between the first extended page table (EPT) of the first part and the second EPT of the second part.

[0068] In Example 3, the subject matter of Examples 1 and 2 further includes the operation of encrypting the first portion using a first encryption key and the operation of encrypting the second portion using a second encryption key.

[0069] In Example 4, the subject matter of Examples 1 to 3 includes the fact that the above-mentioned parts include a third part, and instructions executed in the third part are permitted to access data stored in the first part.

[0070] In Example 5, the subject of Example 4 includes the fact that access to the data within the first part is controlled at a granularity smaller than a page.

[0071] In Example 6, the subject of Examples 1 to 5 further includes an operation that prevents the instruction being executed in the second part from accessing the data stored in the first part.

[0072] In Example 7, the subject of Examples 1 to 6 further includes the operation of creating the TEE in response to a Safety Arbitration Mode (SEAM) function call.

[0073] In Example 8, the subject of Example 7 is that, by creating the TEE, the third portion of the memory is allocated to the TEE, and the operation further includes the operation of allocating the first portion of the memory to the TEE in response to a second SEAM function call, and the operation of allocating the second portion of the memory to the TEE in response to a third SEAM function call.

[0074] In Example 9, the subject of Example 8 includes the fact that the guest operating system is executed in the third part described above.

[0075] In Example 10, the subject of Example 9 includes the guest operating system calling a first function in the first part and a second function in the second part.

[0076] Example 11 is a method for isolating memory in a trusted execution environment (TEE), the method comprising the steps of: a processor allocating multiple portions of memory, including a first portion and a second portion, to the TEE; and the processor preventing instructions being executed in the first portion from accessing data stored in the second portion.

[0077] In Example 12, the subject of Example 11 includes a step of switching between the first extended page table (EPT) of the first part and the second EPT of the second part in response to a Safety Arbitration Mode (SEAM) function call.

[0078] In Example 13, the subject matter of Examples 11 and 12 includes the steps of encrypting the first portion using a first encryption key and encrypting the second portion using a second encryption key.

[0079] In Example 14, the subject matter of Examples 11 to 13 includes the fact that the above-mentioned parts include a third part, and instructions executed in the third part are permitted to access data stored in the first part.

[0080] In Example 15, the subject of Example 14 includes the fact that access to the data in the first part above is controlled at a granularity smaller than a page.

[0081] In Example 16, the subject of Examples 11 to 15 includes a step of ensuring that the instructions being executed in the second part cannot access the data stored in the first part.

[0082] In Example 17, the subject matter of Examples 11 to 16 includes the step of creating the above TEE in response to a Safety Arbitration Mode (SEAM) function call.

[0083] In Example 18, the subject of Example 17 is such that the creation of the TEE results in the allocation of the third portion of the memory to the TEE, and the method further comprises the steps of: the processor allocating the first portion of the memory to the TEE in response to a second SEAM function call; and the processor allocating the second portion of the memory to the TEE in response to a third SEAM function call.

[0084] In Example 19, the subject of Example 18 includes the fact that the guest operating system is run in the third part described above.

[0085] In Example 20, the subject of Example 19 includes the guest operating system calling a first function in the first part and a second function in the second part.

[0086] Example 21 is a non-temporary computer-readable medium comprising instructions, the instructions for isolating memory in a trusted execution environment (TEE) by having the processor perform operations including the operation of allocating multiple portions of memory, including a first portion and a second portion, to a TEE, and the operation of preventing instructions being executed in the first portion from accessing data stored in the second portion.

[0087] In Example 22, the subject of Example 21 further includes an operation that, in response to a Safety Arbitration Mode (SEAM) function call, switches between the first extended page table (EPT) of the first part and the second EPT of the second part.

[0088] In Example 23, the subject matter of Examples 21 and 22 is further described by the fact that the above operation further includes an operation to encrypt the first portion using a first encryption key and an operation to encrypt the second portion using a second encryption key.

[0089] In Example 24, the subject matter of Examples 21 to 23 includes the fact that the above-mentioned parts include a third part, and instructions executed in the third part are permitted to access data stored in the first part.

[0090] In Example 25, the subject of Example 24 includes the fact that access to the data in the first part above is controlled at a granularity smaller than a page.

[0091] In Example 26, the subject of Examples 21 to 25 further includes an operation that prevents the instruction being executed in the second part from accessing the data stored in the first part.

[0092] In Example 27, the subject of Examples 21 to 26 further includes the operation of creating the TEE in response to a Safety Arbitration Mode (SEAM) function call.

[0093] In Example 28, the subject of Example 27 is that, by creating the TEE, the third portion of the memory is allocated to the TEE, and the operation further includes the operation of allocating the first portion of the memory to the TEE in response to a second SEAM function call, and the operation of allocating the second portion of the memory to the TEE in response to a third SEAM function call.

[0094] In Example 29, the subject of Example 28 includes the fact that the guest operating system is run in the third part described above.

[0095] In Example 30, the subject of Example 29 includes the guest operating system calling a first function in the first part and a second function in the second part.

[0096] Example 31 is a system for isolating memory in a trusted execution environment (TEE), the system comprising a storage means and a processing means, the processing means for creating a TEE by allocating a portion of the storage means to the TEE and preventing instructions stored outside the allocated portion from accessing the allocated portion, dividing the portion of the storage means into multiple parts including a first part and a second part, and preventing instructions executed in the first part from accessing data stored in the second part.

[0097] In Example 32, the subject of Example 31 further includes the fact that the processing means is for switching between the first extended page table (EPT) of the first part and the second EPT of the second part in response to a Safety Arbitration Mode (SEAM) function call.

[0098] In Example 33, the subject matter of Examples 31 and 32 is further provided that the processing means is for encrypting the first portion using a first encryption key and encrypting the second portion using a second encryption key.

[0099] In Example 34, the subject matter of Examples 31 to 33 includes the fact that the above-mentioned parts include a third part, and instructions executed in the third part are permitted to access data stored in the first part.

[0100] In Example 35, the subject of Example 34 includes the fact that access to the data in the first part above is controlled at a granularity smaller than a page.

[0101] In Example 36, the subject matter of Examples 31 to 35 further includes the fact that the processing means is for preventing the instructions executed in the second part from accessing the data stored in the first part.

[0102] In Example 37, the subject matter of Examples 31 to 36 further includes the fact that the processing means is for creating the TEE in response to a Safety Arbitration Mode (SEAM) function call.

[0103] In Example 38, the subject of Example 37 is that, by creating the TEE, the third portion of the storage means is allocated to the TEE, and the processing means further allocates the first portion of the storage means to the TEE in response to a second SEAM function call, and allocates the second portion of the storage means to the TEE in response to a third SEAM function call.

[0104] In Example 39, the subject of Example 38 includes the fact that the guest operating system is run in the third part described above.

[0105] In Example 40, the subject of Example 39 includes the guest operating system calling a first function in the first part and a second function in the second part.

[0106] Example 41 is at least one machine-readable medium containing instructions. When these instructions are executed by a processing circuit, the processing circuit is instructed to perform an operation that implements any of Examples 1 to 40.

[0107] Example 42 is a device that includes means for implementing any of Examples 1 to 40.

[0108] Example 43 is a system that implements one of Examples 1 through 40.

[0109] Example 44 is a way to implement any of Examples 1 through 40.

[0110] Figure 9 is a block diagram 900 showing an example of a software architecture 902 for a computing device. Architecture 902 may be used in conjunction with various hardware architectures, for example, as described herein. Figure 9 is merely a non-limiting example of a software architecture, and many other architectures may be implemented to facilitate the functionality described herein. A typical hardware layer 904 is shown, which can represent, for example, any of the computing devices referenced above. In some examples, the hardware layer 904 may be implemented according to the architecture of the computer system in Figure 9.

[0111] A typical hardware layer 904 includes one or more processing units 906 having associated executable instructions 908. The executable instructions 908 represent executable instructions of the software architecture 902, including implementations of methods, modules, subsystems, and components as described herein, and may also include memory and / or storage modules 910 having similar executable instructions 908. The hardware layer 904 may also include other hardware, such as other hardware represented by other hardware 912, which represents any other hardware of the hardware layer 904, such as other hardware shown as part of the software architecture 902.

[0112] In the exemplary architecture of Figure 9, the software architecture 902 may be conceptualized as a stack of layers, each providing specific functionality. For example, the software architecture 902 may include layers such as an operating system 914, libraries 916, framework / middleware 918, applications 920, and a presentation layer 944. Operationally, applications 920 and / or other components within these layers may invoke application programming interface (API) calls 924 through the software stack and access responses and return values, etc., indicated as messages 926 in response to API calls 924. The layers shown are representative in nature, and not all software architectures may have all of them. For example, some mobile operating systems or special-purpose operating systems may not provide a framework / middleware layer 918, while others may. Other software architectures may include further or different layers.

[0113] The operating system 914 may manage hardware resources and provide common services. The operating system 914 may include, for example, a kernel 928, a service 930, and a driver 932. The kernel 928 may function as an abstraction layer between the hardware and other software layers. For example, the kernel 928 may be responsible for memory management, processor management (e.g., scheduling), component management, networking, and security settings. The service 930 may provide other common services to other software layers. In some examples, the service 930 includes an interrupt service. The interrupt service may detect the reception of an interrupt and, in response, may cause the architecture 902 to pause the current processing and execute an interrupt service routine (ISR) when the interrupt is accessed.

[0114] Driver 932 may be responsible for controlling or interfacing with the underlying hardware. For example, depending on the hardware configuration, driver 932 may include a display driver, camera driver, Bluetooth® driver, flash memory driver, serial communication driver (e.g., Universal Serial Bus (USB) driver, Wi-Fi® driver, NFC driver, audio driver, and power management driver).

[0115] Library 916 may provide a common infrastructure that can be used by Application 920 and / or other components and / or layers. Library 916 typically provides functionality that allows other software modules to perform tasks in a way that is easier than directly interfaced with the functionality of the underlying operating system 914 (e.g., kernel 928, services 930, and / or drivers 932). Library 916 may include a system library 934 (e.g., the C standard library) that may provide functions such as memory allocation, string manipulation, and mathematical functions. Furthermore, Library 916 may include API libraries 936 such as a media library (e.g., a library that supports the presentation and manipulation of various media formats such as MPEG4, H.264, MP3, AAC, AMR, JPG, PNG), a graphics library (e.g., the OpenGL framework that can be used to render two-dimensional and three-dimensional graphics content on a display), a database library (e.g., SQLite that can provide various relational database functions), and a web library (e.g., WebKit that can provide web browsing functionality). Library 916 may include a wide variety of other libraries 938 to provide many other APIs to application 920 and other software components / modules.

[0116] The framework / middleware 918 may provide a higher level of common infrastructure that can be utilized by the application 920 and / or other software components / modules. For example, the framework / middleware 918 may provide various graphical user interface (GUI) functions, high-level resource management, and high-level location services. The framework / middleware 918 may also provide a wide range of other APIs that can be utilized by the application 920 and / or other software components / modules, some of which may be specific to a particular operating system or platform.

[0117] Application 920 includes an embedded application 940 and / or a third-party application 942. Typical examples of embedded applications 940 may include, but are not limited to, a contacts application, a browser application, a book reader application, a location application, a media application, a messaging application, and / or a game application. Third-party applications 942 may include any of the embedded applications and other applications from a wide range of options. In certain examples, a third-party application 942 (for example, an application developed by an entity other than the vendor of a particular platform using the Android® or iOS® Software Development Kit (SDK)) may be mobile software that runs on a mobile operating system such as iOS®, Android®, Windows® Phone, or another mobile computing device operating system. In this example, a third-party application 942 may call API calls 924 provided by the mobile operating system, such as operating system 914, to facilitate the functionality described herein.

[0118] Application 920 may create a user interface that interacts with the system's user by utilizing built-in operating system functions (e.g., kernel 928, services 930, and / or drivers 932), libraries (e.g., system library 934, API library 936, and other libraries 938), and framework / middleware 918. Alternatively or additionally, in some systems, user interaction may occur via a presentation layer, such as a presentation layer 944. In these systems, the application / module "logic" may be separated from the application / module aspects that interact with the user.

[0119] Some software architectures utilize virtual machines. In the example in Figure 9, this is represented by a virtual machine 948. A virtual machine creates a software environment in which applications / modules can run as if they were running on a hardware computing device. A virtual machine is hosted by a host operating system (operating system 914) and usually, but not always, has a virtual machine monitor 946, which manages the operation of the virtual machine and its interface with the host operating system (i.e., operating system 914). The software architecture runs within the virtual machine 948, including the operating system 950, libraries 952, frameworks / middleware 954, applications 956, and / or presentation layer 958. These layers of the software architecture running within the virtual machine 948 may be the same as or different from the corresponding layers described above. [Modules, components, and logic]

[0120] In this specification, specific embodiments are described as including logic or several components, modules, or mechanisms. A module may constitute either a software module (e.g., code embodied (1) on a non-temporary machine-readable medium or (2) in a transmitted signal) or a hardware implementation module. A hardware implementation module is a tangible unit capable of performing a specific operation and may be configured or arranged in a particular manner. In exemplary embodiments, one or more computer systems (e.g., a standalone computer system, a client computer system, or a server computer system), or one or more hardware processors, may be configured by software (e.g., an application or application portion) as a hardware implementation module that operates to perform a specific operation as described herein.

[0121] In various embodiments, hardware implementation modules may be mechanically or electronically implemented. For example, a hardware implementation module may include dedicated circuitry or logic permanently configured to perform a specific operation (e.g., as a special-purpose processor such as a field-programmable gate array (FPGA) or application-specific integrated circuit (ASIC)). A hardware implementation module may also include programmable logic or circuitry temporarily configured by software to perform a specific operation (e.g., contained within a general-purpose processor or another programmable processor). It will be found that the decision to mechanically implement a hardware implementation module into dedicated, permanently configured circuitry or temporarily configured (e.g., software-configured) circuitry may depend on cost and time considerations.

[0122] Accordingly, the term “hardware implementation module” should be understood to encompass tangible entities that are physically constructed, permanently configured (e.g., embedded in hardware), or temporarily or transiently configured (e.g., programmed) to operate in a particular manner and / or perform specific operations described herein. Considering embodiments in which hardware implementation modules are temporarily configured (e.g., programmed), it is not necessary to configure or instantiate each hardware implementation module at any given time. For example, if a general-purpose processor configured using software is included in a hardware implementation module, the general-purpose processor may be configured at different times as separate hardware implementation modules. Thus, the software may configure the processor, for example, to configure a particular hardware implementation module at one time and different hardware implementation modules at different times.

[0123] Hardware implementation modules can provide information to other hardware implementation modules and receive information from other hardware implementation modules. Therefore, the described hardware implementation modules may be considered to be communicatively connected. If multiple such hardware implementation modules exist simultaneously, communication may be achieved through signal transmission (e.g., via appropriate circuits and buses connecting the hardware implementation modules). In embodiments where multiple hardware implementation modules are configured or instantiated at different times, communication between such hardware implementation modules may be achieved, for example, through the storage and retrieval of information in a memory structure accessible to the multiple hardware implementation modules. For example, one hardware implementation module may perform an operation and store the output of that operation in a memory device to which it is communicatively connected. Further hardware implementation modules may then access the memory device to retrieve and process the stored output. Hardware implementation modules may initiate communication with input or output devices and may operate on resources (e.g., a collection of information).

[0124] Various operations of the exemplary methods described herein may be performed, at least partially, by one or more processors that are configured (e.g., by software) temporarily or permanently to perform the relevant operations. Such processors may constitute a processor implementation module that operates to perform one or more operations or functions, whether configured temporarily or permanently. The modules referred to herein may include processor implementation modules in some exemplary embodiments.

[0125] Similarly, the methods described herein may be implemented at least partially on a processor. For example, at least some of the operations of the method may be performed by one or more processors or processor implementation modules. Some of these operations may be distributed among one or more processors, not only residing within a single machine but also deployed across several machines. In some exemplary embodiments, one or more processors may be located in a single location (e.g., a residential environment, an office environment, or a server farm), while in other embodiments, multiple processors may be distributed across several locations.

[0126] One or more processors may operate in a “cloud computing” environment or as “software as a service” (SaaS) to support the execution of related operations. For example, at least some of these operations may be performed by a group of computers (as an example of machines containing processors), and these operations may be accessible via a network (e.g., the Internet) and one or more appropriate interfaces (e.g., APIs). [Electronic devices and systems]

[0127] Exemplary embodiments may be implemented in digital electronic circuits, computer hardware, firmware, or software, or a combination thereof. Exemplary embodiments may be implemented using computer program products, such as computer programs tangibly embodied on a machine-readable medium, for execution by a data processing device (e.g., a programmable processor, a computer, or multiple computers) or for controlling the operation of a data processing device.

[0128] Computer programs may be written in any form of programming language, including compiled or interpreted languages, and may be deployed in any form, such as standalone programs or as modules, subroutines, or other units suitable for use in a computing environment. Computer programs may be deployed to run on one computer or on multiple computers at one site, or they may be distributed across multiple sites and interconnected by a communication network.

[0129] In exemplary embodiments, the operation may be performed by one or more programmable processors that execute a computer program to perform the function by performing operations on input data and generating outputs. The operation of the method may be performed by a special-purpose logic circuit, such as an FPGA or ASIC, and the apparatus of the exemplary embodiment may be implemented as a special-purpose logic circuit, such as an FPGA or ASIC.

[0130] A computing system can include clients and servers. Clients and servers are generally geographically distant from each other and typically interact via a communication network. The client-server relationship arises from computer programs running on each computer that have a client-server relationship with each other. In embodiments deploying programmable computing systems, both hardware and software architectures are worth considering. Specifically, the choice of whether to implement certain functionality in persistently configured hardware (e.g., ASICs), in temporarily configured hardware (e.g., a combination of software and a programmable processor), or in a combination of persistent and temporarily configured hardware, may be a design choice. The following describes various exemplary hardware (e.g., machine) and software architectures that can be deployed in different exemplary embodiments. [Example machine architecture and machine-readable media]

[0131] Figure 10 is a block diagram of a machine in an exemplary form of a computer system 1000 on which instructions 1024 for causing a machine to perform one or more of the methodologies described herein can be executed. In alternative embodiments, the machine may operate as a standalone device or be connected to other machines (e.g., networked). In a networked deployment, the machine may operate as a server or client machine in a server-client network environment, or as a peer machine in a peer-to-peer (or distributed) network environment. The machine may be a personal computer (PC), tablet PC, set-top box (STB), personal digital assistant (PDA), mobile phone, web device, network router, switch, or bridge, or a machine capable of executing instructions (sequential or otherwise) that specify an action to be performed by any machine. Furthermore, although only a single machine is illustrated, the term “machine” shall also be interpreted to include any set of machines individually or collectively executing one or more sets of instructions for performing one or more of the methodologies described herein.

[0132] An exemplary computer system 1000 includes a processor 1002 (e.g., a central processing unit (CPU), a graphics processing unit (GPU), or both), main memory 1004, and static memory 1006, which communicate with each other via bus 808. The computer system 1000 may further include a video display unit 1010 (e.g., a liquid crystal display (LCD) or a cathode ray tube (CRT)). The computer system 1000 also includes an alphanumeric input device 1012 (e.g., a keyboard or a touch-sensitive display screen), a user interface (UI) navigation (or cursor control) device 1014 (e.g., a mouse), a storage unit 1016, a signal generation device 1018 (e.g., a speaker), and a network interface device 1020. [Machine-readable media]

[0133] The memory unit 1016 includes a machine-readable medium 1022 in which one or more sets of data structures and instructions 1024 (e.g., software) that embody or utilize one or more of the methodologies or functions described herein are stored. The instructions 1024 may reside entirely or at least partially in the main memory 1004 and / or in the processor 1002 being executed by the computer system 1000, and the main memory 1004 and the processor 1002 also constitute the machine-readable medium 1022.

[0134] In one exemplary embodiment, the machine-readable medium 1022 is shown as a single medium, but the term “machine-readable medium” may include one or more mediums (e.g., a centralized or distributed database, and / or associated caches and servers) that store one or more instructions 1024 or data structures. The term “machine-readable medium” shall also be interpreted as including any tangible medium capable of storing, encoding, or carrying instructions 1024 for execution by a machine, and causing a machine to execute one or more of the methodologies of this disclosure, or storing, encoding, or carrying data structures that are utilized by or associated with such instructions 1024. Accordingly, the term “machine-readable medium” shall be interpreted as including, but is not limited to, solid-state memory, optical media, and magnetic media. Specific examples of machine-readable media 1022 include non-volatile memory, such as semiconductor memory devices (e.g., erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM)) and flash memory devices; magnetic disks, such as internal hard disks and removable disks; magneto-optical disks; and disks such as compact disc read-only memory (CD-ROM) and digital multipurpose disc read-only memory (DVD-ROM). Machine-readable media are not transmission media. [Transmission medium]

[0135] Instruction 1024 may further be transmitted or received via a communication network 1026 using a transmission medium. Instruction 1024 may be transmitted using a network interface device 1020 and one of several well-known transport protocols (e.g., Hypertext Transport Protocol (HTTP)). Examples of communication networks include local area networks (LANs), wide area networks (WANs), the Internet, cellular networks, basic telephone (POTS) networks, and wireless data networks (e.g., Wi-Fi and WiMAX networks). The term “transmission medium” shall be interpreted as including any intangible medium, including digital or analog communication signals or other intangible medium, that can store, encode, or carry instructions 1024 for execution on a machine and facilitate communication of such software.

[0136] While this specification describes specific exemplary embodiments, it will be apparent that various modifications and changes can be made to these embodiments without departing from the broader spirit and scope of this disclosure. Therefore, this specification and the drawings should be considered illustrative rather than restrictive. The accompanying drawings, forming part of this specification, illustrate, not restrictively, specific embodiments in which the subject matter can be put into practice. The embodiments shown are described in sufficient detail to enable a person skilled in the art to put into practice the teachings disclosed herein. Other embodiments may be used and derived therefrom, resulting in structural and logical substitutions and changes without departing from the scope of this disclosure. Therefore, this detailed description should not be interpreted restrictively, and the scope of the various embodiments, together with the entire scope of the equivalents to which the accompanying claims are entitled, is defined solely by the claims.

[0137] In this specification, embodiments relating to the subject matter of the present invention may be referred to individually and / or collectively by the term "invention" for convenience only, and the scope of this application is not intended to be arbitrarily limited to any single invention or inventive concept when more than one is actually disclosed. Therefore, while specific embodiments have been illustrated and described herein, it should be understood that any arrangement calculated to achieve the same objective may substitute for the specific embodiments shown. This disclosure is intended to cover all possible adaptations or variations of various embodiments. Considering the above description, combinations of the embodiments described herein with other embodiments not specifically described herein will be apparent to those skilled in the art.

[0138] Some parts of the subject matter described herein may be presented in terms of algorithms or symbolic representations of operations on data stored as bits or binary digital signals in machine memory (e.g., computer memory). Such algorithms or symbolic representations are examples of techniques used by those skilled in the field of data processing to communicate the substance of their research to others skilled in the field. As used herein, “algorithm” is a consistent sequence of operations or similar operations that produce a desired result. Algorithms and operations in this context involve the physical handling of physical quantities. While not always the case, such quantities may typically take the form of electrical, magnetic, or optical signals that can be stored, accessed, transferred, combined, compared, or otherwise manipulated by a machine. For reasons of general use, it may be convenient to use words such as “data,” “content,” “bit,” “value,” “element,” “symbol,” “character,” “period,” “number,” or “digit” when referring to such signals. However, these words are merely convenient labels and should be associated with appropriate physical quantities.

[0139] Unless otherwise specified, any description herein using words such as “processing,” “calculating,” “calculating,” “determining,” “presenting,” or “displaying” may refer to the operation or process of a machine (e.g., a computer) that manipulates or transforms data expressed as physical (e.g., electronic, magnetic, or optical) quantities in one or more memories (e.g., volatile memory, non-volatile memory, or any suitable combination thereof), registers, or other machine components that receive, store, transmit, or display information. Furthermore, unless otherwise specified, the term “one (a and an)” as found in the patent text is used herein to include one or more examples. Finally, where herein is used, the conjunction “or” means non-exclusive “or” unless otherwise specified. [Other adjacent items] (Item 1) A system that isolates memory in a trusted execution environment (TEE), wherein the above system is Processor and Memory for storing instructions and Equipped with, When the above instruction is executed by the above processor, the above processor will: The operation of allocating multiple parts of memory, including the first and second parts, to the TEE, An action to prevent the instructions being executed in the first part above from accessing the data stored in the second part above. Perform an action that includes system (Item 2) The above operation is, An operation to switch between the first extended page table (EPT) of the first part and the second EPT of the second part in response to a Safety Arbitration Mode (SEAM) function call. The system described in item 1, further including the above. (Item 3) The above operation is, The operation of encrypting the above first part using the first encryption key, The operation of encrypting the above second part using the second encryption key and The system described in item 1, further including the above. (Item 4) The above parts include the third part, The instructions executed in the third part above are permitted to access the data stored in the first part above. The system described in item 1. (Item 5) Access to the above data within the first part above is controlled at a granularity level smaller than the page, as described in item 4. (Item 6) The above instruction is given to the above processor, An operation that prevents the instructions executed in the second part above from accessing the data stored in the first part above. The system described in item 1 further executes the above. (Item 7) The above operation is, The operation to create the above TEE in response to a Safety Arbitration Mode (SEAM) function call. The system described in item 1, further including the above. (Item 8) As a result of the above creation of the TEE, the third portion of the above memory is allocated to the above TEE. The above operation is, In response to a second SEAM function call, the operation involves allocating the first portion of the memory to the TEE, In response to a third SEAM function call, the operation involves allocating the second portion of the memory to the TEE. This also includes, The system described in item 7. (Item 9) In the third part above, the system on which the guest operating system runs is as described in item 8. (Item 10) The guest operating system described in item 9 calls the first function in the first part and the second function in the second part. (Item 11) A method of isolating memory in a trusted execution environment (TEE), The processor allocates multiple parts of memory, including the first and second parts, to the TEE. The above processor performs the step of preventing instructions being executed in the first part from accessing data stored in the second part. A method for providing this. (Item 12) A step in which, in response to a Safety Arbitration Mode (SEAM) function call, a switch is made between the first extended page table (EPT) of the first part and the second EPT of the second part. The method described in item 11, further comprising: (Item 13) The first step is to encrypt the above first part using the first encryption key, The step of encrypting the above second part using the second encryption key The method described in item 11, further comprising: (Item 14) The above parts include the third part, The instructions executed in the third part above are permitted to access the data stored in the first part above. The method described in item 11. (Item 15) Access to the above data within the above first part is controlled at a granularity level smaller than the page, as described in item 14. (Item 16) A non-temporary computer-readable medium comprising instructions, wherein the instructions are provided to a processor, The operation of allocating multiple parts of memory, including the first and second parts, to the TEE, The operation prevents the instructions executed in the first part above from accessing the data stored in the second part above. A non-temporary computer-readable medium intended to isolate memory in a trusted execution environment (TEE) by performing operations that include such actions. (Item 17) The above operation is, An operation to switch between the first extended page table (EPT) of the first part and the second EPT of the second part in response to a Safety Arbitration Mode (SEAM) function call. Non-temporary computer-readable media as described in item 16, including, further. (Item 18) The above operation is, The operation of encrypting the above first part using the first encryption key, The operation of encrypting the above second part using the second encryption key and Non-temporary computer-readable media as described in item 16, including, further. (Item 19) The above parts include the third part, The instructions executed in the third part above are permitted to access the data stored in the first part above. Non-temporary computer-readable media as described in item 16. (Item 20) Access to the above data within the first part above is controlled at a granularity smaller than a page, in non-temporary computer-readable media as described in item 19. (Item 21) The above operation is, An operation that prevents the instructions executed in the second part above from accessing the data stored in the first part above. Non-temporary computer-readable media as described in item 16, including, further. (Item 22) The above operation is, The operation to create the above TEE in response to a Safety Arbitration Mode (SEAM) function call. Non-temporary computer-readable media as described in item 16, including, further. (Item 23) As a result of the above creation of the TEE, the third portion of the above memory is allocated to the above TEE. The above operation is, In response to a second SEAM function call, the operation involves allocating the first portion of the memory to the TEE, In response to a third SEAM function call, the operation involves allocating the second portion of the memory to the TEE. This also includes, Non-temporary computer-readable media as described in item 22. (Item 24) In the third part above, the guest operating system runs on a non-temporary computer-readable medium as described in item 23. (Item 25) The guest operating system invokes the first function within the first part and the second function within the second part, using the non-temporary computer-readable media described in item 24.

Claims

1. A system that isolates memory in a trusted execution environment (TEE), wherein the system is Processor and Memory for storing instructions and Equipped with, When the aforementioned instruction is executed by the processor, the processor will: An operation to allocate multiple parts of memory, including a first part and a second part, to a single TEE applied by hardware, wherein the first part corresponds to an executable first function, the second part corresponds to an executable second function, and the executable first function and the executable second function each have separate, isolated first extended page tables (EPTs) and second EPTs, respectively. Based on the separation of the EPT, an operation is performed to prevent instructions being executed in the first part from accessing data stored in the second part, An operation to switch between the first EPT of the first part and the second EPT of the second part in response to a Safety Arbitration Mode (SEAM) function call. A system that performs actions including those mentioned above.

2. The system according to claim 1, wherein the first EPT and the second EPT each refer to the first and second portions of the memory allocated to a single TEE applied by the hardware.

3. A system that isolates memory in a trusted execution environment (TEE), wherein the system is Processor and Memory for storing instructions and Equipped with, When the aforementioned instruction is executed by the processor, the processor will: The operation of allocating multiple parts of memory, including the first and second parts, to TEE, An operation to prevent the instruction being executed in the first part from accessing the data stored in the second part, An operation to switch between the first extended page table (EPT) of the first part and the second EPT of the second part in response to a Safety Arbitration Mode (SEAM) function call. Perform an action that includes system.

4. The aforementioned operation is, The operation of encrypting the first part using the first encryption key, The operation of encrypting the second part using the second encryption key and The system according to any one of claims 1 to 3, further comprising:

5. The aforementioned parts include a third part, Instructions executed in the third part are permitted to access data stored in the first part. The system according to any one of claims 1 to 4.

6. The system according to claim 5, wherein access to the data within the first portion is controlled at a granularity smaller than a page.

7. The aforementioned operation is, An operation that prevents instructions being executed in the second part from accessing data stored in the first part. The system according to any one of claims 1 to 6, further comprising:

8. The aforementioned operation is, Operation to create the TEE in response to a Safety Arbitration Mode (SEAM) function call. The system according to any one of claims 1 to 7, further comprising:

9. A system that isolates memory in a trusted execution environment (TEE), wherein the system is Processor and Memory for storing instructions and Equipped with, When the aforementioned instruction is executed by the processor, the processor will: The operation of allocating multiple parts of memory, including the first and second parts, to TEE, An operation to prevent the instruction being executed in the first part from accessing the data stored in the second part, A system that performs an operation including the operation of creating the TEE in response to a Safety Arbitration Mode (SEAM) function call.

10. As a result of the creation of the TEE, the fourth portion of the memory is allocated to the TEE. The aforementioned operation is, In response to a second SEAM function call, the operation of allocating the first portion of the memory to the TEE, In response to a third SEAM function call, the operation involves allocating the second portion of the memory to the TEE. This also includes, The system according to claim 8 or 9.

11. The system according to claim 10, wherein the fourth part runs a guest operating system.

12. The system according to claim 11, which is dependent on claim 1, wherein the guest operating system invokes the first function in the first part and the second function in the second part.

13. A method of isolating memory in a trusted execution environment (TEE), A step in which a processor allocates multiple portions of memory, including a first portion and a second portion, to a single TEE applied by hardware, wherein the first portion corresponds to an executable first function, the second portion corresponds to an executable second function, and the executable first function and the executable second function each have separate, isolated first extended page tables (EPTs) and second EPTs, respectively. Based on the separation of the EPT, the processor ensures that instructions being executed in the first part cannot access data stored in the second part. Steps to switch between the first EPT of the first part and the second EPT of the second part in response to a Safety Arbitration Mode (SEAM) function call. A method for providing this.

14. A method of isolating memory in a trusted execution environment (TEE), The processor allocates multiple parts of memory, including the first and second parts, to the TEE. The processor includes the step of preventing instructions being executed in the first part from accessing data stored in the second part, The steps include: switching between the first extended page table (EPT) of the first part and the second EPT of the second part in response to a Safety Arbitration Mode (SEAM) function call; A method for providing this.

15. The step of encrypting the previous first part using the first encryption key, The step of encrypting the second portion using the second encryption key. The method according to claim 13 or 14, further comprising:

16. The aforementioned parts include a third part, Instructions executed in the third part are permitted to access data stored in the first part. The method according to any one of claims 13 to 15.

17. The method according to claim 16, wherein access to the data within the first portion is controlled at a granularity smaller than a page.

18. A step in which instructions being executed in the second part cannot access data stored in the first part. The method according to any one of claims 13 to 17, further comprising:

19. Steps to create the TEE in response to a Safety Arbitration Mode (SEAM) function call. The method according to any one of claims 13 to 18, further comprising:

20. A method of isolating memory in a trusted execution environment (TEE), The processor allocates multiple parts of memory, including the first and second parts, to the TEE. The processor includes the step of preventing instructions being executed in the first part from accessing data stored in the second part, A method comprising the steps of creating the TEE in response to a Safety Arbitration Mode (SEAM) function call.

21. As a result of the creation of the TEE, the fourth portion of the memory is allocated to the TEE. The aforementioned method, The processor, in response to a second SEAM function call, allocates the first portion of the memory to the TEE, The processor, in response to a third SEAM function call, allocates the second portion of the memory to the TEE. It also has, The method according to claim 19 or 20.

22. The method according to claim 21, wherein the fourth part is on which a guest operating system is run.

23. The method according to claim 22, which is dependent on claim 13, wherein the guest operating system invokes the first function in the first part and the second function in the second part.

24. A computer program that causes a processor to perform a procedure for isolating memory in a trusted execution environment (TEE), wherein the procedure is: A procedure for allocating multiple portions of memory, including a first portion and a second portion, to a single TEE applied by hardware, wherein the first portion corresponds to an executable first function, the second portion corresponds to an executable second function, and the executable first function and the executable second function each have separate, isolated first extended page tables (EPTs) and second EPTs, respectively. Based on the separation of the EPT, a procedure to prevent instructions executed in the first part from accessing data stored in the second part, Procedure for switching between the first EPT of the first part and the second EPT of the second part in response to a Safety Arbitration Mode (SEAM) function call. A computer program that includes [this].

25. A computer program that causes a processor to perform a procedure for isolating memory in a trusted execution environment (TEE), wherein the procedure is: A procedure for allocating multiple parts of memory, including the first and second parts, to the TEE, A procedure to prevent an instruction being executed in the first part from accessing data stored in the second part, A computer program that includes a procedure for switching between a first extended page table (EPT) of the first part and a second EPT of the second part in response to a Safety Arbitration Mode (SEAM) function call.

26. The above procedure is, The procedure for encrypting the first part of the previous section using the first encryption key, The procedure for encrypting the second part above using the second encryption key and The computer program according to claim 24, further comprising:

27. A system that isolates memory in a trusted execution environment (TEE), wherein the system is Memory means and Processing means and The processing means is equipped with, The TEE is created by allocating a portion of the storage means to a single TEE applied by hardware, and preventing access to the allocated portion by instructions stored outside the allocated portion. The storage means is divided into a plurality of parts, including a first part and a second part, wherein the first part corresponds to an executable first function, the second part corresponds to an executable second function, and the executable first function and the executable second function each have separate first extended page tables (EPTs) and second EPTs, respectively. The separation of the EPT prevents instructions executed in the first part from accessing data stored in the second part. In response to a Safety Arbitration Mode (SEAM) function call, the system switches between the first EPT of the first part and the second EPT of the second part. To do system.

28. A system that isolates memory in a trusted execution environment (TEE), wherein the system is Memory means and Processing means and The processing means is equipped with, The TEE is created by allocating a portion of the storage means to the TEE and preventing access to the allocated portion by commands stored outside the allocated portion. Dividing the aforementioned storage means into a portion of which includes a first portion and a second portion, The instruction being executed in the first part prevents access to the data stored in the second part, In response to a Safety Arbitration Mode (SEAM) function call, a switch is made between the first extended page table (EPT) of the first part and the second EPT of the second part. system.

29. A non-temporary computer-readable medium storing a computer program according to any one of claims 24 to 26.

Images