Secure Enclave Paging Interruption Logic
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing solutions fail to effectively manage the interruption and resumption of paging operations in secure enclaves, leading to performance challenges and potential glitches in services like voice, video, and real-time transactions due to frequent interrupts and the need for cryptographic operations on large memory pages.
Innovation Solution
The implementation of specific instructions and processing logic that allow for the interruption and resumption of paging operations in secure enclaves, using instructions like EBLOCK, ETRACK, EWRITEBACK, and ELOAD RESUME, which manage page mappings, TLB entries, and encryption/decryption processes to ensure secure data integrity and timely interrupt servicing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic operations are performed on entire memory pages for secure enclave paging, then data security is improved, but processing time and operational complexity increase significantly
Solution Approach 1:
The patent divides a memory page into multiple segments or blocks, allowing cryptographic operations to be performed on individual segments rather than the entire page. This segmentation enables interruptible paging operations where processing can be paused and resumed without requiring re-execution of the entire cryptographic operation on the full page.
Solution Approach 2:
The patent performs preliminary cryptographic operations on portions of the memory page before an interrupt occurs, storing the intermediate state. When the interrupt is handled, the paging operation can resume from where it left off rather than restarting, reducing the total time spent on cryptographic operations.
2Ease of operation
If paging operations are allowed to be interrupted, then interrupt servicing for real-time services is improved, but forward progress of paging operations cannot be guaranteed
Solution Approach 1:
The patent implements a feedback mechanism that tracks the state of paging operations and determines whether they can be safely interrupted or must be completed. The system provides feedback to the interrupt handler about the current paging state, enabling informed decisions about whether to allow interruption or defer the interrupt to ensure forward progress.
Solution Approach 2:
The patent introduces dynamic control over interrupt handling based on the paging operation state. The system can dynamically adjust whether interrupts are permitted during paging operations, transitioning between interruptible and non-interruptible states based on operational needs and system conditions.
3Productivity
If paging operations are made non-interruptible to guarantee forward progress, then paging reliability is improved, but real-time services experience unacceptable glitches
Solution Approach 1:
By segmenting the paging operation into smaller units that can be completed quickly, the system can allow interrupts between segments without significantly impacting overall paging throughput. This segmentation enables real-time services to be serviced while maintaining acceptable paging performance.
Solution Approach 2:
The patent employs periodic checking of paging operation status and periodic opportunities for interrupt handling. Rather than making the entire operation non-interruptible, the system creates periodic windows where interrupts can be serviced while ensuring that paging progress is maintained through structured resumption points.
Data Source
AI summary
Instructions and logic interrupt and resume paging in secure enclaves. Embodiments include instructions, specify page addresses allocated to a secure enclave, the instructions are decoded for execution by a processor. The processor includes an enclave page cache to store secure data in a first cache line and in a last cache line for a page corresponding to the page address. A page state is read from the first or last cache line for the page when an entry in an enclave page cache mapping for the page indicates only a partial page is stored in the enclave page cache. The entry for a partial page may be set, and a new page state may be recorded in the first cache line when writing-back, or in the last cache line when loading the page when the instruction's execution is being interrupted. Thus the writing-back, or loading can be resumed.