Intel Corporation

Hans Goran Liljestrand

David M Durham

Michael Lemay

Andrew V Anderson

Karanvir S Grewal

Sergej Deutsch

Salmin Sultana

Techniques disclosed include selecting a first key identifier (ID) for a first compartment of a compartmentalized process of a computing system, the first compartment including first private data; assigning a first extended page table (EPT) having at least one memory address including the first key ID; encrypting the first private data with a first key associated with the first key ID; and storing the encrypted first private data in a memory starting at the at least one memory address of the first EPT.

Fast key ID switching via extended paging for cryptographic intra-process isolation

A processor is to execute a first instruction to perform a simulated return in a program from a callee function to a caller function based on a first input stack pointer encoded with a first security context of a first callee stack frame. To perform the simulated return is to include generating a first simulated stack pointer to the caller stack frame. The processor is further to, in response to identifying an exception handler in the first caller function, execute a second instruction to perform a simulated call based on a second input stack pointer encoded with a second security context of the caller stack frame. To perform the simulated call is to include generating a second simulated stack pointer to a new stack frame containing an encrypted instruction pointer associated with the exception handler. The second simulated stack pointer is to be encoded with a new security context.

Updating encrypted security context in stack pointers for exception handling and tight bounding of on-stack arguments

Growing community of inventors

Helsinki, Finland

Hans Goran Liljestrand