System and method for running enclave-aware executables

A non-transitory computer-readable medium storing enclave-aware instructions that, when executed by an enclave-aware processor, cause the enclave-aware processor to:

• dispatch a call between a plurality of enclaves according to a calling convention defined by an enclave-aware Application Binary Interface (eABI);
• analyze, by an eABI-aware loader, a plurality of eABI-aware executables;
• instantiate, by the eABI-aware loader, an enclave;
• load, by the eABI-aware loader, a first portion of the plurality of eABI-aware executables in a common memory;
• load, by the eABI-aware loader, a second portion of the plurality of eABI-aware executables into the enclave;
• and
• facilitate, by an eABI-aware runtime, an execution between each of the plurality of eABI-aware executables via the eABI.

A system for enhancing security in a computing environment that supports an enclave, the system comprising:

• an enclave-aware Application Binary Interface (eABI) governing symbol resolution, call dispatch, note formation, routing, and return pathways between enclaves;
• an enclave-aware processor;
• a memory in communication with the enclave-aware processor;
• a usermode process instantiated within the memory;
• an eABI-aware runtime within the usermode process;
• an eABI-aware loader within the usermode process;
• a first generic source code including an imported symbol;
• a first enclave-aware executable derived from the first generic source code;
• a first enclave instantiated within the usermode process and formed from a protected portion of the first enclave-aware executable;
• a second generic source code including a published symbol;
• a second enclave-aware executable derived from the second generic source code;
• a second enclave instantiated within the usermode process and formed from a protected portion of the second enclave-aware executable;
• the eABI semantically resolving an external symbol dependency in the first enclave-aware executable to the published symbol in the second enclave-aware executable;
• an entry/exit bootstrap module within the usermode process;
• a thread of execution configured to enter the first enclave through the entry/exit bootstrap module and the eABI-aware runtime;
• the thread of execution further configured to enter the second enclave through the eABI-aware runtime;
• a main-note within the entry/exit bootstrap module configured to interoperate with the eABI and initiate an external call to the first enclave;
• a subroutine-note within the first enclave configured to interoperate with the eABI and to communicate data between the first enclave and the second enclave;
• the subroutine-note being configured to access the published symbol within the second enclave;
• a transit buffer in a common memory;
• the transit buffer being configured to temporarily store encrypted data during inter-enclave transfer;
• a data security mode;
• the data security mode including a member selected from a group consisting of:
• a plaintext mode,
• an encryption mode,
• a validation mode,
• an encryption with validation mode,
• and combinations thereof;
• a selected data security mode governing formation, transmission, and processing of the main-note and the subroutine-note;
• an enclave-compatible cryptographic key accessible within the first enclave and the second enclave;
• the first enclave configured to encrypt the subroutine-note using the enclave-compatible cryptographic key;
• the second enclave configured to decrypt the subroutine-note using the enclave-compatible cryptographic key;
• and
• the second enclave configured to validate the subroutine-note prior to accessing the published symbol;
• wherein:
• the eABI-aware loader is configured to analyze the first enclave-aware executable and the second enclave-aware executable;
• the eABI-aware loader is configured to instantiate the first enclave and the second enclave;
• the eABI-aware loader is configured to place a non-protected portion of the first enclave-aware executable and a non-protected portion of the second enclave-aware executable in the common memory;
• the eABI-aware loader is configured to load the protected portion of the first enclave-aware executable into the first enclave and the protected portion of the second enclave-aware executable into the second enclave;
• access to the published symbol is mediated by the eABI-aware runtime, and
• the first enclave securely accesses the published symbol in the second enclave via the eABI-aware runtime and in accordance with the data security mode.