Memory Encryption Engine Access Control via Source-Aware Fabric
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern computing systems face enhanced security threats, such as side channel attacks, which exploit cache loading and branch misprediction, necessitating advanced security mechanisms beyond traditional paradigms to protect memory access in multi-tenant data centers and single-user devices.
Innovation Solution
Implementing a centralized access control system using a memory encryption engine (MEE) with a source-aware fabric (SAF) that propagates source IDs along with memory access requests, enabling unified memory access policies and reducing hardware complexity and security bugs by leveraging existing standards-compliant buses and modifying PCIe controllers to extract and translate device IDs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If distributed access control is implemented at each device, then security coverage is improved, but hardware complexity and trusted compute base increase
Solution Approach 1:
The patent merges distributed access control functions into a centralized Memory Encryption Engine (MEE). Instead of implementing access control logic at each device, all access control decisions are centralized in the MEE, which receives memory access requests and determines whether to grant access based on source device IDs. This reduces hardware complexity and the trusted compute base while maintaining comprehensive security coverage.
Solution Approach 2:
The patent introduces a source-aware fabric as an intermediary that propagates source device IDs through the system interconnect to the MEE. This intermediary mechanism enables centralized access control without requiring direct integration of access control logic at each device, simplifying the overall system architecture while maintaining security.
2Device complexity
If centralized access control is implemented in MEE, then hardware complexity is reduced, but access control policy enforcement complexity increases
Solution Approach 1:
The patent implements preliminary action by having software programmably configure access control policies in the MEE before runtime. Device IDs that are permitted to access specific memory ranges are pre-configured in policy registers. This preliminary configuration simplifies runtime enforcement, as the MEE only needs to compare incoming source device IDs against the pre-configured policies without complex decision-making logic.
3Measurement precision
If device IDs are propagated through fabric, then access control accuracy is improved, but interconnect complexity increases
Solution Approach 1:
The patent implements universality by integrating source ID extraction and propagation capabilities into existing standard-compliant buses and PCIe controllers. Rather than creating a completely new interconnect mechanism, the source-aware fabric leverages existing infrastructure, adding source ID propagation functionality to components that already handle memory access requests. This minimizes interconnect complexity while enabling precise access control.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
There is disclosed in one example a computing system, including: a processor; a memory; and a memory encryption engine (MEE) including circuitry and logic to: allocate a protected isolated memory region (IMR); encrypt the protected IMR; set an access control policy to allow access to the IMR by a device identified by a device identifier; and upon receiving a memory access request directed to the IMR, enforce the access control policy.