Non-Canonical Address KeyID Encoding for Scalable Memory Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current Multi-Key Total Memory Encryption (MKTME) systems face a scaling issue due to limited space in page table entries, which restricts the number of cryptographic keys that can be specified, leading to performance and efficiency problems in multi-tenant computing environments.
Innovation Solution
The solution involves using non-canonical address bits in the linear address space to specify KeyIDs, allowing for a larger number of keys without modifying paging structures, and employing a KeyID remapping table to manage key ownership and isolation, enabling scalable memory encryption and integrity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If page table entry size is increased to accommodate KeyIDs, then the number of cryptographic keys that can be specified increases, but system software complexity and performance overhead increase significantly
Solution Approach 1:
The patent moves KeyID specification from the traditional page table entry dimension to the address space dimension. By utilizing unused bits in the linear address space (bits 48-63 in 64-bit addresses), the system can specify up to 64K different keys without modifying the structure or size of page table entries. This dimensional shift resolves the contradiction by providing key specification capability in a different architectural layer that does not impact paging software complexity.
2Adaptability or versatility
If physical address bits are increased to accommodate more keys, then the number of addressable memory locations increases, but the addressable memory space is reduced
Solution Approach 1:
The patent segments the 64-bit linear address space into two functional parts: the lower 48 bits continue to serve traditional memory addressing purposes, while the upper 16 bits (bits 48-63) are repurposed to carry KeyID information. This segmentation allows the system to simultaneously maintain full addressable memory space for data while embedding key identification information in the previously unused upper address bits, thus resolving the contradiction between key diversity and memory capacity.
3Adaptability or versatility
If additional cached metadata is introduced to support more keys, then the number of cryptographic keys increases, but cache resources are consumed
Solution Approach 1:
The patent enables the address space itself to carry the key identification information without requiring external caching structures. The linear address bits directly encode the KeyID, allowing the memory subsystem to retrieve key information from the address field itself rather than from separate cached metadata. This self-service approach eliminates the need for additional cache resources while supporting a large number of cryptographic keys.
Data Source
AI summary
In one embodiment, an apparatus includes a page miss handler to receive a full address including a linear address portion having a linear address and a key identifier portion having a key identifier for a key. The page miss handler may insert an entry including this key identifier in a translation storage. The apparatus further may include a remapping table having a plurality of entries each to store information regarding a key identifier. Other embodiments are described and claimed.