Random-Key Memory Deduplication for Secure Data Separation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing memory deduplication systems in virtualized computing environments expose sensitive data to vulnerabilities by failing to maintain proper separation of data from different sources, despite reducing unnecessary memory usage.
Innovation Solution
Implement a system that generates random keys for each user or entity, associates these keys with memory pages, and selectively deduplicates pages based on the associated keys to segregate data, preventing unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If memory deduplication is implemented to reduce memory usage, then memory efficiency is improved, but data security deteriorates due to inability to maintain proper separation of data from different sources
Solution Approach 1:
The patent segments memory pages by associating each page with a specific user key, creating key-based segments that prevent unauthorized access while allowing deduplication within each segment. This segmentation approach maintains data security boundaries while preserving memory efficiency benefits.
Solution Approach 2:
The patent applies local quality by treating pages differently based on their associated user keys. Pages with the same user key can be deduplicated, while pages with different user keys maintain separation. This local quality approach enables selective deduplication that respects data security requirements.
2Reliability
If random keys are generated and associated with each page to maintain data separation, then data security is improved, but device complexity increases due to additional key management overhead
Solution Approach 1:
The patent makes the user key serve multiple functions: it acts as both an authentication credential for data security and as a deduplication identifier for memory efficiency. This multi-functionality reduces the need for separate key management infrastructure, thereby limiting the increase in system complexity.
3Reliability
If selective deduplication based on user keys is implemented, then data security is maintained, but productivity decreases due to additional processing overhead for key verification
Solution Approach 1:
The patent performs key association with memory pages during the initial memory allocation or page creation phase, rather than verifying keys at every access operation. This preliminary action reduces the processing overhead during normal operations, as the key verification is essentially completed in advance when pages are created or allocated.
Data Source
AI summary
Systems, methods, and apparatuses for managing memory usage in virtualized computing environments are provided herein. An example method includes generating a random key, associating the key with a page or range of pages in a memory, and selectively deduplicating pages based upon the key associated with each respective page.