System and method for providing secure execution environments using virtualization technology

A non-transitory computer-readable storage medium containing program instructions for method for providing secure execution environments in a computer system, wherein execution of the program instructions by one or more processors of the computer system causes the one or more processors to perform steps comprising:

• receiving a secure execution environment creation request, from a software process running in a virtual machine in the computer system, to create a secure execution environment for content, wherein the virtual machine includes at least virtual processor, virtual volatile memory and virtual non-volatile storage, wherein the secure execution environment creation request includes a measurement and an enclave composition/construction log associated with the secure execution environment being requested, the enclave composition/construction log including at least the content, the measurement including information that uniquely identifies the enclave composition/construction log, and wherein the measurement includes a hash value of the enclave composition/construction log;
• calculating a new hash value of the received enclave composition/construction log and comparing the new hash value with the received measurement, wherein the comparing validates the received enclave composition/construction log;
• in response to the request for the secure execution environment and that the new hash value being equal to the received measurement, deploying a new enclave virtual machine in the computer system and creating the secure execution environment in the new enclave virtual machine , the new enclave virtual machine including at least virtual processor and virtual volatile memory without any virtual non-volatile storage, without any virtual networking interface and without any operating system, the virtual processor of the new enclave virtual machine being an emulated resource corresponding to a physical processor resource of the computer system, and the virtual volatile memory of the new enclave virtual machine being an emulated resource corresponding to a physical volatile memory resource of the computer system;
• performing an attestation process for the new enclave virtual machine using another enclave virtual machine to authenticate the new enclave virtual machine with a hypervisor root key;
• loading the content from the enclave composition/construction log into the virtual volatile memory of the new enclave virtual machine;
• executing of at least one task using the content in the new enclave virtual machine;
• and
• deleting the new enclave virtual machine from the computer system after the at least one task has been performed in the new enclave virtual machine.

A computer system comprising:

• memory;
• a virtualization software that can support a plurality of virtual machines;
• and
• at least one processor configured to:
• receive a secure execution environment creation request, from a software process running in a virtual machine in the computer system, to create a secure execution environment for content, wherein the virtual machine includes at least virtual processor, virtual volatile memory and virtual non-volatile storage, wherein the secure execution environment creation request includes a measurement and an enclave composition/construction log associated with the secure execution environment being requested, the enclave composition/construction log including at least the content, the measurement including information that uniquely identifies the enclave composition/construction log, and wherein the measurement includes a hash value of the enclave composition/construction log;
• calculate a new hash value of the received enclave composition/construction log and compare the new hash value with the received measurement, wherein a comparison of the new hash value with the received measurement validates the received enclave composition/construction log;
• in response to the request for the secure execution environment, deploy a new enclave virtual machine in the computer system and create the secure execution environment in the new enclave virtual machine , the new enclave virtual machine including at least virtual processor and virtual volatile memory without any virtual non-volatile storage, without any virtual networking interface and without any operating system, the virtual processor of the new enclave virtual machine being an emulated resource corresponding to a physical processor resource of the computer system, and the virtual volatile memory of the new enclave virtual machine being an emulated resource corresponding to a physical volatile memory resource of the computer system, wherein the new enclave virtual is a same type of isolated software entity as the virtual without any virtual nonvolatile storage, without any virtual networking interface and without any operating system;
• perform an attestation process for the new enclave virtual machine using another enclave virtual machine to authenticate the new enclave virtual machine with a hypervisor root key;
• load the content from the enclave composition/construction log into the virtual volatile memory of the new enclave virtual machine;
• execute at least one task using the content in the new enclave virtual machine;
• and
• delete the new enclave virtual machine from the computer system after the at least one task has been performed in the new enclave virtual machine.