Hardware Key ID Segmentation for Untrusted Software Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In cloud and server environments, untrusted software, such as virtual machine monitors (VMMs), have access to all encryption keys, compromising the security of sensitive data stored in memory by allowing access to secure domains, which is a challenge in maintaining data confidentiality.
Innovation Solution
Implementing a hardware-based solution where a processor includes a cryptographic engine and a memory controller that restricts access to restricted encryption keys by identifying key identifiers (IDs) within physical memory addresses, generating faults when untrusted software attempts to access these keys, and blocking access to prevent unauthorized use.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If untrusted software (VMM) is given access to all encryption keys to manage secure domains, then ease of operation and device functionality are improved, but security and data confidentiality are compromised
Solution Approach 1:
The patent segments encryption keys into two distinct categories: restricted keys and non-restricted keys. Restricted keys are stored in a protected memory region accessible only through specific secure instructions, while non-restricted keys are accessible to untrusted software. This segmentation allows the VMM to manage non-restricted keys for domain operations without compromising the security of restricted keys, thus resolving the contradiction between ease of operation and security.
2Productivity
If memory scanning techniques are used to retrieve data from memory, then productivity and data access speed are improved, but security and data confidentiality are compromised
Solution Approach 1:
The patent applies local quality by creating a specialized protected memory region with unique access characteristics. This region stores restricted encryption keys and is governed by specific security rules: only restricted instructions can access it, and unauthorized access attempts generate faults. This localized security mechanism allows normal memory scanning for non-restricted data while preventing scanning attacks on restricted keys, thus maintaining both productivity and security.
3Adaptability or versatility
If multiple customer workloads are supported simultaneously on the same server, then device versatility and resource utilization are improved, but security isolation and data confidentiality are compromised
Solution Approach 1:
The patent segments the key management system to support multiple workloads securely. Each workload can be assigned specific non-restricted keys for its operations, while a master restricted key remains protected from all untrusted software. This segmentation enables the server to handle multiple customer workloads simultaneously (improving versatility) while maintaining security isolation through the restricted key hierarchy that prevents any single workload from accessing other workloads' cryptographic material.
Data Source
AI summary
A processor includes a processor core. A register of the core is to store: a bit range for a number of address bits of physical memory addresses used for key identifiers (IDs), and a first key ID to identify a boundary between non-restricted key IDs and restricted key IDs of the key identifiers. A memory controller is to: determine, via access to bit range and the first key ID in the register, a key ID range of the restricted key IDs within the physical memory addresses; access a processor state that a first logical processor of the processor core executes in an untrusted domain mode; receive a memory transaction, from the first logical processor, including an address associated with a second key ID; and generate a fault in response to a determination that the second key ID is within a key ID range of the restricted key IDs.