SV-PUF Instructions for Secure Memory Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional systems for providing isolation in virtualized environments do not effectively exclude cloud service provider (CSP) software from the tenant's trusted computing base (TCB) and often increase the TCB significantly, failing to provide secure isolation between customer workloads and CSP software.
Innovation Solution
The implementation of a Trusted Domain (TD) architecture with Software-Visible Physical Unclonable Function (SV-PUF) instructions that generate platform-unique encryption keys, enabling secure memory encryption and integrity protection, and reducing the TCB by isolating customer workloads using Trust Domain Extensions (TDX) and Secure Extended Page Tables (SEPT).
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional isolation systems are used in virtualized environments, then isolation between workloads is provided, but the trusted computing base (TCB) is significantly increased and CSP software cannot be effectively excluded from the tenant's TCB
Solution Approach 1:
The patent extracts the cryptographic key generation and memory encryption functions from the general virtualization management (CSP software) and assigns them to dedicated hardware structures (seamless PUF and memory encryption engine). This extraction removes these critical security functions from the TCB, allowing CSP software to be excluded while maintaining isolation security.
Solution Approach 2:
The patent introduces a seamless Physical Unclonable Function (PUF) as an intermediary hardware component that generates cryptographic keys independently of the CSP software. This intermediary structure mediates between the tenant workload and the encryption/decryption operations, providing isolation security without requiring CSP software to be part of the TCB.
2Reliability
If memory encryption is implemented using conventional methods, then data confidentiality is provided, but the encryption key may be accessible to CSP software increasing security risks
Solution Approach 1:
The patent extracts the encryption key from the CSP software environment and stores it in a dedicated PUF structure that is inaccessible to software. The key is extracted from physical manufacturing variations and held in hardware-only, preventing CSP software from accessing it while maintaining data confidentiality through the memory encryption engine.
Solution Approach 2:
The PUF structure provides self-service by automatically generating and managing the encryption key based on physical characteristics of the hardware. The key is generated on-demand through challenge-response protocols without requiring software intervention or storage, making it inaccessible to CSP software while enabling memory encryption.
3Adaptability or versatility
If platform-unique cryptographic keys are generated using physical variations, then unclonable keys are produced, but the keys must be protected from extraction and misuse
Solution Approach 1:
The patent extracts the cryptographic key from the PUF structure only when needed for encryption operations, and immediately re-encrypts it or returns it to an unusable state. The key is extracted transiently through challenge-response protocols and never stored in accessible memory, preventing extraction while maintaining platform-unique key generation capability.
Solution Approach 2:
The patent implements beforehand cushioning by designing the PUF structure and key management system to prevent key extraction before it can occur. The hardware architecture inherently protects the key through challenge-response protocols and controlled access paths, cushioning against potential extraction attacks before they can compromise the system.
Data Source
Figure 1
Figure 2(A)
Figure 2(B)~2(C)
AI summary
Techniques for encrypting data using a key generated by a physical unclonable function (PUF) are described. An apparatus according to the present disclosure may include decoder circuitry to decode an instruction and generate a decoded instruction. The decoded instruction includes operands and an opcode. The opcode indicates that execution circuitry is to encrypt data using a key generated by a PUF. The apparatus may further include execution circuitry to execute the decoded instruction according to the opcode to encrypt the data to generate encrypted data using the key generated by the PUF.