Techniques for secure-chip memory for trusted execution environments
AssigneeIntel Corporation
InventorsAlpa T. Narendra Trivedi, Siddhartha Chhabra
Life of this patent
Estimating the term…
Abstract
Techniques for secure-chip memory for trusted execution environments are described. A processor may include a memory configured to interface with a trusted execution environment. The processor may be configured to indicate to a trusted execution environment that the memory supports dedicated access to the trusted execution environment. The processor may receive an instruction from the trusted execution environment. The processor may enforce an access control policy of an interface plugin to limit access of the memory by the trusted execution environment to a partition of the memory associated with the trusted execution environment. Other embodiments are described and claimed.
Claims25
A system, comprising:
- a processor comprising processor circuitry and memory configured to interface with a plurality of trusted execution environments, the memory comprising a plurality of partitions, wherein a one of the plurality of partitions is statically associated with one of the plurality of trusted execution environments, the processor configured to:
- indicate to a one of the plurality of trusted execution environments that the memory supports dedicated access to the one of the plurality of trusted execution environments;
- receive an instruction from the one of the plurality of trusted execution environments;
- and
- enforce an access control policy of an interface plugin, the access control policy to allow access to the one of the plurality of partitions associated with the one of the plurality of trusted execution environments by the one of the plurality of trusted execution environments and to restrict access to the one of the plurality of partitions by the other ones of the plurality of trusted execution environments.
A computer implemented method for interfacing a plurality of trusted execution environments with a memory of a processor, the memory comprising a plurality of partitions, wherein a one of the plurality of partitions is statically associated with one of the plurality of trusted execution environments, comprising:
- indicating, by the processor, to a one of the plurality of trusted execution environments that the memory of the processor supports dedicated access to the one of the plurality of trusted execution environments;
- receiving an instruction from the one of the plurality of trusted execution environments;
- and
- enforcing an access control policy of an interface plugin, the access control policy to allow access to the one of the plurality of partitions associated with the one of the plurality of trusted execution environments by the one of the plurality of trusted execution environments and to restrict access to the one of the plurality of partitions by the other ones of the plurality of trusted execution environments.
An article comprising a non-transitory computer-readable storage medium that stores instructions for execution by processing circuitry of a computing device for interfacing a plurality of trusted execution environments with a memory, the memory comprising a plurality of partitions, wherein a one of the plurality of partitions is statically associated with one of the plurality of trusted execution environments, the instructions to cause the computing device to:
- indicate to a one of the plurality of trusted execution environments that the memory of the processing circuitry supports dedicated access to the one of the plurality of trusted execution environments;
- receive an instruction from the one of the plurality of trusted execution environments;
- and
- enforce an access control policy of an interface plugin, the access control policy to allow access to the one of the plurality of partitions associated with the one of the plurality of trusted execution environments by the one of the plurality of trusted execution environments and to restrict access to the one of the plurality of partitions by the other ones of the plurality of trusted execution environments.
Dependencies are inferred from the claim text.