Dual-Key Access Control for Secured Memory in Virtualized Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In virtualization environments, existing methods for sharing secured portions of memory devices among multiple abstracted resources face challenges such as de-synchronization of writes, increased risk of inter-VM attacks, and scalability issues due to limited memory device partitions, leading to compromised security and inefficient resource allocation.
Innovation Solution
A management entity is instantiated to provision unique VM secured portion access keys for each VM, using a dual-key authentication mechanism to verify and synchronize write requests, ensuring secure and synchronized access to memory device secured portions while reducing computing resource overhead.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If multiple abstracted resources share access to secured portions of memory devices, then resource utilization is improved, but write de-synchronization and security risks increase
Solution Approach 1:
A management entity is introduced as an intermediary between abstracted resources and secured memory portions. This entity receives write requests from multiple virtual machines, authenticates them using unique access keys, and coordinates the writes to prevent de-synchronization. The management entity acts as a central mediator that maintains write counters and ensures proper sequencing of write operations across multiple resources sharing the same secured memory portion.
2Reliability
If traditional authentication mechanisms are used for secured memory access, then security is maintained, but scalability is limited due to partition constraints
Solution Approach 1:
The authentication mechanism is segmented by assigning unique access keys to each virtual machine or abstracted resource. Instead of using a single shared authentication mechanism that requires separate memory partitions, the system divides the authentication space into multiple independent key pairs. This allows multiple resources to access the same secured memory portion simultaneously with proper authorization, greatly improving scalability while maintaining security through individual key validation.
3Ease of operation
If security management is distributed among multiple resources, then autonomy is improved, but system complexity and overhead increase
Solution Approach 1:
Security management functions are merged into a centralized management entity that handles authentication, authorization, and write coordination for all abstracted resources. This consolidation reduces the overall system complexity by eliminating redundant security management code in each resource and providing a single point of control. The management entity maintains write counters and coordinates access, simplifying the security model while still allowing resources to operate autonomously within their authorized boundaries.
Data Source
AI summary
Methods and systems for managing access to a memory device of a data processing system that is shared between a plurality of abstracted resources hosted on the data processing system are disclosed. A memory device may have a secured portion that one or more of the plurality of abstracted resources wish to write data into. A management entity hosted by the data processing system may facilitate access of each of the abstracted resources to the secured portion of the memory device. Various encryption mechanisms used to gain access to the secured portion may be stored and/or retrieved by the management entity from various sources. The management entity may also configure a write request sequence to ensure that all write requests to the secured portion received from the abstracted resources will be written into the secured portion.