Cryptographic Pointer Domain Isolation for Serverless Latency

The patent divides the memory address space into distinct domains using cryptographic encoding. Each domain has its own encrypted address space that is isolated from other domains, providing security similar to process-based isolation but without the overhead of full process contexts. This segmentation allows functions to be isolated securely while sharing the same process space, reducing invocation latency.

The patent replaces the mechanical process-based isolation mechanism with a cryptographic addressing system. Instead of using separate process contexts and memory spaces, the system uses encrypted pointers and domain-specific cryptographic keys to achieve isolation. This substitution eliminates the overhead of process creation and context switching while maintaining security boundaries.

The patent applies different security properties to different regions of the memory address space. Each domain has its own encrypted address space with domain-specific cryptographic keys, allowing shared memory regions to be accessed only by authorized domains. This local quality approach enables resource sharing while maintaining domain-specific security guarantees.

The patent introduces cryptographic encoding as an intermediary layer between domains and shared memory. The encrypted pointers act as mediators that control access to shared memory regions, ensuring that only domains with the appropriate cryptographic keys can access specific memory regions. This intermediary mechanism enables both resource sharing and security isolation.