Virtual Channel Secure Data Movement in NFV
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In Network Functions Virtualization (NFV) environments, existing data transfer methods between virtual machines require multiple encryption and decryption operations, leading to increased CPU usage, power consumption, and latency due to the need for total memory encryption and decryption of data across non-shared memory spaces.
Innovation Solution
Implementing a virtual channel with a crypto engine that copies data from a source memory page to an intermediate buffer without modification, storing metadata with a key ID and source address, and then decrypting and encrypting the data using different keys for the destination memory page, reducing the number of cryptography operations required.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If total memory encryption and decryption operations are performed for data transfer between virtual machines, then data security is improved, but CPU usage increases
Solution Approach 1:
The patent applies preliminary action by pre-establishing secure memory regions with encryption capabilities and pre-configuring the data transfer pathway. The source memory region is prepared with encryption context before data transfer, and the destination memory region is pre-configured to receive encrypted data, eliminating the need for post-transfer decryption operations and reducing CPU overhead.
Solution Approach 2:
The patent extracts the decryption operation from the data transfer pathway by implementing a secure memory region that maintains encryption throughout the transfer process. Instead of encrypting-then-decrypting through intermediate buffers, the system extracts unnecessary decryption steps by using memory regions that preserve encryption state, thereby reducing CPU usage while maintaining security.
2Reliability
If total memory encryption and decryption operations are performed for data transfer between virtual machines, then data security is improved, but power consumption increases
Solution Approach 1:
The system performs preliminary configuration of secure memory regions with encryption capabilities before data transfer. The source and destination memory regions are pre-prepared with appropriate encryption contexts, eliminating the need for power-intensive decryption operations during the actual data transfer process.
Solution Approach 2:
The patent extracts unnecessary decryption operations from the data transfer pathway by using secure memory regions that maintain encryption state throughout the transfer. This extraction of redundant cryptographic operations directly reduces power consumption while preserving data security.
3Reliability
If total memory encryption and decryption operations are performed for data transfer between virtual machines, then data security is improved, but latency increases
Solution Approach 1:
The patent applies preliminary action by pre-establishing secure memory regions with encryption contexts configured before data transfer. The source memory region is prepared with encryption parameters and the destination is pre-configured to receive encrypted data, eliminating time-consuming decryption operations and reducing overall transfer latency.
Solution Approach 2:
The system extracts unnecessary decryption operations from the data transfer pathway by implementing secure memory regions that maintain encryption throughout the transfer process. By removing redundant cryptographic steps, the system reduces latency while maintaining data security.
4Reliability
If data is copied between isolated domains without sharing memory, then data security is improved, but the number of cryptography operations increases
Solution Approach 1:
The patent applies preliminary action by pre-configuring secure memory regions with encryption capabilities before data transfer. The source memory region is prepared with encryption context and the destination is pre-configured, allowing the system to maintain fewer cryptography operations while ensuring data security through isolated domain architecture.
Data Source
AI summary
In some examples, for process-to-process communication, such as in function linking, a virtual channel can be provisioned to provide virtual machine to virtual machine communications. In response to a transmit request from a source virtual machine, the virtual channel can cause a data copy from a source buffer associated with the source virtual machine without decryption or encryption. The virtual channel provisions a key identifier for the copied data. The destination virtual machine can receive an indication data is available and can cause the data to be decrypted using a key accessed using the key identifier and source address of the copied data. In addition, the data can be encrypted using a second, different key for storage in a destination buffer associated with the destination virtual machine. In some examples, the key identifier and source address is managed by the virtual channel and is not visible to virtual machine or hypervisor.