Cross-domain security in cryptographically partitioned cloud

A method for secure memory access in a computing platform, the method comprising:

• executing, by at least one processor core of the computing platform, a plurality of workloads, each workload utilizing allocated portions of memory;
• and
• performing key-based cryptography by a multi-key encryption (MKE) engine, including performing operations on data to be read from, or written to, portions of the memory to isolate certain ones of the portions of the memory from workloads to which those portions of the memory are not allocated;
• maintaining a key-mapping data store accessible to the MKE engine and containing associations between identifiers of portions of the memory, and corresponding key identification data from which the MKE engine determines cryptographic keys with which to perform the cryptographic isolation;
• and
• maintaining, by the MKE engine, a key tracking log, wherein the MKE engine is to temporarily store entries in the key tracking log containing the identifiers of the portions of the memory and the corresponding key identification data for those portions of memory during memory-access operations of those portions of memory.

At least one non-transitory machine-readable medium containing instructions that, when executed by a computing platform, cause the computing platform to:

• perform, by at least one processor core of the computing platform, a plurality of workloads, each workload utilizing allocated portions of memory;
• and
• perform key-based cryptography, by a multi-key encryption (MKE) engine, including operations on data to be read from, or written to, portions of the memory to isolate certain ones of the portions of the memory from workloads to which those portions of the memory are not allocated;
• maintain a key-mapping data store that is accessible to the MKE engine and contains associations between identifiers of portions of the memory, and corresponding key identification data from which cryptographic keys are determined by the MKE engine to perform the cryptographic isolation;
• and
• maintain, by the MKE engine, a key tracking log, and cause the MKE engine to temporarily store entries in the key tracking log containing the identifiers of the portions of the memory and the corresponding key identification data for those portions of memory during memory-access operations of those portions of memory.