Shared Memory Inter-Enclave Communication via Cryptography Coprocessor
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing inter-enclave communication methods in containerized environments rely on network protocols, leading to significant overhead and performance degradation due to the use of network stacks, which impedes efficient data sharing between enclaves.
Innovation Solution
Implementing a memory cryptography coprocessor to generate and securely exchange shared memory key data between enclaves, enabling direct secure access to shared memory regions using asymmetric or symmetric encryption techniques, thereby bypassing network communication bottlenecks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If network protocols are used for inter-enclave communication, then security is maintained through enclave isolation, but communication overhead increases and performance degrades
Solution Approach 1:
A shared memory region acts as an intermediary between enclaves, allowing direct memory access while a cryptography coprocessor serves as a mediator for secure key management. This eliminates the need for network protocol mediation while maintaining security through cryptographic protection of the shared memory access mechanisms.
Solution Approach 2:
The communication overhead of network stacks is extracted and removed from the inter-enclave communication path. By using direct shared memory access, the patent eliminates the intermediate network protocol processing layers that cause performance degradation, while security is maintained through enclave isolation boundaries.
2Productivity
If shared memory is used for inter-enclave communication, then communication efficiency improves, but security risks increase due to potential unauthorized access
Solution Approach 1:
A cryptography coprocessor is introduced as a security intermediary that manages cryptographic keys and authentication for shared memory access. This coprocessor verifies enclave identities and manages access permissions, ensuring that only authorized enclaves can access the shared memory region while maintaining high communication efficiency.
Solution Approach 2:
The patent changes the security parameters by using cryptographic key pairs (public and private keys) associated with each enclave. Instead of traditional access control mechanisms, the system uses cryptographic verification where enclaves prove their identity through digital signatures, transforming the security model to enable efficient yet secure shared memory access.
3Reliability
If cryptographic key exchange is implemented for shared memory access, then security is enhanced, but system complexity increases
Solution Approach 1:
Each enclave generates and manages its own cryptographic key pair, with the private key remaining within the enclave and the public key being shared. The cryptography coprocessor automatically handles key verification and authentication processes, making the system self-sufficient in managing security without requiring complex external key management infrastructure.
Solution Approach 2:
The cryptography coprocessor serves multiple functions: it manages cryptographic key generation, verifies digital signatures from enclaves, controls shared memory access permissions, and authenticates communication parties. This multi-functional approach consolidates security operations into a single component, reducing overall system complexity while maintaining robust security.
Data Source
AI summary
Disclosed embodiments provide techniques for inter-enclave communication through shared memory. Enclaves (containers) operate in a protected memory space that inhibits the use of shared memory. Disclosed embodiments enable enclaves to use shared memory, eliminating the communication bottlenecks associated with networking. A memory cryptography coprocessor implemented in hardware generates shared memory key data for a shared memory region that is to be used by two or more enclaves. The shared memory key data is sent to the enclaves that require a shared memory interface. The enclaves access the shared memory securely utilizing the shared memory key data. The memory cryptography coprocessor facilitates shared memory key generation and exchange. The memory cryptography coprocessor data is not directly accessible by the processes executing on the main processor. This enables secure cloud hosting on untrusted environments, since the hosting entity cannot directly access the internal data of the memory cryptography coprocessor.