Loading patent…
AssigneeMicrosoft Technology Licensing, LLC
InventorsYoussef Barakat, Kinshuman Kinshumann, Brian Perkins, Jinsub Moon
Estimating the term…
Constructs to define a Trusted Execution Environment Driver that can implement a standard communication interface in a first environment for discovering and/or exchanging messages with secure applications/services executed in a Trusted Execution Environment (TrEE). The first environment can represent an environment with a different security policy from the TrEE. The TrEE driver can include a standard interface and/or mechanism by which applications/services and drivers within a first environment can access secure applications/services in the TrEE, a standard interface and/or mechanism by which third-party vendors can expose their TrEE applications/services to a first environment, a standard interface and/or mechanism by which a TrEE can request applications/services, on its own behalf, from the first environment, and a standard interface and/or mechanism to facilitate the management of secure application/services and/or provide I/O prioritization and security protection for individual secure applications/services.
A method comprising:
A computer-readable storage device having computer-executable instructions thereon that, upon execution, configure a computer to perform operations comprising:
A system comprising:
A method comprising:
Dependencies are inferred from the claim text.
Drawings are temporarily unavailable. Open the PDF at USPTO
From the US filing history. Foreign family members aren’t listed.
Network architectures or network communication protocols for network security
During program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow: by executing in a restricted environment, e.g.…
For controlling access to devices or network resources: access control lists [ACL]
Network architectures or network communication protocols for network security: for managing network security; network security policies in general
About 7 years 11 months of term left · ends 14 Sep 2034 (estimated)
Operating systems are often required to interface with secure environments to implement general computing operations. These secure environments are generally platform-specific and vendor proprietary. To make use of these secure environments, it is necessary to use a platform-specific secure service protocol as an interface between the operating system and the secure environment. Typically, most proprietary interfaces implement an isolated interface with a secure environment and are restricted to a monolithic service such as a Trusted Platform Module (TPM), secure variables or graphics mini-ports. Such interfaces are often found lacking in flexibility to support arbitrary services and fail to address quality of service or security issues that typically arise with an open, extensible operating system.
Moreover, the use of monolithic proprietary interfaces often requires specialized programming code to be integrated with the high level operating system. Any changes implemented to the operating system will subsequently require changes to the specialized programming code of each monolithic proprietary interface.
This disclosure describes systems and methods for implementing a Trusted Execution Environment (TrEE) driver to provide a consistent interface for operating system (OS) components or drivers to communicate with secure services in a platform-specific environment.
The detailed description is described with reference to the accompanying figures. In the figures, the left-most digit(s) of a reference number identifies the figure in which the reference number first appears. The same reference numbers in different figures indicate similar or identical items.
FIG. 1 is a block diagram depicting an example environment for implementing a service interface between a first environment and a TrEE.
FIG. 2 is a block diagram depicting aspects of example computer devices to execute an operating system and its service interface with a TrEE.
Overview
Examples described herein provide constructs of a Trusted Execution Environment (TrEE) driver to provide a consistent interface for Operating System (OS) components or drivers that need to communicate with secure applications/services executed in a platform-specific environment. Such secure applications/services may be implemented using specialized programming and/or hardware programmed with specific instructions to implement the specified functions. For example, secure applications/services may have different execution models as is the case for graphics processing units (GPUs) and computer processing unit (CPUs).
The terms “unsecure” and “secure,” as described herein, are used to describe the relative strength of security policies associated with a first environment and a secure environment, namely the TrEE. In instances where an “unsecure” first application/service is described as accessing a “secure” second application/service, the terms “unsecure” and “secure” are intended to describe the relative strength of the security policies for the first application/service and the second application/service. In the above example, the unsecure application/service will have a less stringent security policy than the “secure” second application/service. Moreover, the use of the term “unsecure” does not imply a lack of security policy altogether.