Realm Key ID Caching in Memory Encryption Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In virtualized computing environments, managing cryptographic keys for memory encryption is challenging due to resource constraints such as system bus bandwidth and physical chip area, particularly when dealing with a large number of virtual machines (VMs) that require unique cryptographic keys for secure data access and protection against unauthorized access.
Innovation Solution
A system and method that utilize a realm management unit with a key ID association table and a memory ownership table to associate realm IDs with physical addresses and cryptographic keys, enabling efficient memory transactions and caching of realm key IDs in a translation lookaside buffer for rapid access and secure operation of multiple virtual machines.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If cryptographic keys are stored in fast, small memory for rapid access, then access speed is improved, but physical chip area and cost increase
Solution Approach 1:
The patent divides the key storage system into two segments: a first memory (fast, small) for storing actively used cryptographic keys and a second memory (slower, larger) for storing inactive keys. This segmentation allows the system to achieve fast key access when needed while avoiding the cost of keeping all keys in fast memory, thus resolving the contradiction between access speed and chip area.
Solution Approach 2:
The system dynamically manages key storage by moving cryptographic keys between the first memory and second memory based on their active/inactive status. The realm management unit can transfer keys from the second memory to the first memory when they become active, and move them back when inactive. This dynamic allocation optimizes the use of fast memory resources while maintaining quick access to needed keys.
2Adaptability or versatility
If a large number of cryptographic keys are stored for multiple VMs, then security coverage is improved, but system bus bandwidth consumption increases
Solution Approach 1:
The patent extracts only the actively used cryptographic keys from the larger key set and places them in the first memory for rapid access. The realm management unit identifies which keys are currently needed by which realms and extracts those specific keys from the second memory, leaving the inactive keys behind. This extraction minimizes the number of keys that need to be accessed through the system bus, reducing bandwidth consumption while maintaining security coverage for all VMs.
3Productivity
If cryptographic keys are cached in fast memory, then access efficiency is improved, but physical chip area usage increases
Solution Approach 1:
The system applies partial action by caching only the subset of cryptographic keys that are currently active or frequently accessed in the first memory, rather than caching all possible keys. The realm management unit determines which keys should be cached based on current realm activity, maintaining high access efficiency for active keys while avoiding the excessive use of fast memory resources that would result from caching all keys.
Data Source
AI summary
A method, apparatus, and system for storing memory encryption realm key IDs is disclosed. A method comprises accessing a memory ownership table with a physical address to determine a realm ID associated with the physical address, accessing a key ID association structure with the realm ID to determine a realm key IS associated with the realm ID, and initiating a memory transaction based on the realm key ID. Once retrieved, the realm key ID may be stored in a translation lookaside buffer.