Trusted Execution Environment Isolation via Enclave Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for providing Global Platform (GP) compliant Trusted Execution Environment (TEE) either create a larger attack surface due to the inclusion of the entire Virtual Memory Manager in the Trusted Code Base or are resource-constrained with limited scalability.
Innovation Solution
A system and method that utilize a main processor with features like Intel Software Guard Extensions (SGX) to provide a secure execution environment for Trusted Applications, isolating them within their own enclaves and leveraging a security processor for secure services, without requiring changes to client applications and maintaining scalability by running GP TEE on the main processor.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If VMM based approach is used to provide GP TEE support, then TEE functionality is achieved, but attack surface increases and isolation is lost
Solution Approach 1:
The patent segments the TEE implementation by creating separate enclave processes for each trusted application, isolating them from the VMM and each other. This segmentation reduces the attack surface by limiting the scope of potential exploits to individual enclaves rather than the entire VMM, while maintaining TEE functionality through the enclave architecture.
2Reliability
If TEE is implemented entirely within security processor, then security is enhanced, but scalability is limited due to resource constraints
Solution Approach 1:
The patent introduces an intermediary architecture where the main processor executes enclave processes with hardware-enforced isolation, acting as a mediator between the security processor and trusted applications. This intermediary approach allows TEE functionality to scale across multiple applications and users by leveraging the main processor's resources while maintaining security through hardware-based enclave isolation.
3Adaptability or versatility
If entire VMM is included in Trusted Code Base, then TEE support is provided, but trusted applications do not have isolation
Solution Approach 1:
The patent segments the execution environment by creating distinct enclave processes for each trusted application, with the VMM operating outside the Trusted Code Base. This segmentation provides both TEE support through the enclave architecture and application isolation through process boundaries, allowing multiple trusted applications to run securely without interfering with each other.
4Reliability
If security processor is used for TEE, then secure execution is achieved, but system responsiveness may be reduced
Solution Approach 1:
The patent enables the main processor to self-service TEE execution by running enclave processes directly on its cores with hardware-enforced isolation, reducing the need for constant security processor intervention. This self-service approach maintains secure execution through hardware-based enclave protection while improving system responsiveness by keeping trusted applications accessible through the main processor's high-performance execution paths.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Method of providing a Global Platform (GP) compliant Trusted Execution Environment (TEE) starts with main processor executing an application stored in memory device. Application includes client application (CA) and trusted application (TA). Executing the application includes running CA in client process and TA in TEE host process. Client process and TEE host process are separate. Using TEE host process, a request including identifier of the TA is received from client process to open session. Using GP Trusted Services enclave included in TEE host process, TA enclave associated with the identifier is determined and loaded in the TEE host process using the GP Trusted Services enclave to establish the session. Using TEE host process, commands to be invoked in TA enclave and set of parameters needed for commands are received from client process. Using GP Internal APIs, commands in TA enclave associated with identifier are executed. Other embodiments are also described.