Confidential Compute With Direct Swap Caching And Per-VM Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing multi-tenant computing systems face inefficiencies in memory resource allocation and security challenges due to uneven usage by virtual machines, with additional physical links creating security vulnerabilities and latency issues in data encryption and decryption across memory paths.
Innovation Solution
Implement a confidential compute architecture integrating near and far memory systems with direct swap caching, using virtual trusted platform modules and advanced encryption standards to manage memory access and ensure data integrity and security through per-VM keys, while utilizing Compute Express Link-based encryption and integrity checks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If shared memory is separated by additional physical links and controllers from CPU, then memory resource allocation efficiency is improved, but security challenges increase for tenants
Solution Approach 1:
The memory system is segmented into near memory (integrated with CPU) and far memory (separated by physical links), with different security and performance characteristics. Each segment serves specific purposes: near memory for frequent access and far memory for capacity expansion, resolving the contradiction between efficiency and security by spatial segmentation
Solution Approach 2:
Different security measures are applied to different memory locations. Data in near memory uses per-tenant encryption keys for access, while far memory uses dedicated encryption keys specific to each tenant. This local quality approach allows optimized security for each memory region based on access patterns and security requirements
2Reliability
If data is encrypted and decrypted across memory paths, then security is improved, but latency increases
Solution Approach 1:
Encryption keys are pre-distributed to appropriate memory controllers and CPUs before data access operations. The system performs preliminary key establishment and caching, so that when encrypted data needs to be accessed, the decryption can proceed immediately without key negotiation delays, reducing latency while maintaining security
Solution Approach 2:
Memory controllers act as intermediaries that handle encryption and decryption operations transparently to the CPU. The controllers cache decrypted data locally and manage key distribution, absorbing the decryption latency burden and preventing it from directly impacting application performance
3Reliability
If per-VM keys are used for data encryption, then security isolation between virtual machines is improved, but device complexity increases
Solution Approach 1:
The memory controller is designed with multi-functionality to handle multiple encryption keys simultaneously, manage key distribution to different tenants, and perform encryption/decryption operations for various virtual machines. This universal design consolidates key management functions in a single component, reducing overall system complexity while maintaining strong security isolation
Solution Approach 2:
The system implements self-service key management where the memory controller automatically manages the distribution, storage, and usage of encryption keys for different tenants without requiring manual intervention. The controller autonomously handles key rotation, access control, and security policy enforcement, reducing operational complexity
Data Source
AI summary
Systems and methods for a confidential compute architecture integrated with direct swap caching are described. An example method for managing a near memory and a far memory includes, in response to determining that the far memory contains an encrypted version of a first block of data, retrieving from the far memory the encrypted version of the first block of data, decrypting the first block of data using a first key for exclusive use by a first virtual machine associated with the system, and providing a decrypted version of the first block of data to the requestor. The method further includes swapping out a second block of data having an address conflict with the first block of data from the near memory to the far memory, where the second block of data is encrypted using a second key for exclusive use by a second virtual machine associated with the system.