Protected Memory Segmentation for VM Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data processing systems face challenges in protecting memory contents from unauthorized access, particularly in cloud computing environments where virtual machines are vulnerable to attacks from compromised hypervisors, and existing solutions do not adequately address the need for secure storage and encryption of sensitive data.
Innovation Solution
A computer system and method that generates virtual-machine-specific encryption keys, stores them in a protected memory inaccessible to operating systems, and uses a crypto unit to encrypt and decrypt data, with a look-up table accessible only by firmware, ensuring secure access and protection of memory contents.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If memory is made accessible to operating systems and hypervisors for efficient data processing, then productivity and ease of operation are improved, but security and reliability deteriorate as the memory becomes vulnerable to unauthorized access and attacks
Solution Approach 1:
The memory is segmented into protected memory regions that are inaccessible to operating systems and hypervisors, and regular memory regions that remain accessible for normal operations. This segmentation allows the system to maintain both productivity and security by isolating sensitive data in protected regions while keeping functional memory accessible.
Solution Approach 2:
A crypto unit is introduced as an intermediary between the processor and memory, acting as a security gateway that encrypts and decrypts data access requests. This intermediary prevents direct access to protected memory regions by operating systems and hypervisors, ensuring security while allowing controlled access when needed for processing.
2Ease of operation
If encryption keys are stored in accessible memory for cryptographic operations, then ease of operation is improved, but security deteriorates as keys become vulnerable to snooping and unauthorized access
Solution Approach 1:
Encryption keys are extracted from general memory and stored in a dedicated protected memory region that is inaccessible to operating systems and hypervisors. The crypto unit retrieves keys from this protected storage only when needed for cryptographic operations, minimizing key exposure while maintaining operational ease.
Solution Approach 2:
The crypto unit serves as an intermediary that manages encryption keys in protected memory, handling all key access operations securely. This intermediary ensures that keys never暴露在 general memory where they could be snooped, while still enabling cryptographic operations to proceed smoothly.
3Adaptability or versatility
If hypervisor is given full access to memory management for virtual machine execution, then adaptability and productivity are improved, but reliability deteriorates as the hypervisor can snoop on confidential VM contents
Solution Approach 1:
Memory is segmented into VM-specific protected regions that are isolated from hypervisor access. Each virtual machine has its own protected memory space where confidential data is stored, preventing the hypervisor from snooping on VM contents while still allowing the hypervisor to manage VM execution and resource allocation.
Solution Approach 2:
The crypto unit acts as an intermediary between the hypervisor and protected memory regions, controlling all access to VM confidential data. This intermediary allows the hypervisor to manage virtual machines effectively while preventing direct snooping on encrypted VM contents, maintaining both adaptability and confidentiality.
Data Source
AI summary
A method includes generating a set of virtual-machine-specific (VMS) encryption keys for a dedicated virtual machine, storing the set of VMS encryption keys in a protected memory, storing a first look-up table in the protected memory, and replacing an encryption key stored in a crypto unit with at least one VMS encryption key of the set of VMS encryption keys in an operation mode where the dedicated virtual machine is executed by a processor. The protected memory is selectively excluded from access by operating systems executable on a computer system. The look-up table being accessible only by firmware of the computer system.