Secure Memory Page Swapping Using a Memory Encryption Engine
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing hardware-based trusted execution environment (TEE) solutions face inefficiencies in swapping out secure memory pages due to the need for lengthy software-based encryption and decryption processes during memory paging, which slow down the system.
Innovation Solution
Employing a memory encryption engine (MEE) to encrypt and decrypt data during the swapping process, allowing secure memory pages to be quickly swapped out by converting data to ciphertext on regular memory pages, thereby reusing the MEE for faster operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If software-based encryption and decryption processes are used during memory paging, then data security is maintained, but the swapping process becomes slow
Solution Approach 1:
The patent replaces software-based encryption/decryption processes with a hardware Memory Encryption Engine (MEE). The MEE is integrated into the memory subsystem and performs encryption/decryption operations at the hardware level during memory paging, eliminating the need for software-based cryptographic operations and significantly improving swapping speed while maintaining security.
Solution Approach 2:
The Memory Encryption Engine (MEE) acts as an intermediary component between the memory subsystem and the processing system. It intercepts memory access operations, performs encryption/decryption through hardware acceleration, and returns the processed data, thereby enabling fast swapping while preserving data security without involving complex software algorithms.
2Productivity
If secure memory pages are swapped out to non-secure memory area, then memory space utilization is improved, but the encryption/decryption process takes time
Solution Approach 1:
The MEE performs encryption operations in advance during the memory paging process itself, rather than requiring separate encryption steps after swapping. The encryption/decryption operations are overlapped with the physical memory relocation process, so that by the time data needs to be accessed, the cryptographic transformation is already complete, reducing overall time loss.
Solution Approach 2:
By substituting software-based cryptographic operations with hardware-accelerated encryption through the MEE, the patent reduces the time required for encryption/decryption operations. The hardware engine processes data at the memory bus speed, eliminating the bottleneck of software processing and significantly reducing the time loss associated with secure memory page swaps.
Data Source
AI summary
Memory page management is described. A to-be-swapped-out first memory page is determined from a secure memory area of a memory. A second memory page is determined from the memory, where the second memory page is located outside the secure memory area. Based on a physical address of the second memory page by using a memory encryption engine (MEE) of a processor, target data stored on the to-be-swapped-out first memory page is encrypted to obtain a target ciphertext. The target ciphertext is written on the second memory page. The to-be-swapped-out first memory page is released and the second memory page is locked, so that the target data is allowed to swap only from the second memory page into the secure memory area.