Unblock Instruction for Secure Page Block Reversal
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional secure paging methods incur significant processing overhead due to the complexity of managing split metadata between secure and unsecure memory during write back and load operations, leading to inefficient use of processing resources and clock cycles.
Innovation Solution
The implementation of an unblock instruction to reverse a page block during secure paging, combined with a unified metadata structure (UMDS) that stores all metadata related to an enclave page, allowing for streamlined execution of write back and load instructions by eliminating the need to access multiple memory locations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If metadata is split between secure memory and unsecure memory during secure paging, then access control and cryptographic operations can be performed, but the complexity of tracking and managing split metadata increases significantly
Solution Approach 1:
The patent merges the split metadata (secure metadata and unsecure metadata) into a single unified metadata structure stored entirely within secure memory. This eliminates the complexity of tracking and managing separate metadata locations while maintaining the security and cryptographic functionality through a consolidated metadata approach.
2Reliability
If processor copies external metadata and encrypted page into secure memory during load operations, then page restoration can be performed, but the number of processor transactions and clock cycles increases
Solution Approach 1:
The patent performs preliminary actions by maintaining all metadata within secure memory during the paging out process. This preliminary organization of metadata eliminates the need for multiple copy and restore operations during page load, reducing the number of processor transactions and clock cycles required for page restoration.
Solution Approach 2:
The patent extracts the metadata from external/unsecure memory locations and consolidates it within secure memory. This extraction eliminates the need for repeated copying operations during load, as all required metadata is already positioned within secure memory for immediate access.
3Reliability
If processor performs authenticated decryption and verification operations during page load, then security is maintained, but processing resources and clock cycles are consumed
Solution Approach 1:
The patent merges the metadata operations into a unified structure within secure memory, allowing authenticated decryption and verification to be performed on consolidated data. This merging reduces the total processing volume compared to handling separate metadata and page data from multiple locations, thereby improving processing efficiency while maintaining security verification.
Data Source
AI summary
A secure enclave circuit stores an enclave page cache map to track contents of a secure enclave in system memory that stores secure data containing a page having a virtual address. An execution unit is to, in response to a request to evict the page from the secure enclave: block creation of translations of the virtual address; record one or more hardware threads currently accessing the secure data in the secure enclave; send an inter-processor interrupt to one or more cores associated with the one or more hardware threads, to cause the one or more hardware threads to exit the secure enclave and to flush translation lookaside buffers of the one or more cores; and in response to detection of a page fault associated with the virtual address for the page in the secure enclave, unblock the creation of translations of the virtual address.