Creating secure channels between a protected execution environment and fixed-function endpoints

A method comprising:

• implementing, by a processor, an architecturally protected execution environment by performing at least one of executing instructions residing in an enclave page cache and preventing an unauthorized access to the enclave page cache;
• storing, by the processor, a key wrapping key in a first register in a key distribution engine, the first register accessible only by hardware;
• generating, by an application being executed by the processor within the architecturally protected execution environment, a content encryption key;
• generating content encrypted with the content encryption key;
• generating an encrypted content encryption key by encrypting, using the key wrapping key, the content encryption key;
• storing the encrypted content encryption key in a second register in the key distribution engine, the second register accessible by software;
• and
• decrypting, by the key distribution engine, the encrypted content encryption key to generate a first decrypted content encryption key;
• providing, by the key distribution engine, the first decrypted content encryption key to a first fixed-function endpoint;
• receiving, by a configuration interface between the key distribution engine and the first fixed-function endpoint and a second fixed-function endpoint, an acknowledgement from the first fixed-function endpoint that the first fixed-function endpoint has received the first decrypted content encryption key;
• receiving, by a state machine in the key distribution engine, the acknowledgement from the configuration interface before a transition to a state in which a second decrypted content encryption key is to be provided to a second fixed-function endpoint.

An apparatus comprising:

• hardware to implement an architecturally-protected execution environment by performing at least one of executing instructions residing in an enclave page cache and preventing an unauthorized access to the enclave page cache;
• a first register in which to store a key wrapping key, the first register writable only by a processor during a reset process;
• a second register in which to store an encrypted content encryption key, the second register accessible by software executing on the processor within the architecturally-protected execution environment;
• a controller to control the generation of a first decrypted content encryption key by decrypting the encrypted content encryption key using the key wrapping key and to provide the first decrypted content encryption key to a first fixed-function endpoint;
• and
• a state machine to receive an acknowledgement from the first fixed-function endpoint that the first fixed-function endpoint has received the first decrypted content encryption key before a transition to a state in which a second decrypted content encryption key is to be provided to a second fixed-function endpoint.