Selective Memory-Region Clearing for Shared Confidential Computing

Solution Overview

Problem

Existing shared computing environments face inefficiencies in maintaining data confidentiality due to the overhead of clearing memory regions when reassigned, which can compromise workload security and performance.

Innovation Solution

Implementing selective clearing of memory regions by tracking execution context metadata to only clear memory regions reassigned to new contexts, while allowing reuse by previous tenants without compromising confidentiality.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If memory regions are cleared before reassignment to maintain data confidentiality, then data security is improved, but system performance deteriorates due to increased overhead

Engineering Contradiction:

Improvedata confidentialityVSAvoidsystem performance

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The patent applies local quality by differentiating the treatment of memory regions based on their assignment history. Instead of uniformly clearing all memory regions, the system selectively clears only those reassigned to different execution contexts, while allowing reuse by previous tenants. This localized differentiation maintains security where needed while optimizing performance where reuse occurs.

Inventive Principle:

Principle #3Local quality

Solution Approach 2:

The patent implements dynamics by making the memory clearance policy adaptive rather than static. The system dynamically tracks execution context metadata and adjusts its behavior based on whether a memory region is being reassigned to a new context or reused by a previous tenant. This dynamic approach allows the system to respond to actual workload patterns and optimize performance while maintaining security.

Inventive Principle:

Principle #15Dynamics

2Reliability

If all memory regions are cleared upon reassignment, then data security is maintained, but memory management complexity increases

Engineering Contradiction:

Improvedata confidentialityVSAvoidmemory management complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent extracts the essential security requirement from the general memory management process. Instead of implementing a complex uniform clearance policy for all memory regions, the system extracts and applies clearance only to the subset of regions that pose a security risk (those reassigned to different contexts). This extraction simplifies the overall memory management complexity while maintaining necessary security.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent applies local quality by differentiating the treatment of memory regions based on their assignment history. Instead of uniformly clearing all memory regions, the system selectively clears only those reassigned to different execution contexts, while allowing reuse by previous tenants. This localized differentiation maintains security where needed while optimizing performance where reuse occurs.

Inventive Principle:

Principle #3Local quality

Data Source

PatentUS12417278B2Maintaining data confidentiality in shared computing environments

Publication Date: 2025.09.16 MELLANOX TECHNOLOGIES LTD(IL)

AI summary

The technology disclosed herein enables selective clearing of memory regions upon a context switch. An example method includes the operations of: receiving a memory access request referencing a memory region; determining an identifier of a current execution context associated with the memory region; determining an identifier of a previous execution context specified by metadata associated with the memory region; responsive to determining that the identifier of the current execution context does not match the identifier of the previous execution context, updating the metadata associated with the memory region to store the identifier of the current execution context; clearing at least a part of the memory region; and processing the memory access request with respect to the memory region.