Innovative instructions and software model for isolated execution

TLDR

The PC community has long struggled to provide secure solutions on open platforms, but Intel’s new technology enables developers to build and deploy confidential and integrity‑protected applications that run natively in the OS. The paper examines threats to applications and presents an ISA extension and programming model for hardware‑based containers. The mechanism uses ISA extensions to create hardware‑enforceable containers at developer‑chosen granularity, which the OS manages while remaining opaque, and defines a programming model for these containers.

Abstract

For years the PC community has struggled to provide secure solutions on open platforms. Intel has developed innovative new technology to enable SW developers to develop and deploy secure applications on open platforms. The technology enables applications to execute with confidentiality and integrity in the native OS environment. It does this by providing ISA extensions for generating hardware enforceable containers at a granularity determined by the developer. These containers while opaque to the operating system are managed by the OS. This paper analyzes the threats and attacks to applications. It then describes the ISA extension for generating a HW based container. Finally it describes the programming model of this container.