Method, system, and device for modifying a secure enclave configuration without changing the enclave measurement
AssigneeIntel Corporation
InventorBin Xing
Life of this patent
Estimating the term…
Abstract
A system and method for adapting a secure application execution environment to support multiple configurations includes determining a maximum configuration for the secure application execution environment, determining an optimal configuration for the secure application environment, and, at load time, configuring the secure application execution environment for the optimal configuration.
Claims25
A computing device to provide a secure environment for execution of an executable application, the computing device comprising:
- at least one memory device comprising a page cache to supply pages of virtual memory for the secure execution environment;
- at least one processor comprising an instruction set to enable creation and management of the secure execution environment;
- a loader to, at load time, create the secure execution environment for the executable application, the secure execution environment being configured for a first hardware configuration and having a measurement, the measurement usable to protect the security of the secure execution environment;
- and
- an optimizer to, at load time, configure the secure execution environment for a second hardware configuration different than the first hardware configuration without changing the measurement.
A loader embodied in at least one machine readable storage media of a computing device to provide a secure environment for execution of an executable application on the computing device, the loader configured to, at load time:
- determine a maximum configuration for the secure environment;
- determine an optimal configuration for the secure environment based on at least one requirement of the executable application and/or at least one hardware capability of the computing device;
- create the secure environment with a memory layout corresponding to the maximum configuration;
- and
- modify the memory layout to correspond to the optimal configuration.
A method for creating a secure application execution environment to be usable in multiple different hardware environments, the secure application execution environment having a maximum memory configuration and a measurement associated therewith, the measurement usable to protect the security of the secure application execution environment, the method comprising:
- determining an optimal memory configuration for the secure application execution environment, the optimal memory configuration comprising fewer pages of memory than the maximum memory configuration;
- determining a number of memory pages in the maximum memory configuration that are not needed by the optimal memory configuration;
- and
- in response to memory pages being added to the secure application execution environment, removing the memory pages not needed by the optimal memory configuration without affecting the measurement of the secure application execution environment.
One or more machine readable storage media comprising a plurality of instructions stored therein that in response to being executed result in a computing device:
- determining an optimal configuration for a secure application execution environment based on at least one requirement of at least one of an executable application and a hardware capability of the computing device, the secure application execution environment having a memory configuration and a measurement associated therewith, the measurement usable to protect the security of the secure application execution environment;
- and
- modifying the memory configuration of the secure application execution environment to correspond to the optimal configuration without affecting the measurement.
Dependencies are inferred from the claim text.