Cross-platform enclave identity
AssigneeMicrosoft Technology Licensing, LLC
InventorManuel Costa
Life of this patent
Estimating the term…
Abstract
An abstract enclave identity is presented. An abstract identity may be a secure identity that may be the same for multiple related, but not identical, enclave instantiations. An enclave identity value may be determined from an abstract enclave identity type with respect to a instantiated enclave. An abstract identity value may be used to determine equivalence of two enclave instantiations that are not identical, such as two similar enclaves hosted on different computers, two enclaves hosted on different native enclave platforms, and two enclaves instantiated from different versions of the same enclave binary images.
Claims23
A method for determining enclave equivalence, comprising
- receiving a first attestation report from a first enclave instantiated on a first native enclave platform;
- extracting a first enclave identity value associated with an enclave identity type from the first attestation report;
- receiving a second attestation report from a second enclave instantiated on a second native enclave platform, wherein the first native enclave platform and the second native enclave platform are different;
- extracting a second enclave identity value associated with the enclave identity type from the second attestation report;
- determining the first enclave identity value is the same as the second enclave identity value;
- and
- performing, based on the determining, a computing operation by partially completing the computing operation in the first enclave and partially completing the computing operation in the second enclave.
A system comprising:
- memory;
- and
- one or more processors coupled to the memory, the one or more processors configured to:
- receive a first attestation report from a first enclave instantiated on a first native enclave platform;
- extract a first enclave identity value associated with an enclave identity type from the first attestation report;
- receive a second attestation report from a second enclave instantiated on a second native enclave platform, wherein the first native enclave platform and the second native enclave platform are different;
- extract a second enclave identity value associated with the enclave identity type from the second attestation report;
- compare the first enclave identity value to the second enclave identity value;
- and
- perform a computing operation by partially completing the computing operation in the first enclave and partially completing the computing operation in the second enclave.
A computer program product comprising a computer-readable storage medium having instructions recorded thereon for enabling a processor-based system to perform operations to determine enclave equivalence, the operations comprising:
- receive a first attestation report from a first enclave instantiated on a first native enclave platform;
- extract a first enclave identity value associated with an enclave identity type from the first attestation report;
- receive a second attestation report from a second enclave instantiated on a second native enclave platform, wherein the first native enclave platform and the second native enclave platform are different;
- extract a second enclave identity value associated with the enclave identity type from the second attestation report;
- compare the first enclave identity value to the second enclave identity value;
- and
- perform a computing operation by partially completing the computing operation in the first enclave and partially completing the computing operation in the second enclave.
Dependencies are inferred from the claim text.