Context-Sensitive Interrupts in Trusted Execution Environments
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing solutions for handling interrupt events in trusted execution environments (TEEs) introduce processing inefficiencies and security issues due to the need for context switches and reliance on common trusted runtimes, which can be unnecessary and insecure, especially when multiple stakeholders are involved.
Innovation Solution
A context-specific interrupt instantiation module creates interrupt gate entries in an interrupt dispatch table that point to context-specific local descriptor tables, allowing interrupts to be resolved at runtime within an active compartment, eliminating the need for context switches and shared trusted runtimes by using memory segment descriptors to identify interrupt service routines and protecting them with write access protection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a common trusted runtime (e.g., TRUSTZONE Monitor or INTEL SMM) is used to dispatch interrupts in a TEE, then security is maintained through centralized control, but processing time increases due to context switch overhead
Solution Approach 1:
The patent divides the interrupt handling system into compartment-specific segments. Each compartment has its own interrupt descriptor table and local descriptor tables, eliminating the need for a common trusted runtime to dispatch interrupts. This segmentation allows interrupts to be handled directly within the active compartment context, removing context switch overhead while maintaining security through compartment-specific access control.
Solution Approach 2:
The patent extracts the interrupt dispatch function from the common trusted runtime and relocates it to the compartment level. By taking out the dispatch responsibility from the centralized trusted runtime and placing it at the compartment level through compartment-specific IDTs and LDTs, the system eliminates unnecessary context switches while preserving security through compartment-specific access control.
2Reliability
If a common trusted runtime is used for interrupt handling, then centralized security control is achieved, but device complexity increases due to the need for context switching mechanisms
Solution Approach 1:
The patent segments the interrupt handling architecture into compartment-specific components. Each compartment has its own interrupt descriptor table and local descriptor tables, eliminating the need for complex context switching mechanisms. The segmentation approach simplifies the overall system by removing the trusted runtime dispatch layer while maintaining security through compartment-specific access control.
Solution Approach 2:
The patent extracts the context switching mechanism from the interrupt handling path. By removing the trusted runtime dispatch layer and its associated context switching infrastructure, the system reduces device complexity while maintaining security through compartment-specific IDT and LDT structures that handle interrupts directly within the active compartment context.
3Adaptability or versatility
If a common trusted runtime is used to handle interrupts across multiple compartments, then centralized management is achieved, but security risks arise when multiple stakeholders are involved
Solution Approach 1:
The patent segments the interrupt handling authority by compartment, allowing each compartment (potentially controlled by different stakeholders) to have independent interrupt descriptors and local descriptor tables. This segmentation enables multiple stakeholders to maintain security control over their respective compartments without requiring trust in a common runtime, as each compartment's interrupt handling is isolated and controlled locally.
Solution Approach 2:
The patent applies local quality by making interrupt handling properties specific to each compartment rather than uniform across all compartments. Each compartment has its own IDT and LDT configurations tailored to its specific security requirements and stakeholder controls, allowing customized security policies for each compartment while maintaining overall system security through isolation.
Data Source
AI summary
Methods, apparatus, and system to create interrupts which are resolved at runtime relative to an active compartment. Active compartments may be, for example, a compartment of an operating system (“OS”) or a trusted execution environment (“TEE”). The context-specific interrupts comprise an interrupt dispatch table (“IDT”) for each compartment.