Extended Page Table Key Switching for Cryptographic Thread Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing memory encryption technologies and virtualization technologies fail to provide efficient intra-process thread separation, allowing different parts of an application to access all memory, compromising security in Function as a Service (FaaS) environments.
Innovation Solution
Implementing cryptographic isolation between threads using extended page tables (EPTs) that assign unique key identifiers (IDs) to compartments within a shared process memory space, ensuring that private data remains protected while allowing selective data sharing at a sub-page granularity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If software threads share the same process space to enable best performance, then productivity is improved, but security deteriorates because different parts of the application can access all memory
Solution Approach 1:
The patent divides the process memory space into compartments, each with its own key identifier. Threads are assigned to specific compartments, allowing them to share process space while being restricted to accessing only their designated memory regions. This segmentation resolves the contradiction by enabling performance through sharing while maintaining security through isolation.
Solution Approach 2:
The patent applies different security properties to different regions of memory by assigning unique key identifiers to each compartment. Each compartment has its own encryption key, creating local security zones within the shared process space. This allows threads to access memory with appropriate security characteristics for their specific needs while maintaining overall system security.
2Reliability
If memory encryption technologies are used to provide thread separation, then security is improved, but device complexity increases
Solution Approach 1:
The patent uses extended page tables, which are an existing virtualization mechanism, to serve dual purposes: traditional address translation and cryptographic compartmentalization. By extending the functionality of existing page table structures to include key identifier storage and cryptographic operations, the system achieves security without adding entirely new complex infrastructure.
Solution Approach 2:
The patent introduces extended page tables as an intermediary layer between the thread and the physical memory. This intermediary structure handles the cryptographic operations and key management, shielding the complexity of memory encryption from both the threads and the underlying hardware while maintaining security.
3Reliability
If cryptographic isolation is implemented between threads, then security is improved, but loss of time increases due to key switching overhead
Solution Approach 1:
The patent pre-loads multiple key identifiers into the extended page table structures before they are needed. By having the key identifiers ready in the EPTs beforehand, the system minimizes the time required for key switching during thread transitions or memory access operations, reducing the overhead penalty of cryptographic isolation.
Solution Approach 2:
The patent implements dynamic key identifier management within the extended page tables, allowing keys to be switched and updated without requiring complete system reconfiguration. The EPTs can dynamically load appropriate key identifiers based on the current thread's compartment assignment, enabling efficient key management that adapts to runtime conditions and minimizes switching overhead.
Data Source
AI summary
Techniques disclosed include selecting a first key identifier (ID) for a first compartment of a compartmentalized process of a computing system, the first compartment including first private data; assigning a first extended page table (EPT) having at least one memory address including the first key ID; encrypting the first private data with a first key associated with the first key ID; and storing the encrypted first private data in a memory starting at the at least one memory address of the first EPT.