On-Die Channel Controller for VM Memory Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In on-die computer apparatus, compromised virtual machines (VMs) can potentially expose all CPU cores to security breaches due to shared memory, even with secure memory techniques like SME, when multiple VMs operate on the same die.
Innovation Solution
An on-die computer apparatus with a data transfer channel controller that manages data transfer channels to isolate VMs by storing security information and channel information, allowing only secure VMs to access their designated channels, and using encryption/decryption components to secure data transfer between cores and RAM modules.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If multiple VMs share memory on the same die, then memory utilization efficiency is improved, but security between VMs deteriorates
Solution Approach 1:
The patent divides the shared memory system into separate data transfer channels, with each channel dedicated to specific VMs. This segmentation allows multiple VMs to access memory simultaneously through different channels while maintaining isolation, thus improving memory utilization efficiency without compromising security between VMs
Solution Approach 2:
The patent introduces a data transfer channel controller as an intermediary between VMs and memory. This controller manages and directs data transfer requests from multiple VMs through separate channels, enabling efficient memory access while preventing direct exposure of memory contents to compromised VMs, thereby maintaining both productivity and security
2Reliability
If secure memory techniques like SME are used, then memory security is improved, but vulnerability to channel compromise deteriorates
Solution Approach 1:
The patent segments the memory access paths into multiple separate data transfer channels, so that even if one channel is compromised, other channels remain secure. This segmentation limits the scope of potential security breaches while maintaining overall memory security through diverse access paths
Solution Approach 2:
The patent applies different security characteristics to different data transfer channels, with each channel being independently secured. This local quality approach ensures that security compromises in one channel do not propagate to other channels, thereby reducing vulnerability to channel compromise while maintaining memory security
3Reliability
If VMs are isolated using separate cores, then security between VMs is improved, but system complexity deteriorates
Solution Approach 1:
The patent makes each data transfer channel capable of serving multiple VMs through controlled access, rather than dedicating separate physical memory systems to each VM. This multi-functionality allows security isolation similar to separate cores while maintaining a more integrated and less complex system architecture
4Device complexity
If all VMs share the same memory channel, then device complexity is reduced, but security between VMs deteriorates
Solution Approach 1:
The patent divides the memory access infrastructure into multiple data transfer channels, each handling traffic from specific VMs. This segmentation provides security isolation between VMs while maintaining relatively simple channel structures that are easier to manage than fully distributed memory systems
Applied Scientific Principles
This section explains which scientific principles are used to turn an abstract innovation direction into a practical engineering solution.
Function Achieved in This Case
This solution effectively prevents a compromised VM from infecting other VMs by ensuring secure data transfer, enhancing security and isolating sensitive memory access, thereby protecting against breaches across multiple VMs on the same die.
Implementation Method 1
Each of the plurality of data transfer channels may be associated with a respective one of a plurality of encryption/decryption components, e.g. an AES encryption/decryption component. The channel controller may be further configured to store information indicating if data related to the read/write requests from each of the VMs is to be encrypted/decrypted by a said encryption/decryption component.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An on-die computer apparatus (100) comprises a plurality of cores (106) and a plurality of RAM modules (100). Sets of physical memory addresses in the RAM modules are allocated for use by virtual machines executing on the cores. A plurality of data transfer channels (112) are associated the RAM modules. The apparatus further comprises a channel controller (120) for controlling data transfer over the data transfer channels. The channel controller stores security information indicating which of the VMs is designated as secure, and channel information indicating which of the data transfer channels is assigned for use by each of the VMs for accessing its allocated physical memory addresses. The channel controller directs read/write requests from a VM over the data transfer channel assigned to the VM based on the security information and the channel information.