# US 12,118,101 B2 · Technique for providing a trusted execution environment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,118,101 B2 - Document ID: US12118101B2 - Status: Granted - Kind: B2 - Application number: 17/903,267 - Filed: 2022-09-06 - Published: 2024-03-07 - Granted: 2024-10-15 - Earliest claimed: 2022-09-06 - Assignees: Arm Limited - Applicants: Arm Limited - Inventors: Brendan James Moran; Adrian Laurence Shaw; Andreas Lars Sandberg - Web page: https://patentgrep.com/patent/US12118101B2 ## CPC - G06F 21/604: {Tools and structures for managing or administering access control systems} - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract An apparatus and method are described for providing a trusted execution environment. The apparatus comprises processing circuitry to execute program code, and interrupt controller circuitry, responsive to receipt of one or more interrupt requests, to select a given interrupt request from amongst the one or more interrupt requests, and to issue an interrupt signal to the processing circuitry identifying a given interrupt service routine providing program code to be executed by the processing circuitry to service the given interrupt request. The interrupt controller circuitry is responsive to the given interrupt request being a trusted execution environment (TEE) interrupt request, to issue the interrupt signal to identify as the given interrupt service routine a TEE interrupt service routine, and to inhibit issuance of any further interrupt signal until the TEE interrupt service routine has been executed by the processing circuitry. The interrupt controller circuitry comprises code protection circuitry to inhibit unauthorised modification of the TEE interrupt service routine, and data protection circuitry to inhibit unauthorised access to confidential data processed by the TEE interrupt service routine. ## Claims ### Claim 1 An apparatus comprising: processing circuitry to execute program code; and interrupt controller circuitry, responsive to receipt of one or more interrupt requests, to select a given interrupt request from amongst the one or more interrupt requests, and to issue an interrupt signal to the processing circuitry identifying a given interrupt service routine providing program code to be executed by the processing circuitry to service the given interrupt request; wherein: the interrupt controller circuitry is responsive to the given interrupt request being a trusted execution environment (TEE) interrupt request, to issue the interrupt signal to identify as the given interrupt service routine a TEE interrupt service routine, and to inhibit issuance of any further interrupt signal until the TEE interrupt service routine has been executed by the processing circuitry; the interrupt controller circuitry comprises code protection circuitry to inhibit unauthorised modification of the TEE interrupt service routine; and the interrupt controller circuitry further comprises data protection circuitry to inhibit unauthorised access to confidential data processed by the TEE interrupt service routine. ### Claim 2 (depends on 1) An apparatus as claimed in claim 1, wherein the interrupt controller circuitry is arranged to employ a prioritization scheme to select the given interrupt request from amongst the one or more received interrupt requests, and the TEE interrupt request is arranged to have a higher priority than any other interrupt request receivable by the interrupt controller circuitry, to thereby ensure that once an interrupt signal has been issued to the processing circuitry to cause the processing circuitry to execute the TEE interrupt service routine, the interrupt controller circuitry is inhibited from issuing an interrupt signal for any other received interrupt request until the TEE interrupt service routine has been executed by the processing circuitry. ### Claim 3 (depends on 1) An apparatus as claimed in claim 1, wherein: the interrupt controller circuitry is arranged to identify the given interrupt service routine in the interrupt signal by identifying a memory address indication to be used by the processing circuitry to retrieve the given interrupt service routine from memory; the interrupt controller circuitry is arranged to employ a default mechanism to determine the memory address indication for the given interrupt request; and the code protection circuitry is arranged, when the given interrupt request is the TEE interrupt request, to obtain from a locked storage element the memory address indication to be used by the processing circuitry to retrieve the TEE interrupt service routine instead of employing the default mechanism. ### Claim 4 (depends on 3) An apparatus as claimed in claim 3, wherein the locked storage element comprises one of: a one-time programmable register set to identify the memory address indication to be used by the processing circuitry to retrieve the TEE interrupt service routine; a lockable register whose value is arranged to be set by early execution code executed by the processing circuitry following a reset of the apparatus, and the lockable register is arranged to be locked by the early execution code; and a hard-wired storage element providing as the memory address indication an entry point for the TEE interrupt service routine that is provided in unmodifiable memory. ### Claim 5 (depends on 1) An apparatus as claimed in claim 1, wherein: the TEE interrupt service routine is cryptographically signed using an authentication key; the processing circuitry is arranged, in response to the interrupt signal identifying the TEE interrupt service routine, to execute verification code to determine whether the TEE interrupt service routine is verified; and the code protection circuitry is arranged to have access to an authenticity verification key and to make the authenticity verification key available to the verification code when determining whether the TEE interrupt service routine is verified. ### Claim 6 (depends on 5) An apparatus as claimed in claim 5, wherein: the authentication key is the same as the authenticity verification key; the TEE interrupt service routine includes an authentication code; the processing circuitry is arranged to execute the verification code to generate a comparison authentication code from the decryption key and one or more items of data associated with the TEE interrupt service routine, and to determine that the TEE interrupt service routine is verified when the comparison authentication code matches the authentication code included in the TEE interrupt service routine. ### Claim 7 (depends on 1) An apparatus as claimed in claim 1, wherein: the confidential data processed by the TEE interrupt service routine is stored in memory in encrypted form, using an encryption key, unless the processing circuitry is executing the TEE interrupt service routine; the data protection circuitry is arranged to inhibit the processing circuitry from accessing the encryption key, and a decryption key used to decrypt the confidential data, unless the processing circuitry is executing the TEE interrupt service routine; and the processing circuitry is arranged to use the decryption key, whilst executing the TEE interrupt service routine, to decrypt the confidential data to enable the confidential data to be processed during execution of the TEE interrupt service routine and to use the encryption key to encrypt the confidential data prior to completing execution of the TEE interrupt service routine. ### Claim 8 (depends on 7) An apparatus as claimed in claim 7, wherein the encryption key and the decryption key are stored in a given storage element whose accessibility is controlled by the interrupt controller circuitry, and the data protection circuitry is arranged to enable the processing circuitry to access the given storage element whilst the processing circuitry is executing the TEE interrupt service routine. ### Claim 9 (depends on 8) An apparatus as claimed in claim 8, wherein the given storage element is one of: at least one register external to a processing unit containing the processing circuitry which the processing circuitry is only enabled to access when executing the TEE interrupt service routine; at least one special function register within the processing unit that the processing circuitry is only enabled to access when executing the TEE interrupt service routine; at least one general purpose register within the processing unit in which the processing unit is enabled, under control of the data protection circuitry, to maintain a copy of the encryption key and the decryption key whilst the processing circuitry is executing the TEE interrupt service routine. ### Claim 10 (depends on 7) An apparatus as claimed in claim 7, wherein early execution code executed by the processing circuitry following a reset of the apparatus is arranged to scrub memory in order to avoid access to the confidential data in unencrypted form in the event execution of the TEE interrupt service routine was interrupted at a time the apparatus was reset. ### Claim 11 (depends on 1) An apparatus as claimed in claim 1, further comprising: access control circuitry to which any access request seeking to access the confidential data must be routed before allowing the confidential data to be accessed; and the access control circuitry is controlled by the data protection circuitry to prevent access to the confidential data unless the processing circuitry is executing the TEE interrupt service routine. ### Claim 12 (depends on 1) An apparatus as claimed in claim 1, wherein memory accessible to the processing circuitry includes private memory, and the data protection circuitry is arranged to only enable the processing circuitry to access the private memory when the processing circuitry is executing the TEE interrupt service routine. ### Claim 13 (depends on 12) An apparatus as claimed in claim 12, further comprising: a plurality of bus arbiters used to arbitrate access to associated blocks of memory; in a default mode of operation, each bus arbiter whose associated block of memory is within the private memory is arranged to assert a fault signal if the processing circuitry seeks to access the associated block of memory; and the data protection circuitry is arranged to cause each bus arbiter whose associated block of memory is within the private memory to operate in a further mode of operation whilst the processing circuitry is executing the TEE interrupt service routine, in which each bus arbiter whose associated block of memory is within the private memory allows the processing circuitry to access the associated block of memory. ### Claim 14 (depends on 13) An apparatus as claimed in claim 13, wherein each bus arbiter whose associated block of memory is within the private memory is arranged to be located relative to the associated block of memory so as to inhibit provision of a bypass path that would enable the associated block of memory to be accessed without routing the access through the bus arbiter. ### Claim 15 (depends on 13) An apparatus as claimed in claim 13, further comprising: direct memory access circuitry which the processing circuitry can utilise to perform chosen memory accesses on behalf of the processing circuitry; wherein the data protection circuitry is arranged to cause use of the direct memory access circuitry to be disabled whilst the processing circuitry is executing the TEE interrupt service routine. ### Claim 16 (depends on 12) An apparatus as claimed in claim 12, wherein the data protection circuitry is arranged to control access to a private memory enable register so as to only enable access to the private memory enable register whilst the processing circuitry is executing the TEE interrupt service routine, and access to the private memory enable register causes the private memory to be made accessible to the processing circuitry. ### Claim 17 (depends on 1) An apparatus as claimed in claim 1, wherein memory accessible to the processing circuitry includes a memory slice that the data protection circuitry is arranged to only enable the processing circuitry to access when the processing circuitry is executing the TEE interrupt service routine. ### Claim 18 (depends on 17) An apparatus as claimed in claim 17, further comprising a memory slice defining storage element whose accessibility is controlled by the interrupt controller circuitry, and the data protection circuitry is arranged to enable the processing circuitry to access the memory slice defining storage element whilst the processing circuitry is executing the TEE interrupt service routine in order to enable the processing circuitry to access the memory slice. ### Claim 19 (depends on 18) An apparatus as claimed in claim 18, wherein the memory slice defining storage element is one of: a register external to a processing unit containing the processing circuitry which the processing circuitry is only enabled to access when executing the TEE interrupt service routine; a special function register within the processing unit that the processing circuitry is only enabled to access when executing the TEE interrupt service routine; a lockable configuration register that the processing circuitry is only enabled to access when executing the TEE interrupt service routine. ### Claim 20 (depends on 18) An apparatus as claimed in claim 18, wherein the memory slice defining storage element is arranged to identify a range of memory addresses forming the memory slice. ### Claim 21 (depends on 18) An apparatus as claimed in claim 18, further comprising access control circuitry used to control access to memory by the processing circuitry, and the data protection circuitry is arranged to control the access control circuitry to enable access to the memory slice by the processing circuitry when the processing circuitry is executing the TEE interrupt service routine. ### Claim 22 A method of providing a trusted execution environment within an apparatus comprising: employing processing circuitry to execute program code; and arranging interrupt controller circuitry to be responsive to receipt of one or more interrupt requests to select a given interrupt request from amongst the one or more interrupt requests, and to issue an interrupt signal to the processing circuitry identifying a given interrupt service routine providing program code to be executed by the processing circuitry to service the given interrupt request; causing the interrupt controller circuitry, when the given interrupt request is a trusted execution environment (TEE) interrupt request, to issue the interrupt signal to identify as the given interrupt service routine a TEE interrupt service routine, and to inhibit issuance of any further interrupt signal until the TEE interrupt service routine has been executed by the processing circuitry; providing the interrupt controller circuitry with code protection circuitry to inhibit unauthorised modification of the TEE interrupt service routine; and providing the interrupt controller circuitry with data protection circuitry to inhibit unauthorised access to confidential data processed by the TEE interrupt service routine. ### Claim 23 A non-transitory computer-readable medium to store computer-readable code for fabrication of an apparatus comprising: processing circuitry to execute program code; and interrupt controller circuitry, responsive to receipt of one or more interrupt requests, to select a given interrupt request from amongst the one or more interrupt requests, and to issue an interrupt signal to the processing circuitry identifying a given interrupt service routine providing program code to be executed by the processing circuitry to service the given interrupt request; wherein: the interrupt controller circuitry is responsive to the given interrupt request being a trusted execution environment (TEE) interrupt request, to issue the interrupt signal to identify as the given interrupt service routine a TEE interrupt service routine, and to inhibit issuance of any further interrupt signal until the TEE interrupt service routine has been executed by the processing circuitry; the interrupt controller circuitry comprises code protection circuitry to inhibit unauthorised modification of the TEE interrupt service routine; and the interrupt controller circuitry further comprises data protection circuitry to inhibit unauthorised access to confidential data processed by the TEE interrupt service routine.