Management of a distributed universally secure execution environment

1. A method for security management across a plurality of diverse execution environments, the method comprising:

associating, based on a distributed computing framework, a secure execution environment interface with each diverse execution environment from among the plurality of diverse execution environments that collectively execute subroutines of a distributed application within a secure execution environment, the distributed application operating in a distributed system among multiple nodes that can each execute a portion of the distributed application;

receiving, for each diverse execution environment, a general access policy to access at least one secure memory region associated with a respective one of the plurality of diverse execution environments;

in response to a request from the distributed application to access a secure memory region associated with at least one diverse execution environment, prompting for entry at the secure execution environment interface of security credentials to obtain access to the secure memory region;

in response to receiving and verifying the security credentials to obtain access to the secure memory region, establishing, by the secure execution environment interface, access to the secure memory region of the respective one of the plurality of diverse execution environments; and

executing a subroutine provided by the distributed application to read and/or alter data in at least a subset of the secure memory region, and returning a result to the distributed application via the secure execution environment interface.

2. The method of claim 1 , further comprising:

determining when at least one diverse execution environment is executing a runtime operation;

in response to the determining, prompting for entry of security credentials to a respective at least one diverse execution environment to obtain access to the secure memory region during at least a portion of the runtime operation;

in response to the receiving and the verifying of the security credentials, providing access to at least a portion of the secure memory region during the runtime operation for the respective at least one diverse execution environment; and

in response to the security credentials not being valid, denying access to the secure memory region.

3. The method of claim 1 , wherein the secure execution environment comprises specialized run-time memory regions that enables data and applications within memory regions associated with each node to remain un-accessed by non-authorized applications and devices, the at least one diverse execution environment comprises diverse execution environment (DEE) devices, the devices operating in at least one or more of an execute-on-host environment and an execute-on-chip environment.

4. The method of claim 3 , further comprising in response to receiving the request from the distributed application for the execute-on-host environment, accessing the execute-on-host environment by performing one or more of: (i) requesting access to a runtime secure memory region and executing the subroutine of the distributed application in the runtime secure memory region, (ii) providing a decryption key to a decrypted memory region, and (iii) executing a communication routine through shared memory regions to predetermined trusted regions of the diverse execution environment.

5. The method of claim 4 , wherein the predetermined trusted regions comprise at least one of a Local Security Authority region, a Kernel Mode Code Integrity region, a Hypervisor Code Integrity region, Trusted Execution Environment, and Software Guard Extensions.

6. The method of claim 3 , further comprising in response to receiving the request from the distributed application for the execute-on-chip environment, accessing the execute-on-chip environment by performing one or more of: (i) providing a unique decryption key to each execution context associated with an assigned address space and processor unit, and (ii) encrypting the distributed application based on an encryption program image generated by a target processor associated with the secure execution on chip environment.

7. The method of claim 1 , further comprising establishing, during runtime, via a network connection, a secure communication link between the secure execution environment interface and each diverse execution environment using selectively determined function calls that are associated with a shared library of function calls.

8. The method of claim 1 , further comprising:

establishing an intermediate bi-directional communication pathway between each diverse execution environment and the secure execution environment interface utilizing a service proxy; and

loading a copy of the distributed application to a respective secure memory region, via the intermediate bi-directional communication pathway, in preparation for execution;

wherein the service proxy conceals operations of the secure execution environment interface from applications associated with each diverse execution environment.

9. The method of claim 1 , further comprising:

enabling access to a secure execution environment that comprises memory regions that are selectively accessible during runtime operations of the respective diverse execution environment; and

establishing secure access to the respective one of the plurality of diverse execution environments during execution of runtime operations and after completion of runtime operations.

10. The method of claim 1 , wherein a first node among the multiple nodes is an execute on chip (EOC) device having a Secure Execution physical unclonable function (PUF)-based Processor architecture (SEPP) that includes a secure region, the PUF directly integrated into an instruction pipeline of the SEPP.

11. The method of claim 10 , further comprising:

in response to receiving a request from the distributed application for an execute-on-chip environment, accessing the execute-on-chip environment by encrypting the distributed application based on an encryption program image generated by a target processor associated with the secure execution on chip environment.

12. An Information Handling System (IHS) comprising:

a network interface device;

a processor communicatively coupled to the network interface device; and

a memory system communicatively coupled to the processor and having stored thereon a secure execution environment module that executes on the processor to enable the processor to:

associate, based on a distributed computing framework, a secure execution environment interface with each diverse execution environment from among a plurality of diverse execution environments external to the IHS and that collectively execute subroutines of a distributed application within a secure execution environment, the distributed application operating in a distributed system among multiple nodes that can each execute a portion of the distributed application, each node communicating with one another via the IHS and negotiating execution points of the distributed application 231 through the IHS;

receive, for each diverse execution environment, a general access policy to access at least one secure memory region associated with a respective one of the plurality of diverse execution environments;

in response to a request from the distributed application to access a secure memory region associated with at least one diverse execution environment, prompting for entry at the secure execution environment interface of security credentials to obtain access to the secure memory region;

in response to receiving and verifying the security credentials to obtain access to the secure memory region, establish, by the secure execution environment interface, access to the secure memory region of the respective one of the plurality of diverse execution environments; and

execute a subroutine provided by the distributed application to read and/or alter data in at least a subset of the secure memory region, and return a result to the distributed application via the secure execution environment interface.

13. The IHS of claim 12 , wherein the secure execution environment module further enables the processor to:

determine when at least one diverse execution environment is executing a runtime operation;

in response to the determining, prompt for entry of security credentials to a respective at least one diverse execution environment to obtain access to the secure memory region during at least a portion of the runtime operation;

in response to the receiving and the verifying of the security credentials, providing access to at least a portion of the secure memory region during the runtime operation for the respective at least one diverse execution environment; and

in response to the security credentials not being valid, denying access to the secure memory region.

14. The IHS of claim 12 , wherein the secure execution environment comprises specialized run-time memory regions that enables data and applications within memory regions associated with each node to remain un-accessed by non-authorized applications and devices, the at least one diverse execution environment comprises diverse execution environment (DEE) devices, the devices operating in at least one of an execute-on-host environment and an execute-on-chip environment.

15. The IHS of claim 14 , wherein in response to receiving the request from the distributed application for the execute-on-host environment, the secure execution environment module further enables the processor to access the execute-on-host environment by performing one or more of: (i) requesting access to a runtime secure memory region and executing the subroutine of the distributed application in the runtime secure memory region, (ii) providing a decryption key to a decrypted memory region, and (iii) executing a communication routine through shared memory regions to a predetermined trusted regions of the diverse execution environment.

16. The IHS of claim 15 , wherein the predetermined trusted regions comprise at least one of a Local Security Authority region, a Kernel Mode Code Integrity region, a Hypervisor Code Integrity region, Trusted Execution Environment, and Software Guard Extensions.

17. The IHS of claim 14 , wherein in response to receiving the request from the distributed application for the execute-on-chip environment, the secure execution environment module further enables the processor to access the execute-on-chip environment by performing one or more of: (i) providing a unique decryption key to each execution context associated with an assigned address space and processor unit, and (ii) encrypting the distributed application based on an encryption program image generated by a target processor associated with the secure execution on chip environment.

18. The IHS of claim 12 , wherein the secure execution environment module further enables the processor to during runtime, establish a secure communication link, via a network connection, between the secure execution environment interface and each diverse execution environment using selectively determined function calls that are associated with a shared library of function calls.

19. The IHS of claim 12 , wherein the secure execution environment module further enables the processor to:

establish an intermediate bi-directional communication pathway between each diverse execution environment and the secure execution environment interface utilizing a service proxy; and

load a copy of the distributed application to a respective secure memory region, via the intermediate bi-directional communication pathway, in preparation for execution;

wherein the service proxy conceals operations of the secure execution environment interface from applications associated with each diverse execution environment.

20. The IHS of claim 12 , wherein the secure execution environment module further enables the processor to:

enable access to a secure execution environment that comprises memory regions that are selectively accessible during runtime operations of the respective diverse execution environment; and

establish secure access to the respective one of the plurality of diverse execution environments during execution of runtime operations and after completion of runtime operations.