Extended Segmentation for Secure Enclave Memory Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current processors do not support efficient memory segmentation features within secure enclaves, particularly in 64-bit mode, limiting data protection and performance for sandboxed applications.
Innovation Solution
Implementing protection extensions in processors that enable low-latency segmentation, extended descriptors, and segment-linked range registers to manage memory segments, allowing efficient memory protection and isolation between applications or application parts, even in 64-bit addressing, while supporting secure enclaves like Intel® SGX.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional segmentation features are used in 64-bit mode within secure enclaves, then memory protection is provided, but performance degrades due to mode-switching overhead and limited segmentation support
Solution Approach 1:
The patent implements extended segmentation by dividing the 64-bit virtual address space into multiple segments using segment descriptors that contain base addresses and limits. This allows fine-grained memory protection within secure enclaves without requiring mode switching, as the segmentation operates natively in 64-bit mode through extended descriptor tables (EDT) and segment-linked range registers (SLRR).
Solution Approach 2:
The patent changes the parameters of segmentation by extending the segment descriptor format to support 64-bit addresses, introducing new fields such as 64-bit base addresses, 48-bit limits, and type flags that enable different segmentation modes. This allows the system to maintain protection while operating efficiently in 64-bit mode without legacy constraints.
2Adaptability or versatility
If segment base is set to zero for most segments within secure enclave, then processor compatibility is maintained, but memory isolation capability is reduced
Solution Approach 1:
The patent adds another dimension to segmentation by introducing segment-linked range registers (SLRR) that provide an additional layer of address space isolation. This allows non-zero segment bases to be used within secure enclaves while maintaining processor compatibility through the extended descriptor format, effectively adding a new dimension to the address space organization that enables both compatibility and enhanced isolation.
3Reliability
If extended descriptors and segment-linked range registers are implemented, then memory protection and isolation are enhanced, but device complexity increases
Solution Approach 1:
The patent implements self-service mechanisms where the extended descriptor tables and segment-linked range registers automatically manage memory protection without requiring external intervention or mode switching. The segmentation hardware autonomously enforces access controls, validates addresses against segment limits, and handles protection violations, reducing the need for complex software management while enhancing protection.
Data Source
AI summary
Technologies for memory management with memory protection extension include a computing device having a processor with one or more protection extensions. The processor may load a logical address including a segment base, effective limit, and effective address and generate a linear address as a function of the logical address with the effective limit as a mask. The processor may switch to a new task described by a task state segment extension. The task state extension may specify a low-latency segmentation mode. The processor may prohibit access to a descriptor in a local descriptor table with a descriptor privilege level lower than the current privilege level of the processor. The computing device may load a secure enclave using secure enclave support of the processor. The secure enclave may load an unsandbox and a sandboxed application in a user privilege level of the processor. Other embodiments are described and claimed.