# US 11,030,120 B2 · Host-convertible secure enclaves in memory that leverage multi-key total memory encryption with integrity

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,030,120 B2
- Document ID: US11030120B2
- Status: Granted
- Kind: B2
- Application number: 16/454,481
- Filed: 2019-06-27
- Published: 2021-03-04
- Granted: 2021-06-08
- Earliest claimed: 2019-06-27
- Assignees: Intel Corporation
- Applicants: Intel Corporation
- Inventors: Krystof C. Zmudzinski; Simon P. Johnson; Raghunandan Makaram; Francis X. McKeen; Carlos V. Rozas; Meltem Ozsoy; Ilya Alexandrovich; Siddhartha Chhabra
- Web page: https://patentgrep.com/patent/US11030120B2

## CPC

- G06F 12/1408: {by using cryptography (for digital transmission H04L9/00)}
- G06F 21/79: in semiconductor storage media, e.g. directly-addressable memories
- G06F 9/4406: {Loading of operating system}
- G06F 11/0772: {Means for error signaling, e.g. using interrupts, exception flags, dedicated error registers}
- G06F 11/3037: {where the computing system component is a memory, e.g. virtual memory, cache (accessing, addressing or allocating within memory systems or architectures G06F12/00; checking stores for correct operation G11C29/00)}
- G06F 12/0804: with main memory updating (G06F12/0806 takes precedence)
- G06F 12/0871: Allocation or management of cache space
- G06F 12/0882: Page mode
- G06F 12/0891: using clearing, invalidating or resetting means
- G06F 12/1036: for multiple virtual address spaces, e.g. segmentation (G06F12/1045 takes precedence)
- G06F 12/1063: {the data cache being concurrently virtually addressed}
- G06F 12/1441: {for a range}
- G06F 12/1466: {Key-lock mechanism}
- G06F 2212/1052: Security improvement
- G06F 2212/151: Emulated environment, e.g. virtual machine
- G06F 2212/657: Virtual address space management
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A processor includes a cryptographic engine to control access, using an secure region key identifier (ID), to one or more memory range of memory allocable for flexible conversion to secure pages of architecturally-protected memory regions, and a processor core. The processor core is to, responsive to receipt of a request to access the memory, perform a walk of page tables and extended page tables to translate a linear address of the request to a physical address of the memory. The processor core is further to determine that the physical address corresponds to an secure page within the one or more memory range of the memory, that a first key ID located within the physical address does not match the secure region key ID, and issue a page fault and deny access to the secure page in the memory.

## Claims

### Claim 1

A processor comprising:
a cryptographic engine to control access, using a secure region key identifier (ID), to one or more memory range of memory allocable for flexible conversion to secure pages of architecturally-protected memory regions; and
a processor core coupled to the cryptographic engine, the processor core to:
determine that a physical address associated with a request to access the memory corresponds to a secure page within the one or more memory range of the memory;
determine that a first key ID located within the physical address does not match the secure region key ID; and
issue a page fault and deny access to the secure page in the memory, wherein one of:
the processor core further comprises a set of instructions in firmware that performs a basic input-output system (BIOS), wherein the processor core is to execute the set of instructions to:
discover that a host-convertible secure region mode and a secure extensions mode are enabled,
program a secure extensions key into the cryptographic engine to correspond to the secure region key ID, and
reserve the one or more memory range of the memory for flexible conversion to the secure pages, or
the processor core is further to map, using the secure key ID, a guest virtual address of the secure page to a second physical address within page tables and extended page tables, such that the second physical address contains the secure region key ID.

### Claim 2 (depends on 1)

The processor of claim 1, wherein the one is the processor core further comprises the set of instructions in firmware that performs the basic input-output system (BIOS), wherein the processor core is to execute the set of instructions to:
discover that the host-convertible secure region mode and the secure extensions mode are enabled;
program the secure extensions key into the cryptographic engine to correspond to the secure region key ID; and
reserve the one or more memory range of the memory for flexible conversion to the secure pages.

### Claim 3 (depends on 2)

The processor of claim 2, wherein the processor core is further to execute memory check firmware to fail a memory check process in response to detection that the secure region key ID has not been allocated for use with the secure extensions key.

### Claim 4 (depends on 2)

The processor of claim 2, wherein the processor core is further to execute the set of instructions to allocate one of a plurality of key IDs for exclusive use as the secure region key ID.

### Claim 5 (depends on 2)

The processor of claim 2, wherein the processor core is further to execute a central processor unit identifier (CPUID) instruction, wherein the CPUID instruction having:
first register inputs to determine the one or more memory range of the memory allocated for flexible conversion to secure pages; and
second register inputs to determine the secure key ID and associated security properties.

### Claim 6 (depends on 1)

The processor of claim 1, wherein the one is the processor core is further to map, using the secure key ID, the guest virtual address of the secure page to the second physical address within page tables and extended page tables, such that the second physical address contains the secure region key ID.

### Claim 7

A processor comprising:
a cryptographic engine to control access, using a secure region key identifier (ID), to one or more memory range of memory allocable for flexible conversion to secure pages of architecturally protected memory regions; and
a processor core coupled to the cryptographic engine, the processor core to:
determine that a physical address associated with a request to access the memory corresponds to a non-secure page of the memory;
determine that a first key ID, which is located within the physical address, matches the secure region key ID; and
deny access to the non-secure page of the memory, wherein one of:
the processor core is further to:
replace the physical address in the request with an abort page address, which links to an abort page containing incorrect data, and
allow access, by a system agent that issued the request, to the abort page, or
the processor core further comprises a set of instructions in firmware that performs a basic input-output system (BIOS), wherein the processor core is to execute the set of instructions to:
discover that a host-convertible secure region mode and a secure extensions mode are enabled,
program a secure extensions key into the cryptographic engine to correspond to the secure region key ID, and
reserve the one or more memory range of the memory for flexible conversion to the secure pages.

### Claim 8 (depends on 7)

The processor of claim 7, wherein the one is the processor core is further to:
replace the physical address in the request with the abort page address, which links to the abort page containing incorrect data; and
allow access, by the system agent that issued the request, to the abort page.

### Claim 9 (depends on 7)

The processor of claim 7, wherein the one is the processor core further comprises the set of instructions in firmware that performs the basic input-output system (BIOS), wherein the processor core is to execute the set of instructions to:
discover that the host-convertible secure region mode and the secure extensions mode are enabled;
program the secure extensions key into the cryptographic engine to correspond to the secure region key ID; and
reserve the one or more memory range of the memory for flexible conversion to the secure pages.

### Claim 10 (depends on 9)

The processor of claim 9, wherein the processor core is further to execute the set of instructions to allocate one of a plurality of key IDs for exclusive use as the secure region key ID.

### Claim 11 (depends on 9)

The processor of claim 9, wherein the processor core is further to execute memory check firmware to fail a memory check process in response to detection that the secure region key ID has not been allocated for use with the secure extensions key.

### Claim 12 (depends on 9)

The processor of claim 9, wherein the processor core is further to execute a central processor unit identifier (CPUID) instruction, wherein the CPUID instruction having:
first register inputs to determine the one or more memory range of the memory allocated for flexible conversion to secure pages; and
second register inputs to determine the secure region key ID and associated security properties.

### Claim 13

A system comprising:
a cache and home agent (CHA) of a memory subsystem, the CHA to:
set a mesh secure bit of a cache line in response to detection that a first key identifier (ID) in a physical address of the cache line matches a secure region key ID; and
issue a write operation to memory for the cache line; and
a cryptographic engine coupled to the CHA, wherein the cryptographic engine is to set a memory secure bit, which resides in metadata of the cache line in the memory, to a value of the mesh secure bit as part of completion of the write operation.

### Claim 14 (depends on 13)

The system of claim 13, wherein the cryptographic engine is further to:
detect a read operation directed to the cache line stored in the memory; and
to fulfill the read operation, return a poison bit to a requesting agent in response to detection of a mismatch between values of mesh secure bit and memory secure bit.

### Claim 15 (depends on 14)

The system of claim 14, wherein the cryptographic engine, to fulfill the read operation, is further to return a fixed pattern of data to the requesting agent.

### Claim 16 (depends on 13)

The system of claim 13, wherein the cryptographic engine is further to:
detect a read operation directed to the cache line stored in the memory; and
to fulfill the read operation, return data of the cache line to a requesting agent in response to a determination that values of the mesh secure bit and the memory secure bit match.

### Claim 17

A method comprising:
selecting, by a processor, an evicted page of memory to convert to a first secure page; and
executing, by the processor, a secure region conversion instruction to initialize the evicted page as the first secure page by:
writing content of the evicted page as zero values;
calculating a message authentication code (MAC) value using a physical address of the evicted page, data to be stored to the first secure page, and a secure region key identifier (ID) corresponding to an architecturally protected memory region of the memory containing the first secure page; and
storing the MAC value to the first secure page.

### Claim 18 (depends on 17)

The method of claim 17, further comprising:
executing, by the processor, a memory fence instruction to verify operations associated with initialization of the first secure page are completed; and
making the first secure page accessible, by the processor, to one of a virtual machine or an application authorized to access the architecturally protected memory region of the memory.

### Claim 19 (depends on 18)

The method of claim 18, further comprising:
selecting, by the processor, the first secure page for eviction and transition to be a non-secure page;
making the first secure page inaccessible by one of a virtual machine or an application authorized to access the architecturally protected memory region of the memory;
invalidating mappings of the first secure page in a translation lookaside buffer of the processor;
executing, by the processor, a non-secure region conversion instruction to cause write back to the memory and flush of contents of one or more cache line, corresponding to the first secure page, that contains the secure region key ID; and
returning the first secure page to a list of evicted pages available to the processor to allocate for use to store data associated with a new key ID.

### Claim 20 (depends on 17)

The method of claim 17, further comprising:
determining that a physical address associated with a request to access the memory corresponds to the first secure page within the one or more memory range of the memory;
determining that a first key ID located within the physical address does not match the secure region key ID; and
issuing a page fault and denying access, by a system agent that issued the request, to the first secure page in the memory.

### Claim 21 (depends on 17)

The method of claim 17, further comprising:
determining that a physical address associated with a request to access the memory corresponds to a non-secure page of the memory;
determining that a first key ID, which is located within the physical address, matches the secure region key ID; and
denying access, by a system agent that issued the request, to the non-secure page of the memory.