Secure Enclave Page Cache Forking Logic
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current solutions for duplicating secure enclaves during process forking in secure environments face challenges such as performance limitations and security complexities, particularly in high-speed cryptographic operations and real-time transactions, due to the need for secure data handling and OS access restrictions.
Innovation Solution
The implementation of instructions and logic to fork processes and establish child enclaves in a secure enclave page cache, allowing for interrupted and resumed operations, enabling secure copying of secure enclave control structures and pages between parent and child processes while maintaining security and integrity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic operations are performed on entire pages for secure enclave paging, then data security is maintained, but processing time increases significantly (many tens of thousands of cycles)
Solution Approach 1:
The patent segments the secure enclave page cache into multiple regions and implements fine-grained locking mechanisms that allow different regions to be accessed independently. This segmentation enables parallel processing of paging operations in different regions, reducing the overall processing time while maintaining security through region-specific access controls.
Solution Approach 2:
The patent implements preliminary authentication and encryption of secure enclave pages before they are evicted from the secure page cache. By pre-processing the cryptographic operations on pages that are being evicted, the system reduces the time required for cryptographic operations during critical paging events, while still ensuring data security.
2Reliability
If the operating system performs paging operations for secure enclaves, then memory management is maintained, but interrupt servicing is delayed causing service glitches
Solution Approach 1:
The patent implements dynamic priority adjustment for paging operations based on system conditions. When real-time services are active, paging operations are scheduled with lower priority to allow interrupt servicing. The system dynamically adjusts the scheduling of paging operations to balance memory management requirements with service responsiveness, preventing glitches in time-critical services.
3Reliability
If the operating system cannot access decrypted enclave data, then security is maintained, but process forking capability is lost
Solution Approach 1:
The patent introduces a secure intermediary mechanism that allows the operating system to access enclave data only under controlled conditions. The OS can access decrypted enclave data when it needs to perform process forking operations, but this access is mediated through secure authentication and authorization checks. This intermediary approach maintains security by limiting OS access to specific authorized operations while enabling process forking capability.
Data Source
Figure 1A
Figure 1B
Figure 1C
AI summary
Instructions and logic fork processes and establish child enclaves in a secure enclave page cache (EPC). Instructions specify addresses for secure storage allocated to enclaves of a parent and a child process to store secure enclave control structure (SECS) data, application data, code, etc. The processor includes an EPC to store enclave data of the parent and child processes. Embodiments of the parent may execute, or a system may execute an instruction to copy parent SECS to secure storage for the child, initialize a unique child ID and link to the parent's SECS/ID. Embodiments of the child may execute, or the system may execute an instruction to copy pages from the parent enclave to the enclave of the child where both have the same key, set an entry for EPC mapping to partial completion, and record a page state in the child enclave, if interrupted. Thus copying can be resumed.