Supporting memory paging in virtualized systems using trust domains

A method comprising:

• evicting, by a processing device, a memory page associated with a trust domain (TD) executed by the processing device, wherein the TD is cryptographically isolated in memory using at least one exclusive encryption key for encrypting the memory associated with the TD;
• creating, by the processing device, a transportable page that comprises encrypted contents of the memory page, wherein the creating comprises removing a binding that binds the memory page to a physical memory location associated with the TD, and wherein the encrypted contents of the transportable page comprises at least one of a physical address of the memory page or a virtual address of a second memory page where the encrypted contents of the transportable page are stored;
• decrypting contents of the transportable page using a key associated with the TD;
• and
• providing, by the processing device, the transportable page to a second memory location of a second TD, wherein the providing comprises binding the transportable page to the second TD using an ephemeral key associated with the second TD and the second memory location.

A system comprising:

• a memory to store trust domains;
• and
• a processing device, operatively coupled to the memory, to:
• evict a memory page associated with a trust domain (TD) to be executed by the processing device, wherein the TD is cryptographically isolated in memory using at least one exclusive encryption key for encrypting the memory associated with the TD;
• create a transportable page that comprises encrypted contents of the memory page, wherein the creating comprises removing a binding that binds the memory page to a physical memory location associated with the TD, and wherein the encrypted contents of the transportable page comprises at least one of a physical address of the memory page or a virtual address of a second memory page where the encrypted contents of the transportable page are stored;
• decrypt contents of the transportable page using a key associated with the TD;
• and
• provide the transportable page to a second memory location of a second TD, wherein the providing comprises binding the transportable page to the second TD using an ephemeral key associated with the second TD and the second memory location.