Accelerator Multi-Tenancy via Isolated Compute Zones
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In cloud computing environments, maintaining isolation between tenants when offloading compute tasks to accelerators is challenging, as existing methods struggle to ensure secure communication and data protection across shared computing infrastructure.
Innovation Solution
The implementation of cryptographically secure communications between host computing systems and accelerators, using Isolated Memory Regions (IMRs) and a Trusted Execution Environment (TEE) within the accelerator, along with secure compute zones, to isolate and protect tenant data and code.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If computing resources are shared between multiple tenants to improve resource utilization, then productivity increases, but isolation and security between tenants deteriorate
Solution Approach 1:
The accelerator is divided into multiple isolated compute zones, each dedicated to a specific tenant. Each compute zone has its own isolated memory region and execution environment, preventing cross-tenant access while allowing the accelerator to serve multiple tenants simultaneously. This segmentation resolves the contradiction by enabling multi-tenancy without compromising isolation.
Solution Approach 2:
A hypervisor is introduced as an intermediary layer between tenants and the accelerator. The hypervisor manages compute zone assignments, enforces isolation policies, and controls access to accelerator resources. This intermediary enables secure resource sharing by mediating all interactions between tenants and the underlying hardware.
2Productivity
If tenant code and data are offloaded to accelerators for improved processing performance, then productivity increases, but security and confidentiality deteriorate
Solution Approach 1:
Each compute zone is configured with local isolation properties specific to its assigned tenant. Memory regions are marked as isolated and accessible only by their corresponding compute zone, creating localized security boundaries. This local quality approach ensures that performance-critical code and data remain protected even when executed on shared accelerator hardware.
Solution Approach 2:
The system establishes isolation boundaries and security controls before tenant code and data are offloaded to the accelerator. Compute zones are pre-configured with restricted access permissions, and the hypervisor enforces these boundaries before any processing occurs. This beforehand cushioning prevents potential security breaches before they can occur.
3Reliability
If traditional virtualization is used to isolate tenants on host computing systems, then security improves, but maintaining isolation when offloading to accelerators becomes problematic
Solution Approach 1:
The isolation model is extended from the host computing system dimension to the accelerator dimension by creating compute zones within the accelerator. Instead of relying solely on host-level virtualization, the patent introduces a second layer of isolation within the accelerator itself, organizing compute resources into distinct zones that map to individual tenants. This dimensional extension maintains isolation boundaries across the entire offloading path.
Data Source
AI summary
An accelerator includes a memory, a compute zone to receive an encrypted workload downloaded from a tenant application running in a virtual machine on a host computing system attached to the accelerator, and a processor subsystem to execute a cryptographic key exchange protocol with the tenant application to derive a session key for the compute zone and to program the session key into the compute zone. The compute zone is to decrypt the encrypted workload using the session key, receive an encrypted data stream from the tenant application, decrypt the encrypted data stream using the session key, and process the decrypted data stream by executing the workload to produce metadata.