Secure I/O Encryption Engine for Enclave-Accelerator Data Transfer
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current secure execution environments, such as Intel SGX, do not effectively protect data when it is transferred across the on-chip boundary to hardware accelerators, relying on software-based encryption and incurring performance penalties or relying on link encryption technologies, which have limitations.
Innovation Solution
Implementing multi-key total memory encryption (MKTME) and trusted domain extensions (TDXIO) to enable secure and transparent encryption and decryption of data between secure enclaves and accelerators, using shared encryption keys for memory transfers and bypassing software-based decryption, thereby protecting data integrity and performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If software-based encryption is used to protect I/O data across the on-chip boundary, then data security is improved, but processing performance deteriorates due to encryption/decryption overhead
Solution Approach 1:
The patent introduces a dedicated encryption engine as an intermediary component between the secure enclave and I/O devices. This engine handles all encryption and decryption operations for I/O data transfers, offloading this computationally intensive task from the main processor while ensuring data security. The encryption engine acts as a specialized mediator that protects data confidentiality without burdening the general-purpose CPU, thus resolving the contradiction between security and performance.
2Reliability
If link encryption technologies are used to protect data in transit, then data security is improved, but adaptability to different I/O operations deteriorates due to limitations of existing link encryption
Solution Approach 1:
The patent implements a universal encryption engine that can handle multiple types of I/O operations (memory-mapped I/O, direct memory access, interrupt operations) through a single standardized interface. This encryption engine is designed to work with various I/O devices and operation types without requiring device-specific encryption implementations, thus providing both security and adaptability. The engine can dynamically adjust to different I/O protocols and data formats while maintaining consistent security protection.
3Reliability
If I/O data is encrypted to leave the secure enclave, then data security is improved, but access speed deteriorates due to decryption requirements
Solution Approach 1:
The patent implements preliminary encryption of data before it leaves the secure enclave boundary. The encryption engine encrypts data in advance during I/O write operations, so that data is already protected when stored in I/O devices. For read operations, the engine uses pre-computed decryption keys and optimized decryption paths, reducing the time penalty. This preliminary action approach ensures data is secured before potential exposure while minimizing access speed impact through efficient key management and optimized cryptographic operations.
Data Source
AI summary
An apparatus comprises a hardware processor to perform an attestation procedure to attest a remote device, establish a session key for a communication session with the remote device, define a linear address (LA) region outside an established address range for a secure enclave, generate, for the linear address (LA) region, a unique encryption key accessible only to the enclave, assign a key identifier to the unique encryption key, store the linear address (LA) region and the unique encryption key in an enclave control structure, set a pending bit in the enclave control structure to a value to indicate that contents of the linear address region cannot be changed without approval from the secure enclave, clear the pending bit to indicate that the linear address range is available for use by the enclave, wrap the key identifier and the unique encryption key with the session key, and send the key identifier and the unique encryption key to the remote device.