Scalable multi-key memory encryption

A method comprising:

• writing, with a core, data of a protected virtual machine to a memory address, the memory address identifying a memory region storing state of the protected virtual machine, the state stored in the memory region not accessible by a virtual machine monitor;
• storing a plurality of identifiers in a first storage;
• identifying an identifier, of the plurality of identifiers, corresponding to the memory address;
• storing a first encryption information and a second encryption information in a second storage, each of the plurality of identifiers identifying a different one of the first and second encryption information, the first and second encryption information used by different protected virtual machines;
• using the identifier to identify the first encryption information stored in the second storage;
• and
• encrypting the data with the first encryption information prior to storage of corresponding encrypted data to the memory region.

A system comprising:

• a system memory;
• and
• an apparatus coupled with the system memory, the apparatus comprising:
• a core to write data of a protected virtual machine to a memory address, the memory address to identify a memory region to store state of the protected virtual machine, the state to be stored in the memory region not accessible by a virtual machine monitor;
• a first storage to store a plurality of identifiers;
• a first circuitry to identify an identifier, of the plurality of identifiers stored in the first storage, corresponding to the memory address;
• a second storage to store a first encryption information and a second encryption information, each of the plurality of identifiers to identify a different one of the first and second encryption information, the first and second encryption information to be used by different protected virtual machines;
• a second circuitry to use the identifier to identify the first encryption information stored in the second storage;
• and
• an encryption unit to encrypt the data with the first encryption information prior to storage of corresponding encrypted data to the memory region.