Abstract enclave identity
AssigneeMicrosoft Technology Licensing, LLC
InventorManuel Costa
Life of this patent
Estimating the term…
Abstract
An abstract enclave identity is presented. An abstract identity may be a secure identity that may be the same for multiple related, but not identical, enclave instantiations. An enclave identity value may be determined from an abstract enclave identity type with respect to a instantiated enclave. Various enclave operations may be performed with an abstract identity, such as sealing data to an abstract identity, incrementing a monotonic counter, making trusted time measurement.
Claims22
An enclave identification method performed by a computing device comprising a processor and memory, the method comprising:
- receiving an identity type and a request for an operation related to an enclave that is instantiated, wherein an enclave image from which the enclave was instantiated includes references to additional dependent enclave images;
- determining which of the additional dependent enclave images are to be included at least in part as input to a hash function based at least in part on each additional dependent enclave image that is to be included at least in part as input to the hash function being included at least in part in an identity portion of the enclave image that is based at least in part on the identity type;
- computing the hash function, based at least in part on the identity type and information derived from the enclave image, to provide as an output of the hash function an identity value for the enclave, wherein integrity of the identity value is verifiable by verifying a signature in the enclave image with a public key related to an author of the enclave image;
- and
- performing the operation with the identity value to provide security with regard to the enclave.
A system comprising at least a processor and memory storing thereon instructions that, when executed by the system, cause at least:
- receiving an identity type and a request for an operation related to an enclave that is instantiated, the identity type being useable to identify a plurality of enclaves having at least one common feature, the plurality of enclaves including the enclave that is instantiated;
- computing a hash function, based at least in part on the identity type and information derived from an enclave image from which the enclave was instantiated, to provide as an output of the hash function an identity value for the enclave, wherein the enclave image includes a plurality of references to a plurality of respective additional dependent enclave images, and wherein integrity of the identity value is verifiable by verifying a signature in the enclave image with a public key related to an author of the enclave image, wherein the identity type indicates which of the additional dependent enclave images are included as input to the hash function;
- and
- performing the operation with the identity value to provide security with regard to the enclave.
An enclave identification method, comprising:
- receiving an identity type and a request for an operation related to an enclave that is instantiated, the identity type being useable to identify a plurality of enclaves having at least one common feature, the plurality of enclaves including the enclave that is instantiated;
- computing a hash function, based at least in part on the identity type and data stored in a container of the enclave, to provide as an output of the hash function an identity value for the enclave, wherein the identity type indicates which of a plurality of enclave images that were used to instantiate the enclave are to be included at least in part in the hash function, wherein the data stored in the container of the enclave includes a plurality of identity values that identify the enclave, and wherein the identity value is determined by selecting amongst the plurality of identity values based on the identity type, and wherein integrity of the identity value is verifiable by verifying a signature in the container with a public key related to a creator of the enclave;
- and
- performing the operation with the identity value to provide security with regard to the enclave.
Dependencies are inferred from the claim text.