Secure Enclaves for Trusted Packet Processing in Accelerators
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cloud-hosted services face security challenges in ensuring the confidentiality and integrity of user applications, particularly in virtualized server environments where privileged malware can inspect or corrupt application data, and existing solutions lack effective mechanisms to protect against software and hardware attacks on DRAM memory.
Innovation Solution
The implementation of Intel Software Guard Extensions (SGX) creates secure enclaves within the application's address space, using memory encryption and access controls to prevent external software access, ensuring confidentiality and integrity of application data, and extends this protection to programmable and fixed-function accelerators by carving out memory regions accessible only by secure enclaves.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If virtualization is used to improve server utilization and flexibility, then resource efficiency is improved, but security against privileged malware deteriorates
Solution Approach 1:
The patent segments the memory space into secure enclaves and non-secure regions. The secure enclave contains only the essential packet processing code and data that requires protection, while other application code and data reside outside the enclave. This segmentation allows the system to maintain virtualization for resource efficiency while isolating critical security functions from privileged malware attacks.
Solution Approach 2:
The patent introduces a trusted execution environment (secure enclave) as an intermediary layer between the virtualized application and the underlying hardware resources. This enclave acts as a mediator that protects sensitive packet processing operations from both software attacks and hardware attacks, while still allowing controlled access to memory regions for accelerators through cryptographic protection.
2Productivity
If memory is made accessible to accelerators for performance improvement, then processing speed is improved, but security against unauthorized access deteriorates
Solution Approach 1:
The patent applies local quality by providing different access permissions to different memory regions. The secure enclave memory region has restricted access permissions that allow only specific accelerators to access specific data structures (input queues, output queues, packet buffers) through controlled interfaces, while preventing access to other sensitive areas. This enables performance optimization through accelerator access while maintaining security through localized protection.
3Reliability
If secure enclaves are created to protect application data, then security is improved, but device complexity increases
Solution Approach 1:
The patent extracts only the essential security-critical components (packet processing code and data) into the secure enclave, while leaving the rest of the application outside. This minimizes the enclave size and complexity while maximizing security protection for the most critical functions. The enclave contains only what is necessary for secure packet processing, reducing the overall system complexity compared to protecting the entire application.
Data Source
AI summary
Methods and apparatus for extending packet processing to trusted programmable and fixed-function accelerators. Secure enclaves are created in system memory of a compute platform, wherein software code external from a secure enclave cannot access code or data within a secure enclave, and software code in a secure enclave can access code and data both within the secure enclave and external to the secure enclave. Software code for implementing packet processing operations is installed in the secure enclaves. The compute platform further includes one or more hardware-based accelerators that are used by the software to offload packet processing operations. The accelerators are configured to read packet data from input queues, process the data, and output processed data to output queues, wherein the input and output queues are located in encrypted portions of memory that may be in a secure enclave or external to the secure enclaves. Tokens are used by accelerators to validate access to memory in secure enclaves, and used by both accelerators and secure enclaves to access encrypted memory external to secure enclaves.