Patent ID: 9398019
Filing Date: 2016-07-19
CPC Classification: G06F,H04L

Claim Text:
1. A method of creating a code protection domain in a computer system, wherein the method executes at a first privilege level and comprising: suspending a guest operating system that executes confidential code included in the code protection domain at a second privilege level that is less secure than the first privilege level, wherein the confidential code includes an authorization instruction that contains a first placeholder and a verification instruction that contains a second placeholder; replacing both the first placeholder and the second placeholder with a security key; setting both the authorization instruction and the verification instruction to be execute-only; and unsuspending the guest operating system, wherein, upon executing, the authorization instruction sets the value of a register to the security key and the verification instruction compares the value of the register to the security key, and wherein setting the verification instruction to be execute-only comprises setting a page table entry that controls access to the verification instruction such that read access is disabled, write access is disabled, and execution access is enabled.