Cloud Server Hardware Partitioning for Secure Resource Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud computing environments face inefficiencies and security vulnerabilities due to bare-metal cloud environments where customers are allocated entire servers with unused resources and VM environments that share resources and rely on hypervisors, which can be attack vectors.
Innovation Solution
A cloud computing system that statically partitions a cloud server's resources, using processor cores to manage partitions, DVM interposers to prevent unauthorized communication, and interrupt interposers to isolate interrupts, eliminating the need for hypervisors and ensuring secure resource allocation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If VM environments share resources and use hypervisors, then resource utilization is improved, but security vulnerabilities increase due to hypervisor attack vectors
Solution Approach 1:
The system segments processor cores into multiple isolated partitions using hardware-based partitioning. Each partition is assigned dedicated processor cores that cannot be accessed by other partitions, eliminating the shared resource model of virtualization while maintaining high resource utilization through efficient allocation. This hardware partitioning removes the hypervisor layer, thereby eliminating hypervisor-related security vulnerabilities.
Solution Approach 2:
The patent introduces interposer components as intermediaries between processor cores and other system resources. These interposers enforce partition boundaries and control access to shared resources, enabling secure multi-tenant isolation without requiring a hypervisor. The interposers act as hardware-enforced mediators that prevent unauthorized cross-partition access while allowing controlled resource sharing.
2Reliability
If bare-metal cloud environments allocate entire servers to customers, then security is improved through isolation, but resource waste increases due to unused allocated resources
Solution Approach 1:
The system divides a single physical server into multiple isolated hardware partitions, each behaving like a dedicated bare-metal server for a customer. This segmentation allows multiple customers to share one physical server while each customer receives guaranteed isolation and dedicated resource allocation within their partition, eliminating resource waste while maintaining bare-metal security characteristics.
Solution Approach 2:
The patent changes the fundamental parameter of resource allocation from all-or-nothing (entire server) to granular partitions. By adjusting partition size and configuration, the system can precisely allocate only the resources each customer needs, transforming the resource waste problem into an efficient allocation model while maintaining isolation through hardware boundaries.
3Reliability
If hardware partitioning is implemented with interposers, then security isolation is improved, but device complexity increases due to additional interposer components
Solution Approach 1:
The patent uses interposer components as hardware intermediaries that manage partition isolation and resource access control. These interposers are integrated into the processor fabric and provide automated enforcement of partition boundaries, reducing the need for complex software management layers. The hardware-based approach simplifies the overall system architecture compared to software virtualization while maintaining strong isolation guarantees.
Data Source
AI summary
A system for hardware partitions for a cloud server includes one or more processor cores. A first processor core executes instructions to partition at least a portion of the one or more processor cores into one or more partitions. The system includes one or more distributed virtual memory (DVM) interposers, each DVM interposer including a respective partition identifier that identifies a partition. Each DVM interposer, responsive to receiving a DVM message that includes a partition identifier that differs from the partition identifier of the DVM interposer, performs a preventative action. The system includes one or more interrupt interposers. Each interrupt interposer is associated with a processor core of the one or more processor cores. Each interrupt interposer prevents a first interrupt originating from the associated processor core from being provided to a processor core that is outside the partition of the associated processor core.