Facilitating system service request interactions for hardware-protected applications
Described herein are implementations for providing a platform adaptation layer that enables applications to execute inside a user-mode hardware-protected isolation container while utilizing host platform resources that reside outside of the isolation container. The platform adaptation layer facilitates a system service request interaction between the application and the host platform. As part of the facilitating, a secure services component of the platform adaptation layer performs a security-relevant action.
1. A method comprising:
executing an application in a user-mode hardware-protected isolation container (UMHPIC), the UMHPIC protected by a security-enabled processor that provides at least an exit gate for passing execution out of the UMHPIC and an entry gate for returning execution into the UMHPIC;
facilitating, by an UMHPIC-aware platform adaptation layer executing within the UMHPIC, a system service request interaction between the application inside the UMHPIC and one or more untrusted components of a host platform executing outside of the UMHPIC; and
performing, by a secure services component of the UMHPIC-aware platform adaptation layer, a security-relevant action, wherein the security-relevant action facilitates the system service request interaction between the application inside the UMHPIC and the one or more untrusted components of the host platform executing outside of the UMHPIC.
2. The method of claim 1 , wherein the security-relevant action includes encrypting data that is from the application and that is associated with the system service request interaction.
3. The method of claim 1 , wherein the security-relevant action includes maintaining a bookkeeping data structure to store information regarding the system service request interaction.
4. The method of claim 1 , wherein the security-relevant action includes decrypting data that is for the application and that is associated with the system service request interaction.
5. The method of claim 1 , wherein the system service request interaction includes a request for allocation of resources, and wherein the security-relevant action includes verifying correctness of a resource allocation result that is provided by the host platform as part of the system service request interaction.
6. The method of claim 5 , wherein the resource allocation result includes an indication of memory resources, and wherein the verifying the correctness of the resource allocation result includes checking for overlapping memory allocations.
7. The method of claim 1 , wherein the security-relevant action includes performing thread scheduling services.
8. A system, comprising:
one or more processors including a security-enabled processor configured to provide at least an entry gate and an exit gate for passing execution to and from, respectively, a user-mode hardware-protected isolation container (UMHPIC);
memory including the UMHPIC; and
an UMHPIC-aware platform adaptation layer executable by the security-enabled processor, at least partially inside the UMHPIC, to facilitate a system service request interaction between an application executing within the UMHPIC and one or more untrusted components of a host platform executing outside of the UMHPIC, the UMHPIC-aware platform adaptation layer including:
a secure services component executable by the security-enabled processor inside the UMHPIC to perform a security-relevant action as part of the facilitation of the system service request interaction, wherein the security-relevant action facilitates the system service request interaction between the application executing within the UMHPIC and the one or more untrusted components of the host platform executing outside of the UMHPIC.
9. The system of claim 8 , wherein the security-relevant action includes encryption of data that is from the application and that is associated with the system service request interaction.
10. The system of claim 8 , wherein the UMHPIC-aware platform adaptation layer is configured to create a bookkeeping data structure within the UMHPIC, and wherein the security-relevant action includes maintenance of the bookkeeping data structure to store information regarding the system service request interaction.
11. The system of claim 8 , wherein the security-relevant action includes decryption of data that is for the application and that is associated with the system service request interaction.
12. The system of claim 8 , wherein the system service request interaction is a request for allocation of resources, and wherein the security-relevant action includes verification of the correctness of a resource allocation result that is provided by the host platform as part of the system service request interaction.
13. The system of claim 12 , wherein the resource allocation result includes an indication of memory resources, and wherein the verification of the correctness of the resource allocation result includes a check for overlapping memory allocations.
14. The system of claim 8 , wherein the security-relevant action includes performance of thread scheduling services.
15. The system of claim 8 , wherein the UMHPIC-aware platform adaptation layer further includes a thunking component configured to marshal and unmarshal, as part of the facilitation of the system service request interaction, parameters associated with the system service request interaction.
16. Computer-readable storage device comprising a plurality of programming instructions executable by one or more processors of a computing device to cause the computing device to:
facilitate a system resource request interaction between an application that executes within a user-mode hardware-protected isolation container (UMHPIC) and one or more untrusted components of a host platform that executes outside of the UMHPIC, the UMHPIC provided by a security-enabled processor that is configured to provide at least an exit gate for passing execution outside of the UMHPIC and an entry gate for passing execution into the UMHPIC; and
perform, on behalf of the application as part of the facilitation of the system resource request interaction, a security-relevant action that facilitates the system resource request interaction between the application that executes within the UMHPIC and the one or more untrusted components of the host platform that executes outside of the UMHPIC.
17. Computer-readable storage device of claim 16 , wherein the security-relevant action includes encryption of data that is from the application and that is associated with the system service request interaction.
18. Computer-readable storage device of claim 16 , wherein the system service request interaction includes a request for allocation of resources, and wherein the security-relevant action includes verification of correctness of a resource allocation result that is provided by the host platform as part of the system service request interaction.
19. Computer-readable storage device of claim 18 , wherein the resource allocation result includes an indication of memory resources, and wherein the verification of the correctness of the resource allocation result includes checking for overlapping memory allocations.
20. Computer-readable storage device of claim 18 , wherein the resource allocation result includes a device handle, and wherein the verification of the correctness of the resource allocation result includes determining whether the device handle is a duplicate device handle.