[go: up one dir, main page]

WO2010057065A2 - Procédé et appareil assurant une exécution d'application sécurisée - Google Patents

Procédé et appareil assurant une exécution d'application sécurisée Download PDF

Info

Publication number
WO2010057065A2
WO2010057065A2 PCT/US2009/064493 US2009064493W WO2010057065A2 WO 2010057065 A2 WO2010057065 A2 WO 2010057065A2 US 2009064493 W US2009064493 W US 2009064493W WO 2010057065 A2 WO2010057065 A2 WO 2010057065A2
Authority
WO
WIPO (PCT)
Prior art keywords
epc
instruction
data
processor
machine
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/US2009/064493
Other languages
English (en)
Other versions
WO2010057065A3 (fr
Inventor
Frank Mckeen
Uday Savagaonkar
Carlos V. Rozas
Michael A. Goldsmith
Howard C. Herbert
Asher Altman
Gary Graunke
David Durham
Simon P. Johnson
Michael E. Kounavis
Vincent R. Scarlata
Joseph Cihula
Stalinselvaraj Jeyasingh
Bernard Lint
Gil Neiger
Dion Rodgers
Ernie Brickell
Jianguo Li
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Intel Corp
Original Assignee
Intel Corp
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Intel Corp filed Critical Intel Corp
Priority to JP2011536548A priority Critical patent/JP2012508938A/ja
Publication of WO2010057065A2 publication Critical patent/WO2010057065A2/fr
Publication of WO2010057065A3 publication Critical patent/WO2010057065A3/fr
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/30—Arrangements for executing machine instructions, e.g. instruction decode
    • G06F9/30003—Arrangements for executing specific machine instructions
    • G06F9/3004—Arrangements for executing specific machine instructions to perform operations on memory
    • G06F9/30043—LOAD or STORE instructions; Clear instruction
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/30—Arrangements for executing machine instructions, e.g. instruction decode
    • G06F9/30003—Arrangements for executing specific machine instructions
    • G06F9/30007—Arrangements for executing specific machine instructions to perform operations on data operands
    • G06F9/30032—Movement instructions, e.g. MOVE, SHIFT, ROTATE, SHUFFLE

Definitions

  • Embodiments of the invention relate generally to the field of information processing and more specifically, to the field of security in computing systems and microprocessors.
  • Figure 1 illustrates a block diagram of a microprocessor, in which at least one embodiment of the invention may be used;
  • Figure 2 illustrates a block diagram of a shared bus computer system, in which at least one embodiment of the invention may be used;
  • Figure 3 illustrates a block diagram a point-to-point interconnect computer system, in which at least one embodiment of the invention may be used.
  • Embodiments of the invention pertain to a technique for providing secure application and data in a flexible but reliable manner.
  • the attached document entitled "Secure Enclaves Architecture" is hereby incorporated by referrence as an example of at least one embodiment.
  • the incorporated reference is not intended to limit the scope of embodiments of the invention in any way and other embodiments may be used while remaining within the spirit and scope of the invention.
  • Figure 1 illustrates a microprocessor in which at least one embodiment of the invention may be used.
  • Figure 1 illustrates microprocessor 100 having one or more processor cores 105 and 110, each having associated therewith a local cache 107 and 113, respectively.
  • a shared cache memory 115 which may store versions of at least some of the information stored in each of the local caches 107 and 113.
  • microprocessor 100 may also include other logic not shown in Figure 1 , such as an integrated memory controller, integrated graphics controller, as well as other logic to perform other functions within a computer system, such as I/O control.
  • each microprocessor in a multi-processor system or each processor core in a multi-core processor may include or otherwise be associated with logic 119 to enable secure enclave techniques, in accordance with at least one embodiment.
  • the logic may include circuits, software (embodied in a tangible medium) or both to enable more efficient resource allocation among a plurality of cores or processors than in some prior art implementations.
  • Figure 2 illustrates a front-side-bus (FSB) computer system in which one embodiment of the invention may be used.
  • Any processor 201, 205, 210, or 215 may access information from any local level one (Ll) cache memory 220, 225, 230, 235, 240, 245, 250, 255 within or otherwise associated with one of the processor cores 223, 227, 233, 237, 243, 247, 253, 257. Furthermore, any processor 201, 205, 210, or 215 may access information from any one of the shared level two (L2) caches 203, 207, 213, 217 or from system memory 260 via chipset 265.
  • L2 shared level two
  • One or more of the processors in Figure 2 may include or otherwise be associated with logic 219 to enable secure enclave techniques, in accordance with at least one embodiment.
  • P2P point-to-point
  • ring interconnect systems may be used in conjunction with various embodiments of the invention, including point-to-point (P2P) interconnect systems and ring interconnect systems.
  • the P2P system of Figure 3 may include several processors, of which only two, processors 370, 380 are shown by example.
  • Processors 370, 380 may each include a local memory controller hub (MCH) 372, 382 to connect with memory 32, 34.
  • MCH local memory controller hub
  • Processors 370, 380 may exchange data via a point-to-point (PtP) interface 350 using PtP interface circuits 378, 388.
  • PtP point-to-point
  • Processors 370, 380 may each exchange data with a chipset 390 via individual PtP interfaces 352, 354 using point to point interface circuits 376, 394, 386, 398.
  • Chipset 390 may also exchange data with a high-performance graphics circuit 338 via a high- performance graphics interface 339.
  • Embodiments of the invention may be located within any processor having any number of processing cores, or within each of the PtP bus agents of Figure 3.
  • any processor core may include or otherwise be associated with a local cache memory (not shown).
  • a shared cache (not shown) may be included in either processor outside of both processors, yet connected with the processors via p2p interconnect, such that either or both processors' local cache information may be stored in the shared cache if a processor is placed into a low power mode.
  • One or more of the processors or cores in Figure 3 may include or otherwise be associated with logic 319 to enable secure enclave techniques, in accordance with at least one embodiment.
  • IP cores may be stored on a tangible, machine readable medium (“tape”) and supplied to various customers or manufacturing facilities to load into the fabrication machines that actually make the logic or processor.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Security & Cryptography (AREA)
  • Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • General Health & Medical Sciences (AREA)
  • Virology (AREA)
  • Health & Medical Sciences (AREA)
  • Storage Device Security (AREA)
  • Retry When Errors Occur (AREA)
  • Memory System Of A Hierarchy Structure (AREA)
  • Multi Processors (AREA)

Abstract

L'invention concerne une technique qui permet de sécuriser l’intégrité des données et des applications à l’intérieur d’un système d’ordinateur. Dans un mode de réalisation, une ou plusieurs enclaves sécurisées sont établies dans lesquelles une application et des données peuvent être stockées et exécutées.
PCT/US2009/064493 2008-11-14 2009-11-14 Procédé et appareil assurant une exécution d'application sécurisée Ceased WO2010057065A2 (fr)

Priority Applications (1)

Application Number Priority Date Filing Date Title
JP2011536548A JP2012508938A (ja) 2008-11-14 2009-11-14 セキュアなアプリケーション実行方法および装置

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
US19931808P 2008-11-14 2008-11-14
US61/199,318 2008-11-14
US59076709A 2009-11-13 2009-11-13
US12/590,767 2009-11-13

Publications (2)

Publication Number Publication Date
WO2010057065A2 true WO2010057065A2 (fr) 2010-05-20
WO2010057065A3 WO2010057065A3 (fr) 2010-08-19

Family

ID=42170755

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/US2009/064493 Ceased WO2010057065A2 (fr) 2008-11-14 2009-11-14 Procédé et appareil assurant une exécution d'application sécurisée

Country Status (2)

Country Link
JP (1) JP2012508938A (fr)
WO (1) WO2010057065A2 (fr)

Cited By (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102289386A (zh) * 2010-06-21 2011-12-21 英特尔公司 通过部分虚拟化机器的统一存储设备
WO2013058781A1 (fr) 2011-10-18 2013-04-25 Intel Corporation Procédés, systèmes et appareil pour faciliter une authentification en fonction d'un client
WO2014105159A1 (fr) * 2012-12-28 2014-07-03 Intel Corporation Radiomessagerie en enclaves sécurisées
WO2014105160A1 (fr) * 2012-12-28 2014-07-03 Intel Corporation Connexion en enclaves sécurisées
WO2014105161A1 (fr) * 2012-12-28 2014-07-03 Intel Corporation Gestion de mémoire dans des enclaves sécurisées
EP2778899A2 (fr) 2013-03-15 2014-09-17 Intel Corporation Fixer le rendu de surfaces d'affichage
US9087200B2 (en) 2009-12-22 2015-07-21 Intel Corporation Method and apparatus to provide secure application execution
EP2889777A3 (fr) * 2013-12-27 2015-08-12 Intel IP Corporation Modification des permissions de mémoire dans un environnement de traitement sécurisé
US9448950B2 (en) 2013-12-24 2016-09-20 Intel Corporation Using authenticated manifests to enable external certification of multi-processor platforms
US9501668B2 (en) 2013-09-25 2016-11-22 Intel Corporation Secure video ouput path
US9606940B2 (en) 2015-03-27 2017-03-28 Intel Corporation Methods and apparatus to utilize a trusted loader in a trusted computing environment
US9705892B2 (en) 2014-06-27 2017-07-11 Intel Corporation Trusted time service for offline mode
US10552344B2 (en) 2017-12-26 2020-02-04 Intel Corporation Unblock instruction to reverse page block during paging

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9430384B2 (en) * 2013-03-31 2016-08-30 Intel Corporation Instructions and logic to provide advanced paging capabilities for secure enclave page caches

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5224166A (en) * 1992-08-11 1993-06-29 International Business Machines Corporation System for seamless processing of encrypted and non-encrypted data and instructions
JP3880933B2 (ja) * 2003-01-21 2007-02-14 株式会社東芝 耐タンパマイクロプロセッサ及びキャッシュメモリ搭載プロセッサによるデータアクセス制御方法
JP4263976B2 (ja) * 2003-09-24 2009-05-13 株式会社東芝 オンチップマルチコア型耐タンパプロセッサ
US7734932B2 (en) * 2003-11-10 2010-06-08 Broadcom Corporation System and method for securing executable code
JP4945200B2 (ja) * 2006-08-29 2012-06-06 株式会社日立製作所 計算機システム及びプロセッサの制御方法
US7650479B2 (en) * 2006-09-20 2010-01-19 Arm Limited Maintaining cache coherency for secure and non-secure data access requests

Cited By (21)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9087200B2 (en) 2009-12-22 2015-07-21 Intel Corporation Method and apparatus to provide secure application execution
US10885202B2 (en) 2009-12-22 2021-01-05 Intel Corporation Method and apparatus to provide secure application execution
US10102380B2 (en) 2009-12-22 2018-10-16 Intel Corporation Method and apparatus to provide secure application execution
JP2012009013A (ja) * 2010-06-21 2012-01-12 Intel Corp 部分仮想化マシンに基づく統一格納装置
CN102289386A (zh) * 2010-06-21 2011-12-21 英特尔公司 通过部分虚拟化机器的统一存储设备
WO2013058781A1 (fr) 2011-10-18 2013-04-25 Intel Corporation Procédés, systèmes et appareil pour faciliter une authentification en fonction d'un client
US9766889B2 (en) 2012-12-28 2017-09-19 Intel Corporation Memory management in secure enclaves
US9990197B2 (en) 2012-12-28 2018-06-05 Intel Corporation Memory management in secure enclaves
WO2014105159A1 (fr) * 2012-12-28 2014-07-03 Intel Corporation Radiomessagerie en enclaves sécurisées
US10409597B2 (en) 2012-12-28 2019-09-10 Intel Corporation Memory management in secure enclaves
WO2014105160A1 (fr) * 2012-12-28 2014-07-03 Intel Corporation Connexion en enclaves sécurisées
WO2014105161A1 (fr) * 2012-12-28 2014-07-03 Intel Corporation Gestion de mémoire dans des enclaves sécurisées
US9690704B2 (en) 2012-12-28 2017-06-27 Intel Corporation Paging in secure enclaves
EP2778899A2 (fr) 2013-03-15 2014-09-17 Intel Corporation Fixer le rendu de surfaces d'affichage
US9501668B2 (en) 2013-09-25 2016-11-22 Intel Corporation Secure video ouput path
US9448950B2 (en) 2013-12-24 2016-09-20 Intel Corporation Using authenticated manifests to enable external certification of multi-processor platforms
US9355262B2 (en) 2013-12-27 2016-05-31 Intel Corporation Modifying memory permissions in a secure processing environment
EP2889777A3 (fr) * 2013-12-27 2015-08-12 Intel IP Corporation Modification des permissions de mémoire dans un environnement de traitement sécurisé
US9705892B2 (en) 2014-06-27 2017-07-11 Intel Corporation Trusted time service for offline mode
US9606940B2 (en) 2015-03-27 2017-03-28 Intel Corporation Methods and apparatus to utilize a trusted loader in a trusted computing environment
US10552344B2 (en) 2017-12-26 2020-02-04 Intel Corporation Unblock instruction to reverse page block during paging

Also Published As

Publication number Publication date
JP2012508938A (ja) 2012-04-12
WO2010057065A3 (fr) 2010-08-19

Similar Documents

Publication Publication Date Title
WO2010057065A2 (fr) Procédé et appareil assurant une exécution d'application sécurisée
US12130740B2 (en) Apparatuses and methods for a processor architecture
US20250110737A1 (en) Processor having multiple cores, shared core extension logic, and shared core extension utilization instructions
US11216556B2 (en) Side channel attack prevention by maintaining architectural state consistency
EP3552108B1 (fr) Appareils et procédés d'une architecture de processeur
US11354240B2 (en) Selective execution of cache line flush operations
US8140828B2 (en) Handling transaction buffer overflow in multiprocessor by re-executing after waiting for peer processors to complete pending transactions and bypassing the buffer
US8812792B2 (en) Technique for using memory attributes
US12277041B2 (en) Method for migrating CPU state from an inoperable core to a spare core
US11188341B2 (en) System, apparatus and method for symbolic store address generation for data-parallel processor
US9323686B2 (en) Paging in secure enclaves
TW201732566A (zh) 從亂序處理器中的不良儲存-至-負載轉發復原的方法與設備
US8719500B2 (en) Technique for tracking shared data in a multi-core processor or multi-processor system
US8996923B2 (en) Apparatus and method to obtain information regarding suppressed faults
US20230418757A1 (en) Selective provisioning of supplementary micro-operation cache resources

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 09826885

Country of ref document: EP

Kind code of ref document: A2

WWE Wipo information: entry into national phase

Ref document number: 2011536548

Country of ref document: JP

Ref document number: 2340/DELNP/2011

Country of ref document: IN

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 09826885

Country of ref document: EP

Kind code of ref document: A2