Hardware Encryption Module for DMA Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing processor systems face vulnerabilities in information security, particularly in multi-VM environments where hypervisor flaws can lead to unauthorized access between virtual machines, and in physically insecure environments where data can be subject to theft or unauthorized access through direct memory access (DMA) requests.
Innovation Solution
Implementing a hardware encryption module at the memory controller that uses unique encryption keys for each virtual machine or virtual function, managed by a security module separate from processor cores, to cryptographically isolate secure information by identifying the source of memory access requests and employing Advanced Encryption Standard (AES) encryption and decryption techniques.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If separate memory page tables are maintained for each VM to ensure isolation, then information security between VMs is improved, but the hypervisor itself becomes vulnerable to exploitation due to software flaws
Solution Approach 1:
The patent introduces an encryption module as an intermediary component between the hypervisor and memory. This module acts as a mediator that handles encryption/decryption operations, allowing the hypervisor to maintain isolation through page tables while the encryption module provides an additional security layer that is independent of hypervisor software integrity. The encryption module receives memory access requests, determines the target VM, and applies the appropriate encryption key, thereby preventing direct exploitation of hypervisor flaws.
Solution Approach 2:
The patent segments the security functionality by separating the encryption module from the hypervisor. Instead of relying solely on the hypervisor for security management, the system divides security responsibilities: the hypervisor handles VM scheduling and page table management, while the dedicated encryption module handles cryptographic operations. This segmentation ensures that flaws in the hypervisor do not directly compromise the encryption mechanism.
2Productivity
If DMA access is allowed from devices to memory for high-speed data transfer, then productivity is improved, but unauthorized entities can access secure memory spaces through unauthorized DMA requests
Solution Approach 1:
The encryption module serves as an intermediary in the DMA path between devices and memory. When a DMA request arrives, the encryption module intercepts it, determines the target VM based on the requestor ID, and applies the appropriate encryption key before allowing access to the encrypted memory region. This maintains high-speed DMA transfer capability while preventing unauthorized access, as devices can only access memory regions encrypted with keys they are authorized to use.
Solution Approach 2:
The patent applies different encryption keys to different memory regions corresponding to different VMs. Each VM's memory space is encrypted with a unique key, and the encryption module selects the appropriate key based on the target VM identified from the DMA requestor ID. This local quality approach ensures that even if one VM's memory is accessed, other VMs' data remains protected by different encryption keys.
3Ease of operation
If encryption keys are managed by software for flexibility, then ease of operation is improved, but security is compromised due to software vulnerabilities
Solution Approach 1:
The encryption module acts as an intermediary that manages encryption keys in hardware rather than in software. The module contains key storage and key selection logic that operates independently of the hypervisor and operating system software. This hardware-based key management provides flexibility in key selection (based on requestor ID and target VM) while eliminating software vulnerabilities that could compromise key security.
Solution Approach 2:
The patent replaces software-based key management with a hardware-based encryption module. Instead of using software routines to manage encryption keys, the system uses dedicated hardware circuitry that performs key storage, key selection, and cryptographic operations. This substitution provides the flexibility needed for VM-specific key management while achieving security levels that software alone cannot provide.
Data Source
AI summary
A processor employs a hardware encryption module in the memory access path between an input/out device and memory to cryptographically isolate secure information. In some embodiments, the encryption module is located at a memory controller of the processor, and each memory access request provided to the memory controller includes VM tag value identifying the source of the memory access request. The VM tag is determined based on a requestor ID identifying the source of the memory access request. The encryption module performs encryption (for write accesses) or decryption (for read accesses) of the data associated with the memory access based on an encryption key associated with the VM tag.