# US 12,223,064 B2 · Mechanism to secure an execution environment in processor cores

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,223,064 B2
- Document ID: US12223064B2
- Status: Granted
- Kind: B2
- Application number: 17/933,866
- Filed: 2022-09-21
- Published: 2024-03-21
- Granted: 2025-02-11
- Earliest claimed: 2022-09-21
- Assignees: QUALCOMM Incorporated
- Applicants: QUALCOMM Incorporated
- Inventors: Sachin Kumar
- Web page: https://patentgrep.com/patent/US12223064B2

## CPC

- G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
- G06F 21/602: {Providing cryptographic facilities or services}
- G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine
- G06F 21/54: by adding security routines or objects to programs
- G06F 21/107: {License processing; Key processing}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Various embodiments include methods and devices for a secure execution environment in computing devices. Embodiments may include generating a binary executable file for execution in the secure execution environment by generating hashes of instructions of a function, inserting a start hash instruction and a stop hash instruction in object code of the function, and generating a binary executable having the function including the start hash instruction and the stop hash instruction. Embodiments may include implementing the secure execution environment by generating hashes of instructions of a function in parallel with executing the function, comparing the generated hashes of the instructions of the function to stored hashes of instructions of the function, and issuing an exception indicating to a processor that execution of the function is not secure for any difference between the generated hashes of the instructions of the function and the stored hashes of the instructions of the function.

## Claims

### Claim 1

A method of generating a binary executable for execution in a secure execution environment, comprising:
generating hashes of instructions of a function using an assembler;
inserting a start hash instruction and a stop hash instruction in object code of the function; and
generating a binary executable having the function including the start hash instruction and the stop hash instruction.

### Claim 2 (depends on 1)

The method of claim 1, wherein inserting the start hash instruction and the stop hash instruction in the object code of the function includes:
inserting the start hash instruction in a prologue of the function; and
inserting the stop hash instruction in an epilogue of the function.

### Claim 3 (depends on 1)

The method of claim 1, further comprising:
encrypting a program header for the hashes of the instructions of the function; and
storing the encrypted program header for the hashes of the instructions of the function to a dedicated memory.

### Claim 4 (depends on 1)

The method of claim 1, further comprising receiving an indication of a hash algorithm using a software development toolchain, wherein generating the hashes of the instructions of the function comprises generating the hashes of the instructions of the function using the indicated hash algorithm.

### Claim 5 (depends on 1)

The method of claim 1, further compromising:
receiving a private key using a software development toolchain; and
encrypting a program header for the hashes of the instructions of the function using an encryption algorithm and the private key.

### Claim 6 (depends on 1)

The method of claim 1, further compromising:
receiving an indication of an encryption algorithm using a software development toolchain; and
encrypting a program header for the hashes of the instructions of the function using the indicated encryption algorithm.

### Claim 7 (depends on 1)

The method of claim 1, wherein;
inserting the start hash instruction and the stop hash instruction in the object code of the function comprises inserting the start hash instruction and the stop hash instruction in the object code of the function using the assembler; and
generating the binary executable having the function including the start hash instruction and the stop hash instruction comprises generating the binary executable having the function including the start hash instruction and the stop hash instruction using a linker.

### Claim 8

A computing device, comprising:
a memory; and
a processor coupled to the memory and configured to:
generate hashes of instructions of a function using an assembler;
insert a start hash instruction and a stop hash instruction in object code of the function; and
generate a binary executable having the function including the start hash instruction and the stop hash instruction.

### Claim 9 (depends on 8)

The computing device of claim 8, wherein the processor is further configured to cause the processor to insert the start hash instruction and the stop hash instruction in the object code of the function in a manner that:
inserts the start hash instruction in a prologue of the function; and
inserts the stop hash instruction in an epilogue of the function.

### Claim 10 (depends on 8)

The computing device of claim 8, wherein the processor is further configured to:
encrypt a program header for the hashes of the instructions of the function; and
store the encrypted program header for the hashes of the instructions of the function in the memory.

### Claim 11 (depends on 8)

The computing device of claim 8, wherein the processor is further configured to:
receive an indication of a hash algorithm at a software development toolchain; and
generate the hashes of the instructions of the function using the indicated hash algorithm.

### Claim 12 (depends on 8)

The computing device of claim 8, wherein the processor is further configured to:
receive a private key at a software development toolchain; and
encrypt a program header for the hashes of the instructions of the function using an encryption algorithm and the private key.

### Claim 13 (depends on 8)

The computing device of claim 8, wherein the processor is further configured to:
receive an indication of an encryption algorithm at a software development toolchain; and
encrypt a program header for the hashes of the instructions of the function using the indicated encryption algorithm.

### Claim 14 (depends on 8)

The computing device of claim 8, wherein the processor is further configured to:
insert the start hash instruction and the stop hash instruction in the object code of the function using the assembler; and
generate the binary executable having the function including the start hash instruction and the stop hash instruction using a linker.