Shared Memory Pages With ECC-Based Cryptographic Key Identification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face inefficiencies in managing memory resources protected by multiple cryptographic keys, particularly in virtual machine environments, where maintaining separate memory pools for each VM is inefficient and storing key selectors explicitly consumes valuable space and affects performance.
Innovation Solution
Implementing error correction (EC) data to implicitly store key selectors, allowing data encryption with multiple keys in a single memory page without explicit storage, using techniques like Reed-Solomon codes to identify the correct key during read operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If separate memory pools are maintained for each virtual machine, then cryptographic security is improved, but memory management efficiency deteriorates
Solution Approach 1:
The patent merges multiple VM-specific memory pools into a single shared memory pool, where memory pages are allocated to multiple VMs simultaneously. This consolidation eliminates the need for separate encrypted memory pools for each VM, improving memory management efficiency while maintaining security through per-page encryption key management.
Solution Approach 2:
The shared memory pool serves multiple VMs universally, allowing a single memory page to be accessed by multiple VMs with different cryptographic keys. The system implements multi-functionality by enabling the same physical memory resource to fulfill security requirements for multiple tenants through dynamic key assignment during read operations.
2Reliability
If key selectors are stored explicitly with encrypted data, then key identification reliability is improved, but memory space consumption deteriorates
Solution Approach 1:
The patent extracts the key identification function from explicit storage and relocates it to the error correction code (ECC) mechanism. Instead of storing key selectors alongside encrypted data, the system uses ECC syndrome values to implicitly identify the correct decryption key, eliminating the need for dedicated key selector storage space.
Solution Approach 2:
The error correction code acts as an intermediary between the encrypted data and the key identification process. The ECC data, originally intended for error detection and correction, serves as a mediator that encodes key identification information, allowing the system to retrieve the correct key without explicitly storing key selectors.
3Measurement precision
If explicit key selectors are stored with encrypted data, then key retrieval accuracy is improved, but system performance deteriorates
Solution Approach 1:
The patent removes the explicit key selector storage and retrieval process, replacing it with an implicit key identification mechanism based on error correction codes. This extraction eliminates the performance overhead associated with reading and processing explicit key selectors while maintaining accurate key retrieval through ECC-based identification.
Solution Approach 2:
The error correction code mechanism serves dual purposes: traditional error detection/correction and key identification. By making the ECC system self-service for key identification, the patent eliminates the need for separate key management processes, thereby improving system performance while maintaining key retrieval accuracy.
4Reliability
If duplicate physical pages are allocated for each VM, then memory isolation security is improved, but resource utilization efficiency deteriorates
Solution Approach 1:
The patent merges duplicate physical pages into a single shared memory page that serves multiple VMs. Instead of allocating separate physical pages for each VM, the system consolidates memory resources while maintaining logical isolation through cryptographic encryption with VM-specific keys, thereby improving resource utilization efficiency.
Solution Approach 2:
The system changes the isolation parameter from physical page separation to cryptographic key separation. By maintaining memory isolation through different encryption keys rather than through physical page duplication, the patent achieves both security and efficient resource utilization, allowing multiple VMs to share the same physical memory space.
Data Source
AI summary
Disclosed systems and techniques involve storage of encrypted data in memory pages that may include units stored with different cryptographic keys. Data may be stored with error correction data that implicitly encodes an identification of a key (key selector) without additional memory being allocated to explicit storage of the key selector. During data retrieval, the key selector is recovered from error correction data by processing multiple instances of extended data in which the data is combined with various possible key selectors.