Cryptographic computing isolation for multi-tenancy and secure software components

A non-transitory machine readable medium comprising instructions that when executed by a processor, cause the processor to perform operations comprising:

• receiving a request to instantiate a first process based on a request to launch an application;
• creating a context table for the first process;
• loading an encrypted shared library into memory for the first process, wherein the encrypted shared library is encrypted based at least in part on a first cryptographic key;
• creating a first entry in the context table;
• storing, in the first entry, first context information identifying the encrypted shared library and second context information representing the first cryptographic key;
• creating a second entry in the context table, the second entry to include fourth context information identifying an encrypted main program of the application and fifth context information representing a second cryptographic key, wherein the encrypted main program is encrypted based, at least in part, on the second cryptographic key;
• populating a first register with a base address of the context table;
• populating a second register with the second cryptographic key;
• and
• populating a third register with a load address of the encrypted main program.

A system, comprising:

• memory for storing a plurality of software components and a main program of a user application;
• and
• a processor coupled to the memory, the processor comprising circuitry to:
• instantiate a process based on a request to launch the user application associated with a software component to be invoked during the process, wherein to instantiate the process is to include:
• encrypting the main program of the user application based at least in part on a first cryptographic key;
• encrypting the software component based at least in part on a second cryptographic key;
• storing, in a first entry in a context table of the process, first context information identifying the encrypted main program and second context information representing the first cryptographic key;
• storing, in a second entry in the context table of the process, third context information identifying the encrypted software component and fourth context information representing the second cryptographic key,
• subsequent to instantiating the process, fetch an encrypted first code block of the encrypted main program from the memory;
• decrypt the encrypted first code block of the encrypted main program to generate an unencrypted first instruction;
• and
• execute the unencrypted first instruction to transition from executing the encrypted main program to executing the encrypted first software component.

A method comprising:

• instantiating a first process based on a request to launch an application, wherein the application is associated with a software component to be invoked during the first process, wherein instantiating the first process includes:
• encrypting a main program of the application based at least in part on a first cryptographic key;
• using at least a second cryptographic key for encrypting the software component to be invoked during the first process;
• creating a first entry in a context table of the first process, the first entry to include first context information identifying the main program and second context information representing the first cryptographic key;
• creating a second entry in the context table, the second entry to include third context information identifying the software component and fourth context information representing the second cryptographic key;
• subsequent to instantiating the first process, fetching an encrypted first code block of the encrypted main program from a memory;
• decrypting the encrypted first code block of the encrypted main program to generate an unencrypted first instruction;
• and
• executing the unencrypted first instruction to transition from executing the encrypted main program to executing the encrypted software component.