On-Chip NVRAM Partitioning for Trusted Execution Environment Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Trusted execution environments (TEEs) face challenges in maintaining secure data storage across sleep states due to the lack of secure and persistent memory solutions that provide the necessary security guarantees, as conventional off-chip storage does not adequately protect sensitive information from compromise.
Innovation Solution
A processor is configured to interface with a trusted execution environment, indicating support for dedicated access to a memory and enforcing access control policies through an interface plugin to limit access to a partitioned memory, ensuring secure storage within on-chip NVRAM, which is partitioned and locked to specific TEEs, preventing accidental or malicious access from other applications or TEEs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If off-chip persistent storage is used for enclave data, then data persistence is achieved, but security protection is insufficient
Solution Approach 1:
The memory is divided into multiple partitions, with each partition dedicated to a specific trusted execution environment. This segmentation ensures that data from different TEEs are isolated and cannot be accessed by each other, providing both persistence and enhanced security. The interface plugin enforces access control policies that limit each TEE to its designated partition only.
2Reliability
If conventional memory access is used for TEE, then ease of operation is maintained, but access control and security isolation are insufficient
Solution Approach 1:
An interface plugin is introduced as an intermediary between the TEE and the memory. This plugin intercepts and manages all memory access requests, enforcing access control policies and ensuring that each TEE can only access its designated partition. The interface plugin abstracts the complexity of access control from the TEE, maintaining ease of operation while ensuring security.
3Productivity
If on-chip NVRAM is used for TEE storage, then performance and state-recoverability are improved, but device complexity increases
Solution Approach 1:
The patent combines on-chip NVRAM with partitioning and access control mechanisms into a unified memory subsystem. By merging these features, the system achieves high performance and state-recoverability while managing complexity through integrated design. The interface plugin is incorporated into the existing memory controller, avoiding the need for separate complex hardware components.
Data Source
AI summary
Techniques for secure-chip memory for trusted execution environments are described. A processor may include a memory configured to interface with a trusted execution environment. The processor may be configured to indicate to a trusted execution environment that the memory supports dedicated access to the trusted execution environment. The processor may receive an instruction from the trusted execution environment. The processor may enforce an access control policy of an interface plugin to limit access of the memory by the trusted execution environment to a partition of the memory associated with the trusted execution environment. Other embodiments are described and claimed.