Guest OS Data Encryption via Trusted Key Store and MMU
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In a multi-tenant cloud environment, there is a security concern as the host operating system may be able to read data belonging to a guest operating system, compromising trust and security due to shared processor resources.
Innovation Solution
An apparatus and method that utilize a trusted key store and encryption/decryption module to encrypt and decrypt data specific to the guest operating system, using a process identifier and encryption key stored in the trusted key store, ensuring only the guest operating system can access its own data, preventing unauthorized access by the host operating system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If the host operating system shares processor resources with guest operating systems, then resource utilization and productivity are improved, but security and data protection deteriorate because the host can inspect and read guest data
Solution Approach 1:
The system segments the memory address space into host address space and guest address space, with each having separate encryption key stores. The memory management unit (MMU) is divided into a host MMU and a guest MMU, allowing independent encryption/decryption operations for each address space without interfering with the other, thus enabling secure multi-tenant coexistence on shared processors
Solution Approach 2:
The patent introduces an intermediary encryption/decryption mechanism between the host and guest operating systems. The guest OS data is encrypted using guest-specific keys before being accessible to the host, and the MMU acts as an intermediary that automatically decrypts data when the guest OS needs access. This intermediary layer prevents the host from directly reading guest data while maintaining efficient resource sharing
2Reliability
If encryption is implemented for guest operating system data, then security is improved, but processing overhead and device complexity increase
Solution Approach 1:
The patent merges the encryption/decryption functionality directly into the memory management unit (MMU) and processor architecture. By integrating cryptographic operations into the existing memory management hardware, the system avoids adding separate encryption devices or software layers, thus reducing overall system complexity while maintaining strong security
Solution Approach 2:
The system implements self-service encryption where the MMU automatically performs encryption and decryption operations based on address space identification. The guest OS data is encrypted using guest-specific keys stored in the guest key store, and the MMU automatically decrypts data when accessed by the guest OS without requiring manual intervention or complex key management from the OS layer
3Reliability
If separate encryption keys are used for each guest operating system, then data isolation and security are improved, but key management complexity and memory overhead increase
Solution Approach 1:
The patent introduces a new dimension of security isolation by implementing separate encryption key stores for host and guest address spaces. Instead of managing keys in a flat structure, the system creates a hierarchical key management architecture where guest keys are stored in a dedicated guest key store, physically or logically separated from the host key store, enabling strong data isolation without proportionally increasing memory overhead
Data Source
AI summary
An apparatus includes one or more processor core, trusted key store, memory controller, and a memory module. The memory controller includes an encryption/decryption module that encrypts data being stored to the memory module for a guest OS being executed by the processor core(s) and that decrypts data being read from the memory module for the guest OS. Data owned by the guest OS is encrypted and decrypted by the encryption/decryption module using an encryption key stored by the trusted key store in association with the guest OS. A method encrypts data owned by the guest OS using the encryption key assigned to the guest OS and stores the encrypted data on a memory module, wherein the encrypted data is stored in association with the process identifier of the guest OS, and decrypts the encrypted data using the guest OS encryption key and provides the decrypted data to the guest OS.