Memory Encryption Bypass for Native-Performance Non-Confidential VMs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing virtualization systems impose performance overheads on non-confidential virtual machines due to default memory encryption, increasing the total cost of ownership for cloud service providers by requiring all memory to be encrypted, even for non-confidential workloads.
Innovation Solution
An architectural mechanism decouples memory encryption from cryptographic isolation solutions like TDX, allowing non-confidential virtual machines to run at native performance by enabling a bypass mode for memory encryption, using a TME capability model specific register and activation mechanism.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If memory encryption is enabled for all virtual machines, then security protection for confidential data is improved, but system performance deteriorates due to encryption overhead
Solution Approach 1:
The patent applies local quality by differentiating memory encryption treatment between confidential and non-confidential virtual machines. The hypervisor identifies which VMs require encryption based on their confidentiality requirements, enabling encryption only for confidential VMs while allowing non-confidential VMs to operate without encryption overhead, thus optimizing both security and performance
Solution Approach 2:
The patent segments the memory encryption functionality by introducing separate encryption contexts and key management for different VM types. The memory encryption engine is divided into independent encryption streams, allowing selective application of encryption to specific VMs based on their security requirements, resolving the contradiction between universal security and individual performance
2Adaptability or versatility
If memory encryption is enabled for non-confidential virtual machines, then uniform security policy is improved, but total cost of ownership increases due to unnecessary encryption overhead
Solution Approach 1:
The patent implements dynamic security policy adaptation where the hypervisor continuously assesses VM confidentiality requirements and adjusts encryption status accordingly. This dynamic approach allows the system to maintain uniform security policies for confidential VMs while automatically disabling encryption for non-confidential VMs, optimizing resource utilization and reducing unnecessary costs
Solution Approach 2:
The patent changes the encryption parameter state based on VM type classification. By modifying the encryption enable/disable parameter dynamically according to whether a VM is confidential or non-confidential, the system achieves uniform security policy enforcement where needed while eliminating wasteful encryption overhead in non-confidential contexts, thereby reducing total cost of ownership
Data Source
AI summary
A processor includes a first model specific register (MSR); and memory encryption circuitry to receive a request to access a memory, determine if a key identifier (ID) of the request is zero, and if the key ID is zero, to bypass data encryption when the request is to write data to the memory and to bypass memory decryption when the request is to read data from the memory and when a selected bit of the first MSR is set, and if the selected bit of the first MSR is not set, to encrypt write data when the request is to write data or decrypt data in a read response when the request is to read data, with a key associated with the key ID equal to zero.