Encrypted VM Migration via Memory Controller Key Exchange
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional virtual machine migration systems compromise security by transmitting memory pages in a decrypted state, which can be intercepted and accessed by third parties, and existing secure migration solutions using IPSec consume significant computing resources, impacting performance and Quality of Service (QoS).
Innovation Solution
The method involves transmitting encrypted memory pages from a first host system to a second host system via an unsecured channel while maintaining encryption, using secure communication channels only for cryptographic data items to derive and use the same cryptographic key for secure storage, thereby reducing data transmission over secure channels and improving performance and QoS.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If memory pages are transmitted in decrypted state during virtual machine migration, then migration speed is improved, but security is compromised as data can be intercepted by third parties
Solution Approach 1:
The patent segments the data transmission into two parts: encrypted memory pages transmitted over unsecured channels and cryptographic data items (keys) transmitted over secured channels. This allows the bulk data to move quickly without security overhead while maintaining security through the key protection mechanism.
Solution Approach 2:
The patent introduces a third-party secure communication channel as an intermediary for transmitting cryptographic data items. This mediator ensures that encryption keys are exchanged securely without requiring the entire memory page transmission to go through the secure channel, thus maintaining both speed and security.
2Reliability
If IPSec is used to secure memory page transmission during virtual machine migration, then data security is improved, but computing resources are consumed significantly impacting performance and Quality of Service
Solution Approach 1:
The patent extracts the encryption function from the data transmission process itself and places it in the memory controller. By using hardware-based encryption/decryption in the memory controller rather than software-based IPSec protocols, the computational burden is reduced and performance is maintained while security is preserved.
Solution Approach 2:
The patent replaces the software-based IPSec mechanical system with a hardware-based encryption mechanism in the memory controller. This substitution eliminates the need for complex software encryption/decryption operations during data transmission, significantly reducing CPU resource consumption and improving system performance.
3Reliability
If encryption keys are transmitted over secure communication channels, then data security is maintained, but communication overhead increases reducing migration efficiency
Solution Approach 1:
The patent applies partial action by securing only the essential cryptographic data items (keys) rather than the entire memory page data. This selective encryption approach ensures security where needed while minimizing the overhead of secure transmission for the bulk data, thus reducing migration time.
Solution Approach 2:
The patent changes the parameter of data classification by separating data into two categories: encrypted memory pages (bulk data) and unencrypted cryptographic data items (keys). This parameter change allows different transmission security levels for different data types, optimizing both security and migration efficiency.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A cryptographic data item utilized to derive a first cryptographic key employed by a first memory controller for implementing a first cryptographically protected execution environment for storing memory pages associated with a virtual machine may be received from a first host system via a first secure communication channel. The cryptographic data item may be transmitted to a second host system via a second secure communication channel for implementing a second cryptographically protected environment on the second host system. The first host system may be caused to migrate the memory pages of the virtual machine via an unsecured communication channel to the second host system for storing in the second cryptographically protected execution environment.