Multi-tenant encryption for storage class memory
AssigneeIntel Corporation
InventorsHormuzd M. Khosravi, Baiju V. Patel
Life of this patent
Estimating the term…
Abstract
Various embodiments are generally directed to the providing for mutual authentication and secure distributed processing of multi-party data. In particular, an experiment may be submitted to include the distributed processing of private data owned by multiple distrustful entities. Private data providers may authorize the experiment and securely transfer the private data for processing by trusted computing nodes in a pool of trusted computing nodes.
Claims26
An apparatus comprising:
- a memory controller communicatively coupled to a processor element, the memory controller to:
- add a tenant encryption key to a key table of the processor element, the tenant encryption key corresponding to a tenant of a plurality of tenants;
- add a unique tenant identification to the key table to identify the tenant encryption key;
- and
- configure a physical address comprising a set of bits in a page table for at least one memory page of a storage class memory (SCM) to include an indication of the unique tenant identification and an SCM physical address, wherein the indication of the unique tenant identification includes a first subset of the set of bits and the SCM physical address includes a second subset of the set of bits.
At least one non-transitory machine-readable storage medium comprising instructions that when executed by a processor element, cause the processor element to:
- add a tenant encryption key to a key table of the processor element, the tenant encryption key corresponding to a tenant of a plurality of tenants;
- add a tenant identification to the key table to identify the tenant encryption key;
- and
- configure a physical address comprising a set of bits in a page table for at least one memory page of a storage class memory (SCM) to include an indication of the tenant identification and an SCM physical address, wherein the indication of the tenant identification includes a first subset of the set of bits and the SCM physical address includes a second subset of the set of bits.
A system comprising:
- a storage class memory (SCM);
- a memory controller coupled to the storage class memory to access the SCM;
- and
- logic, at least a portion of which is implemented in hardware, the logic to:
- add a tenant encryption key to a key table of a processor element, the tenant encryption key corresponding to a tenant of a plurality of tenants;
- add a tenant identification to the key table to identify the tenant encryption key;
- and
- configuring a physical address comprising a set of bits in a page table for at least one memory page of the SCM to include an indication of the tenant identification and an SCM physical address, wherein the indication of the tenant identification includes a first subset of the set of bits and the SCM physical address includes a second subset of the set of bits.
A computer-implemented method comprising:
- adding a tenant encryption key to a key table of a processor element, the tenant encryption key corresponding to a tenant of a plurality of tenants;
- adding a tenant identification to the key table to identify the tenant encryption key;
- and
- configuring a physical address comprising a set of bits in a page table for at least one memory page of a storage class memory (SCM) to include an indication of the tenant identification and an SCM physical address, wherein the indication of the tenant identification includes a first subset of the set of bits and the SCM physical address includes a second subset of the set of bits.
Dependencies are inferred from the claim text.