Page-to-Key Lookup Table for Multi-Tenant Memory Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Multi-key memory encryption in multi-tenant computing environments faces scalability issues due to complexities in identifying appropriate keys for memory access, leading to increased costs and performance degradation as more traditional enterprise workloads move to cloud computing environments.
Innovation Solution
The implementation of a page-to-key identifier lookup table and an encrypted compression technique that embeds key identifiers within data lines, allowing for efficient key lookup without reducing addressable memory space, and enabling software-based memory access control for virtual machine isolation and cloud security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If key identifiers are communicated using unused physical address bits, then key identification is enabled, but memory address space is reduced
Solution Approach 1:
The patent introduces a key selector/identifier as an intermediary component that manages key identification without consuming physical address bits. This mediator translates between memory addresses and key identifiers through lookup tables, enabling key selection while preserving the full memory address space for actual memory addressing.
2Adaptability or versatility
If additional address bits or metadata are added for key identification, then key identification capability is improved, but die area increases
Solution Approach 1:
The key selector/identifier is designed as a multi-functional component that handles key identification, key selection, and coordination with lookup tables. This universal component performs multiple functions within a single hardware structure, avoiding the need for separate dedicated circuits for each function and thereby reducing overall die area.
3Reliability
If traditional multi-key encryption is implemented with per-tenant keys, then cryptographic isolation is achieved, but system complexity increases
Solution Approach 1:
The patent segments the key management system into distinct components: key storage, key selector/identifier, and lookup tables. This segmentation allows each component to be optimized independently and simplifies the overall system architecture by dividing the complex key management functionality into manageable, modular units that can be implemented and maintained more easily.
4Speed
If key lookup tables are implemented for efficient key selection, then key access speed is improved, but cache resources are consumed
Solution Approach 1:
The lookup tables are implemented with local quality optimization by storing only the necessary key identifier mappings rather than complete key data. The system uses a hierarchical approach where frequently accessed key identifiers are cached locally in the key selector, while less frequently used mappings remain in the lookup tables, optimizing the balance between access speed and cache resource consumption.
Data Source
AI summary
In one embodiment, an apparatus comprises a processor to read a data line from memory in response to a read request from a VM. The data line comprises encrypted memory data. The apparatus also comprises a memory encryption circuit in the processor. The memory encryption circuit is to use an address of the read request to select an entry from a P2K table; obtain a key identifier from the selected entry of the P2K table; use the key identifier to select a key for the read request; and use the selected key to decrypt the encrypted memory data into decrypted memory data. The processor is further to make the decrypted memory data available to the VM. The P2K table comprises multiple entries, each comprising (a) a key identifier for a page of memory and (b) an encrypted address for that page of memory. Other embodiments are described and claimed.