Technologies for dynamic loading of integrity protected modules into secure enclaves

One or more computer-readable storage media comprising a plurality of instructions that in response to being executed cause a computing device to:

• execute an enclave entry point within a secure enclave, wherein the secure enclave is established with secure enclave support of a processor of the computing device, and wherein the enclave entry point is associated with an executable image that is divided into a plurality of chunks;
• access, in response to executing the enclave entry point, a first chunk of the executable image, wherein the first chunk is not loaded in the secure enclave;
• generate a page fault in response to accessing the first chunk of the executable image;
• verify, by the secure enclave in response to generating the page fault, the first chunk based on a hash tree, wherein the hash tree includes a plurality of leaf nodes and a root value, wherein each of the plurality of leaf nodes corresponds to a hash value corresponding to a chunk of the executable image, and wherein the root value is integrity-protected;
• and
• accept the first chunk of the executable image into the secure enclave in response to verifying the first chunk.

A computing device for secure enclave generation, the computing device comprising:

• a slice module to divide an executable image into a plurality of chunks;
• a hash module to (i) hash each of the plurality of chunks to generate a corresponding hash value and (ii) generate a hash tree as a function of the plurality of hash values corresponding to the plurality of chunks, wherein the hash tree includes a plurality of leaf nodes and a root value, and wherein each of the plurality of leaf nodes corresponds to a hash value corresponding to a chunk;
• and
• an output module to generate an initial secure enclave memory image for the executable image, wherein the initial secure enclave memory image includes the root value of the hash tree.

One or more computer-readable storage media comprising a plurality of instructions that in response to being executed cause a computing device to:

• divide an executable image into a plurality of chunks;
• hash each of the plurality of chunks to generate a corresponding hash value;
• generate a hash tree as a function of the plurality of hash values corresponding to the plurality of chunks, wherein the hash tree includes a plurality of leaf nodes and a root value, and wherein each of the plurality of leaf nodes corresponds to a hash value corresponding to a chunk;
• and
• generate an initial secure enclave memory image for the executable image, wherein the initial secure enclave memory image includes the root value of the hash tree.