Multi-tenant cryptographic memory isolation
AssigneeIntel Corporation
InventorsShay Gueron, Siddhartha Chhabra, Nadav Bonen
Life of this patent
Estimating the term…
Abstract
System and techniques for multi-tenant cryptographic memory isolation are described herein. A multiple key total memory encryption (MKTME) circuitry may receive a read request for encrypted memory. Here, the read request may include an encrypted memory address that itself includes a sequence of keyid bits and physical address bits. The MKTME circuitry may retrieve a keyid-nonce from a key table using the keyid bits. The MKTME circuitry may construct a tweak from the keyid-nonce, the keyid bits, and the physical address bits. The MKTME circuitry may then decrypt data specified by the read request using the tweak and a common key.
Claims23
A device for multi-tenant cryptographic memory isolation, the device comprising:
- storage that includes a key table;
- interface circuitry to facilitate an interface to form an interconnect between memory hardware and a user of the memory hardware;
- and
- processing circuitry to:
- receive, on the interface:
- a write request, by a tenant of several tenants, for the memory hardware from the user of the memory hardware;
- and
- data corresponding to the write request;
- extract a tenant identifier (ID) from the write request;
- obtain a nonce for the tenant from the key table using the tenant ID as an index, the key table being writable to store new keyed-nonces;
- and
- encrypt the data, creating encrypted data, using the nonce for storage in the memory hardware, wherein, to encrypt the data using the nonce, the processing circuitry is configured to:
- combine the nonce with the tenant ID and physical address from the write request to create a tweak;
- and
- encrypt the data using the tweak.
A method for multi-tenant cryptographic memory isolation, the method comprising:
- receiving, on an interface forming an interconnect between memory hardware and a user of the memory hardware, a write request, by a tenant of several tenants, for the memory hardware from the user of the memory hardware;
- receiving, on the interface, data corresponding to the write request;
- extracting a tenant identifier (ID) from the write request;
- obtaining a nonce for the tenant from a key table using the tenant ID as an index, the key table being writable to store new keyed-nonces;
- and
- encrypting the data, created encrypted data, using the nonce for storage in the memory hardware, wherein encrypting the data using the nonce includes:
- combining the nonce with the tenant ID and physical address from the write request to create a tweak;
- and
- encrypting the data using the tweak.
At least one non-transitory machine-readable medium including instructions for multi-tenant cryptographic memory isolation, the instructions, when executed by processing circuitry, cause the processing circuitry to perform operations comprising:
- receiving, on an interface forming an interconnect between memory hardware and a user of the memory hardware, a write request, by a tenant of several tenants, for the memory hardware from the user of the memory hardware;
- receiving, on the interface, data corresponding to the write request;
- extracting a tenant identifier (ID) from the write request;
- obtaining a nonce for the tenant from a key table using the tenant ID as an index, the key table being writable to store new keyed-nonces;
- and
- encrypting the data, created encrypted data, using the nonce for storage in the memory hardware, wherein encrypting the data using the nonce includes:
- combining the nonce with the tenant ID and physical address from the write request to create a tweak;
- and
- encrypting the data using the tweak.
Dependencies are inferred from the claim text.