Hardware Encryption Module for VM Memory Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional processor security mechanisms, such as hypervisors, are vulnerable to bugs and exploitation, allowing unauthorized access between virtual machines, and data stored in memory is susceptible to theft and unauthorized access, even in secure environments.
Innovation Solution
Implementing a hardware encryption module at the processor's memory controller to cryptographically isolate secure information by encrypting or decrypting data based on unique keys assigned to each virtual machine, ensuring that only authorized access can decipher the data, thereby protecting it from both internal and external threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a hypervisor is used to maintain isolation of VM information, then virtual machine isolation is achieved, but the system becomes vulnerable to exploitation through hypervisor bugs
Solution Approach 1:
The patent introduces an encryption module as an intermediary layer between the hypervisor and memory, which encrypts VM data before storage and decrypts it upon authorized access. This mediator protects against hypervisor exploitation by ensuring that even if the hypervisor is compromised, the encrypted data remains inaccessible without the proper decryption keys.
Solution Approach 2:
The patent changes the state of data from plaintext to encrypted form using cryptographic transformations. By applying encryption algorithms and transforming data parameters, the system ensures that VM information cannot be accessed or exploited even when stored in memory, fundamentally changing the security parameter from logical isolation to cryptographic protection.
2Productivity
If data is stored in memory modules for processing, then system operation is enabled, but data becomes susceptible to theft and unauthorized access
Solution Approach 1:
The patent applies encryption to data before it is stored in memory modules, performing the protective action in advance. The encryption module encrypts VM data prior to its placement in memory, ensuring that even if unauthorized access occurs during system operation, the stolen data remains encrypted and meaningless without the decryption keys.
Solution Approach 2:
The encryption module serves as an intermediary between the memory system and unauthorized access points. It transforms data into an protected state before memory storage and controls access through cryptographic verification, preventing direct theft or unauthorized access to data in memory while maintaining normal system operation.
3Reliability
If separate memory page tables are maintained for each VM, then VM isolation is achieved, but the hypervisor itself becomes vulnerable to exploitation
Solution Approach 1:
The encryption module acts as an intermediary that eliminates the need for complex hypervisor-managed isolation mechanisms. By encrypting data at the memory level with VM-specific keys, the system replaces the vulnerable hypervisor page table management with a simpler cryptographic layer that provides the same isolation function without the associated vulnerability risks.
Solution Approach 2:
The patent replaces the mechanical/software-based isolation mechanism (hypervisor page tables) with a cryptographic mechanism. Instead of relying on software-controlled memory management structures that can be exploited, the system uses mathematical encryption algorithms that provide provable security, substituting a vulnerable software system with a more secure cryptographic system.
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
A processor [102] employs a hardware encryption module [115] in the processor's memory access path to cryptographic ally isolate secure information. In some embodiments, the encryption module is located at a memory controller [110] (e.g. northbridge) of the processor, and each memory access provided to the memory controller indicates whether the access is a secure memory access, indicating the data associated with the memory access is designated for cryptographic protection, or a non-secure memory access. For secure memory accesses, the encryption module performs encryption (for write accesses) or decryption (for read accesses) of the data associated with the memory access.