Method and system for process working set isolation
Embodiments of systems and methods disclosed herein may isolate the working set of a process such that the data of the working set is inaccessible to other processes, even after the original process terminates. More specifically, in certain embodiments, the working set of an executing process may be stored in cache and for any of those cache lines that are written to while in secure mode those cache lines may be associated with a secure descriptor for the currently executing process. The secure descriptor may uniquely specify those cache lines as belonging to the executing secure process such that access to those cache lines can be restricted to only that process.
1. A system, comprising:
a processor;
a memory;
a secret key stored in hardware;
a cache having one or more lines comprising data of one or more processes executed on the processor in a secure mode; and
a secure execution controller configured to control access to a first line of the cache using a first secure descriptor based on the secret key and associated with a first process such that only the first process can access the first line of the cache and control access to a second line of cache using a second secure descriptor based on the secret key and associated with a second process such that only the second process can access the second line of the cache, wherein the first secure descriptor and the second secure descriptor are different secure descriptors.
2. The system of claim 1 , wherein the system was placed in secure mode based on the first secure descriptor.
3. The system of claim 1 , wherein the secure execution controller is configured to cause an entire working set of the first process to be stored in the cache and to cause writes to a memory location other than the cache in the secure mode to be disabled.
4. The system of claim 1 , wherein the first process has terminated.
5. The system of claim 3 , wherein the secure execution controller is configured to cause the first line of the cache to be associated with the first secure descriptor associated with the first process.
6. The system of claim 5 , wherein the secure execution controller is configured to cause a security flag associated with the first line of the cache to be set when the first process writes the data.
7. The system of claim 6 , wherein the secure execution controller is configured to control access by causing the following steps to be performed:
determining that the first line of cache is being accessed by the first process,
determining if the first process is executing in secure mode,
determining a third secure descriptor associated with the first process,
comparing the first secure descriptor and the third secure descriptor, and
allowing access only if the first is executing in secure mode and the first secure descriptor matches the third secure descriptor.
8. A method, comprising:
executing one or more processes on a processor in a secure mode;
storing data in one or more lines of a cache, wherein the data was stored in a first line of the cache by a first process executed on the processor in the secure mode and in a second line of the cache by a second process executed on the processor in the secure mode; and
controlling access to the first line of the cache using a first secure descriptor associated with the first process such that only the first process can access the first line of the cache and controlling access to the second line of the cache using a second secure descriptor associated with the second process such that only the second process can access the second line of the cache, wherein the first secure descriptor and the second secure descriptor are different secure descriptors and are based on a secret key stored in hardware on a system comprising the processor and the cache.
9. The method of claim 8 , wherein the secure mode was entered based on the first secure descriptor.
10. The method of claim 8 , further comprising storing an entire working set of the first process in the cache and disabling writes to a memory location other than the cache in the secure mode.
11. The method of claim 8 , wherein the first process has terminated.
12. The method of claim 10 , further comprising associating the first line of the cache with the first secure descriptor associated with the first process.
13. The method of claim 12 , further comprising setting a security flag associated with the line of the cache when the first process writes the data.
14. The method of claim 13 , wherein controlling access comprises:
determining that the first line of cache is being accessed by the first process,
determining if the first process is executing in secure mode,
determining a third secure descriptor associated with the first process,
comparing the first secure descriptor and the third secure descriptor, and
allowing access only if the first is executing in secure mode and the first secure descriptor matches the third secure descriptor.
15. A non-transitory computer readable medium, comprising instructions for:
executing one or more processes on a processor in a secure mode;
storing data in one or more lines of a cache, wherein the data was stored in a first line of the cache by a first process executed on the processor in the secure mode and in a second line of the cache by a second process executed on the processor in the secure mode; and
controlling access to the first line of the cache using a first secure descriptor associated with the first process such that only the first process can access the first line of the cache and controlling access to the second line of the cache using a second secure descriptor associated with the second process such that only the second process can access the second line of the cache, wherein the first secure descriptor and the second secure descriptor are different secure descriptors and are based on a secret key stored in hardware on a system comprising the processor and the cache.
16. The non-transitory computer readable medium of claim 15 , wherein the secure mode was entered based on the first secure descriptor.
17. The non-transitory computer readable medium of claim 15 , further comprising instructions for storing an entire working set of the first process in the cache and disabling writes to a memory location other than the cache in the secure mode.
18. The non-transitory computer readable medium of claim 15 , wherein the first process has terminated.
19. The non-transitory computer readable medium of claim 17 , further comprising instructions for associating the first line of the cache with the first secure descriptor associated with the first process.
20. The non-transitory computer readable medium of claim 19 , further comprising instructions for setting a security flag associated with the first line of the cache when the process writes the data.
21. The non-transitory computer readable medium of claim 20 , wherein controlling access comprises:
determining that the first line of cache is being accessed by the first process,
determining if the first process is executing in secure mode,
determining a third secure descriptor associated with the first process,
comparing the first secure descriptor and the third secure descriptor, and
allowing access only if the first is executing in secure mode and the first secure descriptor matches the third secure descriptor.