Enclave Virtual Machine for Secure Workload Offloading

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional virtual machines often lack the necessary resources to execute specific workloads, leading to inefficient solutions that require customization and expose protected data when relying on external protocols for resource access.

Innovation Solution

The creation of an enclave virtual machine, initiated by a primary virtual machine, to provide additional capabilities not supported by the primary machine, allowing for secure execution of specialized tasks and offloading resource utilization, while maintaining secure data communication using the Smart Data Accelerator Interface (SDXI) protocol.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If conventional virtual machines are used to execute workloads, then device functionality is limited to what the VM is configured for, but adapting the system to enhance functionality increases device complexity

Engineering Contradiction:

Improvedevice functionalityVSAvoidsystem complexity

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The system segments functionality by creating specialized enclave virtual machines for specific workloads (e.g., ARM-based enclave VM for mobile app emulation on x86 host) rather than requiring the host VM to support all functionalities directly. This allows the host VM to remain simple while gaining access to specialized capabilities through isolated enclave instances.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The enclave virtual machine acts as an intermediary between the host virtual machine and the underlying hardware resources. The enclave VM provides a controlled interface that allows the host VM to access specialized functionalities (different CPU architectures, devices) without directly exposing the complexity of hardware emulation and resource management to the host VM.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Productivity

If external protocols are used for resource access, then resource utilization is enabled, but protected data is exposed

Engineering Contradiction:

Improveresource utilizationVSAvoiddata security

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The enclave virtual machine is nested within the host virtual machine environment, creating a hierarchical structure where the enclave VM provides an additional layer of isolation and security. Data and resources remain protected within the enclave's isolated memory space and execution environment, while still enabling resource access through controlled interfaces.

Inventive Principle:

Principle #7Nested doll (Nesting)

Solution Approach 2:

The enclave virtual machine implements localized security measures specific to its workload requirements, with isolated memory regions, dedicated device access, and customized security policies. Each enclave VM can have tailored security characteristics rather than relying on uniform external protocols, allowing secure data access patterns specific to each workload.

Inventive Principle:

Principle #3Local quality

Data Source

PatentUS20240256317A1Systems and methods for backend architecture provisioning and emulation

Publication Date: 2024.08.01 DELL PROD LP

AI summary

A method for executing a process in an enclave virtual machine, the method that includes receiving, by a primary virtual machine, a process request specifying a process, making a determination that the primary virtual machine is not configured to execute the process, and based on the determination, sending the process request to an enclave virtual machine, where the enclave virtual machine is configured to execute the process, and initiating execution of the process on the enclave virtual machine.