Intra-TEE Memory Isolation via Extended Page Tables
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for protecting memory in Trusted Execution Environments (TEEs) face challenges in reducing latency and overhead, particularly in function-as-a-service (FaaS) environments where multiple functions need to be isolated without compromising data integrity, leading to increased computing resources and complexity.
Innovation Solution
The implementation of a system that allows multiple functions to share a single Trusted Execution Environment (TEE) using separate extended page tables and encryption keys, enabling intra-TEE protection while minimizing the overhead of creating multiple TEEs, by using Secure Arbitration Mode (SEAM) and Multi-key Total Memory Encryption (MKTME) to isolate memory spaces and encrypt data securely.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple TEEs are created to isolate multiple functions, then data integrity and security are improved, but computing overhead and resource usage increase
Solution Approach 1:
The patent merges multiple TEEs into a single TEE by implementing intra-TEE isolation mechanisms. Multiple functions share the same TEE instance with unified encryption keys and memory encryption, eliminating the overhead of creating and managing multiple separate TEE instances while maintaining isolation through software-based memory management and access control within the shared TEE.
Solution Approach 2:
The patent makes a single TEE universal by enabling it to host multiple isolated functions simultaneously. The TEE is designed to provide multi-tenant isolation capabilities, allowing different functions to coexist in the same TEE with their own isolated memory spaces and access controls, thereby serving multiple security requirements with a single instance.
2Reliability
If multiple TEEs are created to isolate multiple functions, then memory isolation is improved, but memory usage and resource allocation complexity increase
Solution Approach 1:
The patent merges multiple memory spaces into a single encrypted memory region within the TEE. Instead of allocating separate encrypted memory regions for each TEE instance, the system uses a single encrypted memory space with software-enforced isolation boundaries, reducing total memory consumption while maintaining functional isolation between functions.
Solution Approach 2:
The patent segments the single TEE memory space into isolated regions for different functions using software-based memory management. Virtual memory addresses and page tables are used to create logical separation between function memory spaces, allowing efficient memory allocation and isolation without duplicating physical memory resources.
3Reliability
If separate encryption keys are used for each TEE, then security between functions is improved, but key management complexity and processing overhead increase
Solution Approach 1:
The patent merges multiple encryption keys into a single encryption key used by the shared TEE. All memory regions within the TEE are encrypted using the same key, and isolation between functions is achieved through software-based access controls rather than cryptographic separation, dramatically simplifying key management while maintaining security within the trusted boundary.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Example methods and systems are directed to isolating memory in trusted execution environments (TEEs). In function-as-a-service (FaaS) environments, a client makes use of a function executing within a TEE on a FaaS server. To minimize the trusted code base (TCB) for each function, each function may be placed in a separate TEE. However, this causes the overhead of creating a TEE to be incurred for each function. As discussed herein, multiple functions may be placed in a single TEE without compromising the data integrity of each function. For example, by using a different extended page table (EPT) for each function, the virtual address spaces of the functions are kept separate and map to different, non-overlapping physical address spaces. Partial overlap may be permitted to allow functions to share some data while protecting other data. Memory for each function may be encrypted using a different encryption key.