Granted Patent B2

US 12,321,467 · App. 17/854,814 · Granted Jun 3, 2025

Inventors: Salmin Sultana (Hillsboro, OR); David M. Durham (Beaverton, OR); Michael LeMay (Hillsboro, OR); Karanvir S. Grewal (Hillsboro, OR); Sergej Deutsch (Hillsboro, OR)

Assignee: Intel Corporation

G06F21/602G06F9/30043G06F9/30101G06F21/31G06F21/335G06F21/805

Abstract

Claims (84)

1. A processor comprising:

circuitry to be coupled to memory configured to store one or more instructions, the circuitry to:

execute the one or more instructions to instantiate a first process based on a request to launch an application associated with two or more software components to be invoked during the first process, wherein to instantiate the first process is to:

create a context table to be used by the first process;

encrypt a first software component of the two or more software components using a first cryptographic key;

encrypt a second software component of the two or more software components using a second cryptographic key, wherein the encrypted second software component includes an encrypted main program of the application;

store, in a first entry in the context table, first context information identifying the encrypted first software component and second context information representing the first cryptographic key; and

store, in a second entry in the context table, fourth context information identifying the encrypted second software component of the application and fifth context information representing the second cryptographic key, wherein subsequent to instantiating the first process, the circuitry is further to:

fetch an encrypted first code block of the encrypted main program from the memory;

decrypt the encrypted first code block of the encrypted main program to generate an unencrypted first instruction; and

execute the unencrypted first instruction to transition from executing the encrypted main program to executing the encrypted first software component.

2. The processor of claim 1 , wherein to instantiate the first process is further to:

store, in the first entry of the context table, third context information representing a first load address of the encrypted first software component.

3. The processor of claim 1 , wherein to instantiate the first process is further to:

create the first entry in the context table in response to determining that the encrypted first software component is shareable with other applications running on the processor.

4. The processor of claim 1 , wherein the second context information is to include either the first cryptographic key or a key handle that references the first cryptographic key.

5. The processor of claim 1 , wherein to instantiate the first process is further to:

populate a first register with a base address of the context table.

6. The processor of claim 1 , wherein to instantiate the first process is further to:

populate a second register with the second cryptographic key; and

populate a third register with a third load address of the encrypted main program.

7. The processor of claim 6 , wherein the encrypted first code block of the encrypted main program is to be decrypted based at least in part on the second cryptographic key in the second register.

8. The processor of claim 6 , wherein the circuitry is further to execute a trusted loader to:

prior to executing the encrypted first software component, encode a return address to an encrypted second instruction in the encrypted main program, wherein the return address is to be encoded with the fourth context information identifying the encrypted main program and a domain switch value to trigger updates to the second register and the third register based on the return address being used to return execution to the encrypted main program.

9. The processor of claim 6 , wherein the circuitry is further to execute a trusted loader to:

prior to executing the encrypted first software component,

update the second register with the first cryptographic key based on the second context information in the first entry of the context table; and

update the third register with a first load address of the encrypted first software component based on third context information in the first entry in the context table.

10. The processor of claim 9 , wherein the circuitry is further to:

subsequent to updating the second register and the third register, fetch an encrypted second code block of the encrypted first software component; and

decrypt the encrypted second code block based at least in part on the first cryptographic key in the second register to generate an unencrypted third instruction of the first software component.

11. The processor of claim 10 , wherein the encrypted second code block of the encrypted first software component is to be decrypted based in part on a second tweak including location information indicating a position of the encrypted second code block relative to the first load address of the encrypted first software component.

12. The processor of claim 1 , wherein the circuitry is further to, during execution of the encrypted first software component in the first process:

initiate a process context switch to pause the first process and activate a second process, wherein the process context switch is to include:

storing a first load address of the encrypted first software component in a first variable of a process control block of the first process;

storing a base address of the context table in a second variable of the process control block of the first process; and

storing the first cryptographic key in a third variable of the process control block of the first process.

13. The processor of claim 1 , wherein the encrypted first software component is position independent code (PIC).

14. The processor of claim 1 , wherein the first software component includes a shared library, a microservice, a function as a service, or a browser component of a browser.

15. The processor of claim 1 , wherein the second first software component includes a shared library, a microservice, a function as a service, or a browser component of a browser.

16. A non-transitory machine readable medium comprising instructions that when executed by a processor, cause the processor to perform operations comprising:

receiving a request to instantiate a first process based on a request to launch an application;

creating a context table for the first process;

loading an encrypted shared library into memory for the first process, wherein the encrypted shared library is encrypted based at least in part on a first cryptographic key;

creating a first entry in the context table;

storing, in the first entry, first context information identifying the encrypted shared library and second context information representing the first cryptographic key;

creating a second entry in the context table, the second entry to include fourth context information identifying an encrypted main program of the application and fifth context information representing a second cryptographic key, wherein the encrypted main program is encrypted based, at least in part, on the second cryptographic key;

populating a first register with a base address of the context table;

populating a second register with the second cryptographic key; and

populating a third register with a load address of the encrypted main program.

17. The non-transitory machine readable medium of claim 16 , wherein the instructions, when executed by the processor, cause the processor to perform further operations comprising:

storing, in the first entry of the context table, third context information representing a first load address of the encrypted shared library.

18. The non-transitory machine readable medium of claim 16 , wherein the instructions, when executed by the processor, cause the processor to perform further operations comprising:

in response to execution of an instruction in the encrypted main program to call the encrypted shared library:

update the second register with the first cryptographic key based on the second context information in the first entry of the context table; and

update the third register with a first load address of the encrypted shared library based on third context information in the first entry of the context table.

19. A system, comprising:

memory for storing a plurality of software components and a main program of a user application; and

a processor coupled to the memory, the processor comprising circuitry to:

instantiate a process based on a request to launch the user application associated with a software component to be invoked during the process, wherein to instantiate the process is to include:

encrypting the main program of the user application based at least in part on a first cryptographic key;

encrypting the software component based at least in part on a second cryptographic key;

storing, in a first entry in a context table of the process, first context information identifying the encrypted main program and second context information representing the first cryptographic key;

storing, in a second entry in the context table of the process, third context information identifying the encrypted software component and fourth context information representing the second cryptographic key,

subsequent to instantiating the process, fetch an encrypted first code block of the encrypted main program from the memory;

decrypt the encrypted first code block of the encrypted main program to generate an unencrypted first instruction; and

execute the unencrypted first instruction to transition from executing the encrypted main program to executing the encrypted first software component.

20. The system of claim 19 , wherein to encrypt the software component is to include:

encrypting an unencrypted second code block of the software component based on the second cryptographic key and a code tweak, wherein the code tweak is to include an offset of the code block relative to a start of the software component.

21. The system of claim 19 , wherein the encrypted software component is position independent code (PIC).

22. A method comprising:

instantiating a first process based on a request to launch an application, wherein the application is associated with a software component to be invoked during the first process, wherein instantiating the first process includes:

encrypting a main program of the application based at least in part on a first cryptographic key;

using at least a second cryptographic key for encrypting the software component to be invoked during the first process;

creating a first entry in a context table of the first process, the first entry to include first context information identifying the main program and second context information representing the first cryptographic key;

creating a second entry in the context table, the second entry to include third context information identifying the software component and fourth context information representing the second cryptographic key;

subsequent to instantiating the first process, fetching an encrypted first code block of the encrypted main program from a memory;

decrypting the encrypted first code block of the encrypted main program to generate an unencrypted first instruction; and

executing the unencrypted first instruction to transition from executing the encrypted main program to executing the encrypted software component.

23. The method of claim 22 , further comprising:

during execution of the encrypted software component in the first process initiate a process context switch to pause the first process and activate a second process, wherein the process context switch includes:

storing a first load address of the encrypted software component in a first variable of a process control block of the first process;

storing a base address of the context table in a second variable of the process control block of the first process; and

storing the second cryptographic key in a third variable of the process control block of the first process.

Assignments (1)

Continuity (1)

References Cited (365)