Secure Enclave Memory Management via EPC MMU
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing information processing systems face challenges in securely managing memory within secure enclaves, particularly in ensuring the integrity and isolation of confidential data from the operating system's unapproved changes and faults.
Innovation Solution
The implementation of a secure enclave unit with an Enclave Page Cache (EPC) Memory Management Unit (MMU) that uses specific instructions (EADD, EAUG, EMOD, EACCEPT, EREMOVE) to dynamically manage memory spaces, ensuring secure memory allocation, access control, and integrity protection through the use of PENDING and MODIFIED bits in the EPC Map, allowing applications to securely manage their memory without operating system interference.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the operating system manages memory directly, then memory management is simple and integrated, but secure enclave isolation and integrity protection are compromised
Solution Approach 1:
The patent divides the memory management system into separate components: the EPC MMU handles secure enclave memory management independently from the main system MMU. This segmentation allows the secure enclave to have its own isolated memory management unit that enforces security policies without relying on the operating system, thereby maintaining isolation while managing complexity through dedicated hardware enforcement.
Solution Approach 2:
The EPC MMU acts as an intermediary between the secure enclave application and the system memory. It mediates all memory access requests by the secure enclave, enforcing access control policies and preventing unauthorized access to confidential data. This intermediary layer protects the secure enclave from operating system interference while still allowing controlled communication with system resources.
2Reliability
If the secure enclave prevents operating system access, then data integrity and security are improved, but memory allocation and management become more complex
Solution Approach 1:
The system performs preliminary actions by pre-allocating and pre-configuring memory pages for secure enclave use through the EPC MMU before the operating system needs to access them. Pages are marked with security attributes and access control policies in advance, allowing the secure enclave to operate with guaranteed isolation without requiring complex runtime negotiations with the operating system.
Solution Approach 2:
The EPC MMU implements dynamic memory management for secure enclaves, allowing memory pages to be allocated, deallocated, and reconfigured based on runtime needs. The PENDING and MODIFIED bits enable dynamic tracking of page states, allowing the system to adapt memory allocation while maintaining security constraints, thus managing complexity through flexible hardware-supported state tracking.
3Reliability
If independent application operation is enabled, then security isolation is improved, but system-wide memory coordination becomes more difficult
Solution Approach 1:
The EPC MMU implements feedback mechanisms through status bits (PENDING, MODIFIED) that provide real-time information about the state of memory pages. This feedback allows the system to coordinate memory operations between the secure enclave and operating system by monitoring page states and enforcing appropriate access policies, thereby maintaining isolation while enabling coordinated memory management through hardware-supported state visibility.
Data Source
AI summary
Embodiments of an invention for memory management in secure enclaves are disclosed. In one embodiment, a processor includes an instruction unit and an execution unit. The instruction unit is to receive a first instruction and a second instruction. The execution unit is to execute the first instruction, wherein execution of the first instruction includes allocating a page in an enclave page cache to a secure enclave. The execution unit is also to execute the second instruction, wherein execution of the second instruction includes confirming the allocation of the page.