Compressive Encryption Memory Isolation for Virtual Machine Replay Prevention

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In shared cloud environments, virtual machines' memory is vulnerable to unauthorized access and replay by privileged entities despite existing encryption techniques, lacking robust memory isolation and access control.

Innovation Solution

Implementing compressive encryption that combines data compression with encryption, using compression indicators and encryption metadata to secure memory access, ensuring only authorized entities can read and write data, thereby preventing unauthorized memory replay.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If memory encryption is applied to secure VM memory, then access security is improved, but memory replay by privileged entities remains possible

Engineering Contradiction:

Improvememory access securityVSAvoidmemory replay vulnerability

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent segments the memory access control into multiple independent components: encryption keys for confidentiality, compression indicators for integrity, and version numbers for replay prevention. Each component addresses a specific security aspect, and together they provide comprehensive protection against both unauthorized access and memory replay by privileged entities.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent creates a composite security mechanism that combines encryption, compression, and versioning into a unified memory protection system. This composite approach integrates multiple security functions (confidentiality through encryption, integrity through compression indicators, and replay prevention through version numbers) into a single coherent system that addresses the limitations of encryption alone.

Inventive Principle:

Principle #40Composite materials

2Reliability

If additional data variables are stored in separate locations for authentication, then access control is improved, but system complexity increases

Engineering Contradiction:

Improveaccess authenticationVSAvoidmemory structure complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent merges the authentication data variables (version numbers, compression indicators, encryption metadata) directly into the memory structure itself rather than storing them in separate locations. This integration allows the memory to carry its own authentication information, eliminating the need for separate authentication tables or structures and thereby reducing overall system complexity while maintaining strong access control.

Inventive Principle:

Principle #5Merging (Combining)

Data Source

PatentUS12386651B2Technologies for memory replay prevention using compressive encryption

Publication Date: 2025.08.12 INTEL CORP

AI summary

Systems and methods for memory isolation are provided. The methods include receiving a request to write a data line to a physical memory address, where the physical memory address includes a key identifier, selecting an encryption key from a key table based on the key identifier of the physical memory address, determining whether the data line is compressible, compressing the data line to generate a compressed line in response to determining that the data line is compressible, where the compressed line includes compression metadata and compressed data, adding encryption metadata to the compressed line, where the encryption metadata is indicative of the encryption key, encrypting a part of the compressed line with the encryption key to generate an encrypted line in response to adding the encryption metadata, and writing the encrypted line to a memory device at the physical memory address. Other embodiments are described and claimed.