Trust domain isolation management in secured execution environments
An established root of trust supports a secure execution environment (SEE) that supports execution of validated software instructions on behalf of trust domains that operate within the SEE to implement functions and to support hardware supported by the IHS. Embodiments support isolated operation of such trust domains within the SEE while avoiding the overhead of isolation within separate software environment enclaves. Signed instructions for the operation of a trust domain are retrieved and authenticated based on a signing token associated with the trust domain. If authenticated, the trust domain is granted access to resources set forth in a privilege policy token linked to the signing token of the trust domain. The privileges assigned to a trust domain may be modified by linking the trust domain's signing token to a new privilege policy token.
1. A method for providing isolation of trust domains within a secure execution environment of a trusted component of an Information Handling System (IHS), the method comprising:
retrieving a plurality of signing software tokens from a memory device of the IHS, wherein each signing software token comprises a signing key and comprises a link to a privilege policy token, and
wherein the signing key of each signing software token is associated with a trust domain that is configured to operate in the secure execution environment of the IHS using signed instructions;
retrieving a plurality of privilege policy tokens from the memory device of the IHS,
wherein each privilege policy token specifies a plurality of resources of the IHS that is accessed by a trust domain that operates within the secure execution environment of the IHS using signed instructions that have been validated;
retrieving, from the memory device of the IHS, first signed instructions for the operation of a first trust domain within the secure execution environment of the IHS;
validating a signature of the first signed instructions based on a first signing key associated with the first trust domain,
wherein the first signing key of the first trust domain is present in the plurality of signing software tokens retrieved from the memory device of the IHS;
in response to determination that the first signed instructions of the first trust domain are validated, granting the first trust domain access to a first plurality of IHS resources specified by a first privilege policy token that is linked to the first signing key associated with the first trust domain;
replacing the link from first signing key to the first privilege policy token with a link to a second privilege policy token specifying a second plurality of IHS resources;
revoking the access by the first trust domain to the first plurality of resources of the IHS specified by the first privilege policy token; and
granting the first trust domain access to the second plurality of IHS resources specified by the second privilege token.
2. The method of claim 1 , wherein the first plurality of resources granted for access by the first trust domain based on validation of the first signed instructions comprises a first region of a system memory of the IHS.
3. The method of claim 2 , further comprising:
receiving a request to access the first region of system memory; and
denying the request to access the first region of system memory when the request cannot be validated using the first signing key.
4. The method of claim 1 , wherein the first privilege policy token is linked to the first signing key of the first trust domain by a reference to the first privilege policy token in metadata of the first signing token of the first trust domain.
5. The method of claim 1 , wherein the plurality of privilege policy tokens retrieved from the memory device are signed by a signing authority, and wherein the plurality of retrieved signing keys are signed by the signing authority.
6. The method of claim 5 , further comprising: validating the signature of the plurality of privilege policy tokens and the signature of the plurality of retrieved signing keys using a root key associated with the signing authority.
7. The method of claim 1 , wherein the trusted component on which the secure execution environment operates comprises an embedded controller of the IHS.
8. An Information Handling System (IHS), comprising: a flash memory; and
an embedded controller coupled to the flash memory, wherein the embedded controller is configured to:
retrieve a plurality of signing software tokens from the flash memory, wherein each signing software token comprises a signing key and comprises a link to a privilege policy token, and wherein the signing, key of each signing software token is associated with a trust domain that is configured to operate in the secure execution environment of the IHS using signed instructions; retrieve a plurality of privilege policy tokens from the flash memory,
wherein each privilege policy token specifies a plurality of resources of the IHS that is accessed by a trust domain that operates within the secure execution environment of the IHS using signed instructions that have been validated;
retrieve, from the flash memory, first signed instructions for the operation of a first trust domain within the secure execution environment of the IHS;
validate a signature of the first signed instructions based on a first signing key associated with the first trust domain,
wherein the first signing key of the first trust domain is present in the plurality of signing software tokens retrieved from the memory device of the IHS; and
in response to determination that the first signed instructions of the first trust domain are validated, grant the first trust domain access to a first plurality of IHS resources specified by a first privilege policy token that is linked to the first signing key associated with the first trust domain,
wherein a second privilege policy token is linked to the first signing key in replacement of the link to the first signing key by the first privilege policy token; and
wherein the embedded controller is further configured to revoke the access by the first trust domain to the first plurality of resources of the IHS specified by the first privilege policy token and
grant the first trust domain access to a second plurality of IHS resources specified by the second privilege policy token.
9. The IHS of claim 8 , wherein the first plurality of resources granted for access by the first trust domain based on validation of the first signed instructions comprises a first region of a system memory of the IHS.
10. The IHS of claim 9 , wherein the embedded controller is further configured to receive a request to access the first region of system memory and to deny the request to access the first region of system memory when the request cannot be validated using the first signing key.
11. The IHS of claim 8 , wherein the first privilege policy token is linked to the first signing key of the first trust domain by a reference to the first privilege policy token in metadata of the first signing token of the first trust domain.
12. The IHS of claim 8 , wherein the embedded controller is configured to validate a signature of the plurality of privilege policy tokens and a signature of the plurality of retrieved signing keys using a root key associated with a signing authority.
13. An embedded controller coupled to a flash memory of an Information Handling System (IHS), wherein the embedded controller is configured to:
retrieve a plurality of signing software tokens from the flash memory of the IHS,
wherein each signing software token comprises a signing key and comprises a link to a privilege policy token, and
wherein the signing, key of each signing software token is associated with a trust domain that is configured to operate in a secure execution environment of the embedded controller using signed instructions;
retrieve a plurality of privilege policy tokens from the flash memory of the IHS,
wherein each privilege policy token specifies a plurality of resources of the IHS that is accessed by a trust domain that operates within the secure execution environment of the embedded controller using instructions that have been validated;
retrieve, from the flash memory, first signed instructions for the operation of a first trust domain within the secure execution environment of the embedded controller;
validate a signature of the first signed instructions based on a first signing key associated with the first trust domain,
wherein the first signing of the first trust domain is present in the plurality of signing software tokens retrieved from the flash memory of the IHS;
in response to determination that the first signed instructions of the first trust domain are validated, grant the first trust domain access to a first plurality of IHS resources specified by a first privilege policy token that is linked to the first signing key associated with the first trust domain,
wherein a second privilege policy token is linked to the first signing key in replacement of the link to the first signing key by the first privilege policy token, and
wherein the embedded controller is further configured to revoke the access by the first trust domain to the first plurality of resources of the IHS specified by the first privilege policy token; and
grant the first trust domain access to a second plurality of IHS resources specified by the second privilege policy token.
14. The embedded controller of claim 13 , wherein the first plurality of resources granted for access by the first trust domain based on validation of the first signed instructions comprises a first region of a system memory of the IHS.
15. The embedded controller of claim 14 , further configured to receiving a request to access the first region of system memory and to deny the request to access the first region of system memory when the request cannot be validated using the first signing key.
16. The embedded controller of claim 13 , wherein the first privilege policy token is linked to the first signing key of the first trust domain by a reference to the first privilege policy token in metadata of the first signing token of the first trust domain.
17. The embedded controller of claim 13 , wherein the embedded controller is configured to validate a signature of the plurality of privilege policy tokens and a signature of the plurality of retrieved signing keys using a root key associated with a signing authority.