Cloud Server Hardware Partitions Using DVM Hubs and Interrupt Interposers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud computing environments face inefficiencies in resource allocation and security vulnerabilities due to bare-metal and VM cloud environments, where customers are allocated unused resources and exposed to hypervisor-based attacks.
Innovation Solution
A cloud computing system that statically partitions a cloud server's resources, using a management core to partition processor cores and employ DVM hubs and interrupt interposers to ensure secure, efficient use of resources without a hypervisor, preventing inter-core communication across partitions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If virtualization (VM) is used to allocate resources, then resource flexibility and utilization are improved, but security vulnerabilities increase due to hypervisor-based attacks
Solution Approach 1:
The system segments processor cores into isolated partitions using hardware-based partitioning. Each partition is assigned to specific customers and operates independently without a shared hypervisor, eliminating hypervisor-based attack vectors while maintaining resource allocation flexibility through configurable partition boundaries.
Solution Approach 2:
The patent introduces dedicated hardware components (DVM hubs and interrupt interposers) as intermediaries between processor cores. These components enforce partition boundaries and control inter-partition communication, providing secure resource sharing without requiring a vulnerable hypervisor layer.
2Reliability
If bare-metal environment is used to dedicate resources, then security is improved, but resource utilization efficiency deteriorates due to unused allocated resources
Solution Approach 1:
The system divides processor cores into multiple isolated partitions, allowing different customers to access different partitions. This enables secure multi-tenancy where resources are dedicated to each customer (maintaining security) while the overall system can dynamically allocate partitions to different customers based on demand (improving utilization efficiency).
Solution Approach 2:
The hardware partitioning system provides universal access control mechanisms that allow the same physical infrastructure to serve multiple customers securely. The DVM hubs and interrupt interposers enable a single system to function as multiple isolated environments, achieving both security isolation and resource sharing.
3Reliability
If hardware partitioning is implemented to prevent inter-core communication, then security is improved, but device complexity increases due to additional components
Solution Approach 1:
The patent uses specialized hardware components (DVM hubs and interrupt interposers) as intermediaries to manage communication between processor cores. These components centralize the security enforcement logic, allowing complex partition isolation requirements to be handled by dedicated components rather than complicating the core processor architecture.
Solution Approach 2:
The hardware partitioning system implements self-service mechanisms where the DVM hubs and interrupt interposers automatically enforce partition boundaries without requiring external management. The system autonomously routes messages and interrupts according to partition configuration, reducing the operational complexity despite the added hardware components.
Data Source
AI summary
A system comprises one or more processor cores, including a management processor core that executes instructions to partition at least a portion of the one or more processor cores into one or more partitions. The system includes at least one distributed virtual memory (DVM) hub that obtains a first DVM message from a processor core; determines, based on a processor core identifier of the DVM message, one or more recipient processor cores for the first DVM message; and provides the first DVM message to the one or more recipient processor cores. The system includes one or more interrupt interposers that are each associated with a processor core and prevent an interrupt originating from the associated processor core from being provided to a processor core that is outside the partition of the associated processor core.