Hypervisor-Based Resilient Memory Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in resiliently encrypting data across changing hardware configurations and efficiently backing up volatile memory data during power disruptions, while ensuring data integrity and quick restoration.
Innovation Solution
A method involving a hypervisor that manages address mapping and encryption keys to track memory module addresses independently, allowing for strong encryption without hardware configuration restrictions, and utilizing a node with a processor to decrypt data and store it on non-volatile storage for backup and restoration.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is encrypted using hardware-specific addresses, then encryption strength is improved, but hardware configuration changes cause decryption failures
Solution Approach 1:
The address space is segmented into virtual machine addresses, host addresses, and memory module addresses. The encryption system operates at the memory module address level while maintaining virtualization abstraction, allowing hardware changes without compromising encryption strength or adaptability.
Solution Approach 2:
The system dynamically tracks and updates memory module addresses through hypervisor-mediated lookups. When hardware configurations change, the address mapping tables are updated to reflect new memory module locations, enabling the system to adapt while maintaining encryption integrity through dynamic address resolution.
2Reliability
If volatile memory data is backed up during power disruptions, then data integrity is improved, but backup time and system overhead increase
Solution Approach 1:
The system performs preliminary actions by maintaining address mapping tables and encryption key associations in advance. During power disruptions, the backup process leverages pre-computed address mappings to quickly identify and backup only the necessary encrypted data blocks, reducing backup time while ensuring data integrity.
Solution Approach 2:
The system creates copies of encrypted data blocks to non-volatile storage based on address mapping information. The hypervisor generates copies of specific memory regions that need to be preserved, using the tracked address mappings to efficiently identify and copy only the necessary data without requiring full memory dumps.
3Adaptability or versatility
If address mapping tables are maintained independently of hardware, then adaptability to hardware changes is improved, but system complexity increases
Solution Approach 1:
The hypervisor serves as an intermediary layer between the encryption system and hardware components. It maintains address mapping tables that translate virtual machine addresses to physical memory module addresses, absorbing the complexity of hardware configuration management while presenting a simplified interface to the encryption/decryption operations.
Solution Approach 2:
The address mapping tables serve multiple functions: they enable encryption address resolution, support hardware configuration changes, facilitate backup operations, and provide a unified interface for both read and write operations. This multi-functionality reduces overall system complexity by consolidating multiple management responsibilities into a single universal mechanism.
Data Source
AI summary
A method for encrypting and decrypting data, that includes using an encryption key and an address associated with a memory device or a software instance. The method for encrypting and decrypting data may be performed by a hypervisor or by a configured processor. The method may include receiving a read or write request specifying an address; performing a first lookup, in an address mapping table, to identify a memory module address of a memory module associated with the address; performing a second lookup to identify an encryption key associated with the read or write request; generating a decryption or encryption request that includes the memory module address; and the encryption key; and sending the decryption or encryption request to the memory module.