Virtualization-Based Intra-Block Workload Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computing systems, such as system-on-a-chip (SoC), face security issues due to intra-block workload interference, where untrusted or malicious workloads can disrupt other workloads executing on the same operational block, which is not effectively addressed by current access control mechanisms, especially in heterogeneous computing environments.
Innovation Solution
Implementing virtualization-based intra-block workload isolation using a virtual machine manager (VMM) to create secure sandboxes for workloads, ensuring isolation of code, data, and state information, and allowing secure execution and result handling within operational blocks, employing page-table based access controls and cryptographic verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If multiple workloads execute on the same operational block, then productivity is improved, but security and reliability deteriorate due to intra-block interference
Solution Approach 1:
The patent segments the operational block into multiple isolated execution contexts or sandboxes, each capable of running workloads independently. This segmentation prevents intra-block interference by ensuring that workloads in different contexts cannot access or interfere with each other's execution state, while still allowing the operational block to execute multiple workloads simultaneously for improved productivity.
2Reliability
If access control mechanisms are implemented, then security is improved, but they fail to address intra-block interference in heterogeneous computing
Solution Approach 1:
The patent introduces an intermediary mechanism (such as a virtual machine manager or security engine) that mediates between workloads executing on the operational block and the underlying hardware resources. This intermediary enforces isolation policies and prevents intra-block interference by controlling access to shared resources within the operational block, extending security beyond traditional inter-block access control.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Generally, this disclosure provides systems, devices, methods and computer readable media for virtualization-based intra-block workload isolation. The system may include a virtual machine manager (VMM) module to create a secure virtualization environment or sandbox. The system may also include a processor block to load data into a first region of the sandbox and to generate a workload package based on the data. The workload package is stored in a second region of the sandbox. The system may further include an operational block to fetch and execute instructions from the workload package.