Encrypted VM Memory Deduplication via Shared Page Copies
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing memory deduplication techniques are hindered by encrypted virtual machines, as hypervisors cannot access the encrypted memory contents, preventing effective duplicate detection and reduction.
Innovation Solution
A decrypted copy of an encrypted memory page is stored in a shared memory accessible to the hypervisor, allowing deduplication processes to be performed, with the original page being removed from the encrypted memory, thereby reducing memory usage and improving system performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If memory is encrypted to protect virtual machine data, then security is improved, but the hypervisor cannot access memory contents to perform deduplication
Solution Approach 1:
A decryption module acts as an intermediary between the encrypted memory and the hypervisor. This module decrypts memory pages on-demand, allowing the hypervisor to access plaintext content for deduplication operations while the underlying memory remains encrypted for security. The intermediary enables both security and deduplication functionality to coexist.
2Productivity
If decrypted copies of memory pages are stored in shared memory for deduplication, then memory deduplication is enabled, but additional memory overhead is introduced
Solution Approach 1:
The patent merges the decrypted memory pages into a shared memory space that is accessible to multiple virtual machines. Instead of maintaining separate decrypted copies for each VM, the system consolidates them in a shared region, reducing overall memory overhead while enabling deduplication across VM boundaries.
Solution Approach 2:
The system implements a mechanism where decrypted memory pages are temporarily stored in shared memory only when needed for deduplication operations. After deduplication is complete, these temporary copies are discarded or recovered, preventing permanent memory overhead while still enabling the deduplication process to function.
Data Source
AI summary
Memory deduplication for encrypted virtual machines can be performed according to some examples. In one example, a virtual machine can select a target memory page stored in an encrypted memory of the virtual machine. The encrypted memory can be inaccessible to a hypervisor configured to manage the virtual machine. The virtual machine can store a copy of the target memory page to a shared memory that is accessible to the hypervisor. The hypervisor can then execute a deduplication process with respect to the copy of the target memory page stored in the shared memory. Subsequent to storing the copy of the target memory page to the shared memory, the virtual machine can remove the target memory page from the encrypted memory. The virtual machine can also prompt the hypervisor to reallocate the memory space of the encrypted memory that was previously used to store the target memory page.