Trust Domain Lifecycle Using One-Time Keys for Memory Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern processing devices face vulnerabilities in protecting data in memory, particularly in cloud environments, as data in plaintext form is susceptible to attacks through techniques like bus and memory scanning, exposing sensitive information including encryption keys.
Innovation Solution
Implementing a Trust Domain (TD) architecture with Total Memory Encryption (TME) and Multi-Key TME (MK-TME) technologies, along with Trust Domain Extensions (TDX), which utilize encryption keys to secure memory pages and isolate tenant workloads from unauthorized access, even from privileged software.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If data is stored in plaintext in memory for easy access and processing, then processing speed and accessibility are improved, but security and vulnerability to attacks deteriorate
Solution Approach 1:
The patent divides memory into separate encrypted regions (first encrypted region for sensitive data, second encrypted region for other data) that can be independently accessed and protected. This segmentation allows the system to maintain encrypted protection while enabling selective access to specific data regions, thus improving both security and processing efficiency for non-sensitive data.
Solution Approach 2:
The patent applies different encryption key configurations to different memory regions. The first encrypted region uses a first encryption key while the second encrypted region uses a second encryption key, allowing locally optimized security and access characteristics for different types of data, thereby balancing security requirements with processing speed needs.
2Ease of operation
If cloud service providers have access to plaintext memory data for virtualization management, then service delivery and resource management are improved, but data confidentiality and trust deteriorate
Solution Approach 1:
The patent extracts sensitive data into a separate first encrypted region that is protected by a dedicated first encryption key, isolating it from the second encrypted region that cloud service providers can access. This extraction allows cloud providers to manage and access non-sensitive data while the sensitive data remains protected, thus maintaining both operational capability and confidentiality.
Solution Approach 2:
The patent introduces an intermediary decryption process where the first encrypted region can be selectively decrypted using the first encryption key when needed, acting as a mediator between the need for data access and the need for data protection. This allows controlled access while maintaining default confidentiality.
3Reliability
If encryption is applied to all memory data to protect confidentiality, then security is improved, but processing performance and energy consumption deteriorate
Solution Approach 1:
The patent segments memory into encrypted and non-encrypted regions, allowing processing operations to occur on non-encrypted data without the overhead of decryption/encryption, thus maintaining processing performance while still providing security for sensitive data through selective encryption of the first region.
Solution Approach 2:
The patent applies encryption selectively to specific memory regions based on their security requirements rather than uniformly to all memory, optimizing the balance between security and performance by encrypting only where necessary while leaving other regions accessible for high-performance processing.
Data Source
AI summary
A method of creating a trusted execution domain includes initializing, by a processing device executing a trust domain resource manager (TDRM), a trust domain control structure (TDCS) and a trust domain protected memory (TDPM) associated with a trust domain (TD). The method further includes generating a one-time cryptographic key, assigning the one-time cryptographic key to an available host key id (HKID) in a multi-key total memory encryption (MK-TME) engine, and storing the HKID in the TDCS. The method further includes associating a logical processor to the TD, adding a memory page from an address space of the logical processor to the TDPM, and transferring execution control to the logical processor to execute the TD.