Trust Anchor VM Memory Encryption Cloud Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cloud computing and Infrastructure as a Service (IaaS) providers face challenges in ensuring the trusted execution of virtual machines (VMs) due to the lack of strong mechanisms for effective separation between VMs sharing the same CPU, leading to security concerns and potential data leakage, even with hypervisor-enforced separation.
Innovation Solution
A method and apparatus that utilize a trust anchor on a multi-core CPU to manage encryption keys for secure memory compartmentalization, ensuring that each VM's memory is encrypted and isolated from others, even when sharing a common cache, by using an encrypt/decrypt block between the processing core and cache, and swapping keys during context switches to maintain confidentiality.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If multiple VMs are collocated in the same server to maximize resource utilization, then productivity and resource efficiency are improved, but security and data isolation are worsened due to potential side attacks and cache-based information leakage
Solution Approach 1:
The patent segments the shared cache into isolated regions for each VM using cache tags that encode VM identifiers. This allows multiple VMs to concurrently utilize the same physical cache resources while maintaining logical separation through tag-based addressing, thereby resolving the contradiction between resource sharing and security isolation
Solution Approach 2:
The patent introduces a cache management intermediary layer that intercepts and modifies cache access requests. This intermediary validates VM identifiers, manages cache tag assignments, and prevents unauthorized access to other VMs' cache regions, enabling secure multi-tenancy without sacrificing resource utilization
2Speed
If VMs share access to common cache memory to improve performance, then speed and efficiency are improved, but security is worsened due to potential information leakage between VMs
Solution Approach 1:
The patent applies local quality by making each cache line's accessibility VM-specific through encoded tags. Each VM can only access cache lines tagged with its own identifier, creating locally secure access patterns within the shared cache structure while maintaining high-speed access for authorized operations
Solution Approach 2:
The patent changes the parameter of cache address tagging to include VM identifiers. This parameter modification enables the cache to distinguish between different VMs' access requests and enforce isolation policies, preventing information leakage while preserving fast cache access for legitimate operations
3Reliability
If hypervisor-enforced separation is used to isolate VMs, then security is improved, but device complexity increases due to additional management overhead
Solution Approach 1:
The patent implements self-service by embedding VM identification directly in cache tags, enabling the cache hardware itself to enforce isolation policies. This shifts the isolation enforcement burden from the hypervisor to the cache structure, reducing hypervisor complexity while maintaining security
Solution Approach 2:
The patent replaces the mechanical/software-based hypervisor isolation mechanism with a hardware-based cache tagging system. This substitution leverages the cache's existing tag comparison logic to enforce VM separation, reducing the computational overhead and complexity on the hypervisor
Data Source
Figure 1A~1B
Figure 2
Figure 3
AI summary
The present disclosure presents a method and apparatus configured to provide for the trusted execution of virtual machines (VMs) on a virtualization server, e.g., for executing VMs on a virtualization server provided within Infrastructure as a Service (IaaS) cloud environment. A physical multi-core CPU may be configured with a hardware trust anchor. The trust anchor itself may be configured to manage session keys used to encrypt/decrypt instructions and data when a VM (or hypervisor) is executed on one of the CPU cores. When a context switch occurs due to an exception, the trust anchor swaps the session key used to encrypt/decrypt the contents of memory and cache allocated to a VM (or hypervisor).