Patent application EP20162644A (EP), filed 2020-03-12
Publication number: EP3757859A2
Title: HOST-CONVERTIBLE SECURE ENCLAVES IN MEMORY THAT LEVERAGE MULTI-KEY TOTAL MEMORY ENCRYPTION WITH INTEGRITY
Abstract: A processor includes a cryptographic engine to control access, using an secure region key identifier (ID), to one or more memory range of memory allocable for flexible conversion to secure pages of architecturally-protected memory regions, and a processor core. The processor core is to, responsive to receipt of a request to access the memory, perform a walk of page tables and extended page tables to translate a linear address of the request to a physical address of the memory. The processor core is further to determine that the physical address corresponds to an secure page within the one or more memory range of the memory, that a first key ID located within the physical address does not match the secure region key ID, and issue a page fault and deny access to the secure page in the memory.
IPC codes: G06F  12/    14            A I
G06F  21/    79            A I
G06F  12/  0804            A I
G06F  12/  0882            A I
G06F  12/  1036            A I
Claims: number: 1
text: A processor comprising:
number: 2
text: The processor of claim 1, wherein the processor core further comprises a set of instructions in firmware that performs a basic input-output system (BIOS), wherein the processor core is to execute the set of instructions to:
number: 3
text: The processor of claim 2, wherein the processor core is further to execute memory check firmware to fail a memory check process in response to detection that the secure region key ID has not been allocated for use with the secure extensions key.
number: 4
text: The processor of claim 2, wherein the processor core is further to execute the set of instructions to allocate one of a plurality of key IDs for exclusive use as the secure region key ID.
number: 5
text: The processor of claim 2, wherein the processor core is further to execute a central processor unit identifier (CPUID) instruction, wherein the CPUID instruction having:
number: 6
text: The processor of claim 1, wherein the processor core is further to map, using the secure key ID, a guest virtual address of the secure page to a second physical address within page tables and extended page tables, such that the second physical address contains the secure region key ID.
number: 7
text: A system comprising:
number: 8
text: The system of claim 7, wherein the cryptographic engine is further to:
number: 9
text: The system of claim 8, wherein the cryptographic engine, to fulfill the read operation, is further to return a fixed pattern of data to the requesting agent.
number: 10
text: The system of claim 7, wherein the cryptographic engine is further to:
number: 11
text: A method comprising:
number: 12
text: The method of claim 11, further comprising:
number: 13
text: The method of claim 12, further comprising:
number: 14
text: The method of claim 11, further comprising:
number: 15
text: The method of claim 11, further comprising:
Office action: search_report, dated 2020-12-30
Prior art cited: ref_id: EP1909185
ref_type: patent
severity: background
ref_id: EP3049992
ref_type: patent
severity: background
ref_id: US2017372088
ref_type: patent
severity: background
ref_id: US2018046823
ref_type: patent
severity: background
ref_id: US2019095334
ref_type: patent
severity: background
ref_id: US2019102324
ref_type: patent
severity: background
Final disposition: pending (2020-12-30)