Intel corporation (20240118913). APPARATUS AND METHOD TO IMPLEMENT SHARED VIRTUAL MEMORY IN A TRUSTED ZONE simplified abstract

APPARATUS AND METHOD TO IMPLEMENT SHARED VIRTUAL MEMORY IN A TRUSTED ZONE

Organization Name

intel corporation

Inventor(s)

Kaijie Guo of Shanghai (CN)

Junyuan Wang of Shanghai (CN)

Maksim Lukoshkov of Clarecastle, Clare (IE)

Weigang Li of Shanghai (CN)

Xin Zeng of Shanghai (CN)

APPARATUS AND METHOD TO IMPLEMENT SHARED VIRTUAL MEMORY IN A TRUSTED ZONE - A simplified explanation of the abstract

This abstract first appeared for US patent application 20240118913 titled 'APPARATUS AND METHOD TO IMPLEMENT SHARED VIRTUAL MEMORY IN A TRUSTED ZONE

Simplified Explanation

The abstract describes an apparatus and method for implementing shared virtual memory in a trust zone. One embodiment of the processor includes multiple cores, a memory controller, and an input/output memory management unit (IOMMU) to facilitate memory access requests from input/output devices within a secure environment.

• The processor comprises multiple cores, a memory controller, and an IOMMU.
• The memory controller establishes private memory regions in system memory for different trust domains.
• The IOMMU receives memory access requests from input/output devices and accesses translation tables to determine the appropriate memory region.
• A virtual machine monitor (VMM) initiates secure transactions with a trust domain manager to translate guest virtual addresses to physical addresses for memory access.
• The IOMMU performs memory access on behalf of input/output devices using the translated physical addresses.

Potential Applications

This technology could be applied in secure computing environments where different trust domains need to share virtual memory while maintaining isolation and security.

Problems Solved

This technology solves the problem of securely accessing shared virtual memory in a trust zone environment, ensuring that data remains protected and isolated between different trust domains.

Benefits

The benefits of this technology include enhanced security, improved isolation between trust domains, and efficient memory access for input/output devices within a secure environment.

Potential Commercial Applications

Potential commercial applications of this technology include secure cloud computing, virtualization platforms, and data centers where multiple trust domains need to share virtual memory securely.

Possible Prior Art

One possible prior art for this technology could be existing methods of implementing shared virtual memory in secure computing environments, such as hardware-based memory protection mechanisms or software-based memory isolation techniques.

How does this technology impact system performance compared to traditional memory access methods?

This article does not provide information on the performance implications of implementing shared virtual memory in a trust zone compared to traditional memory access methods. Further research or testing may be needed to determine the performance impact of this technology.

What are the potential security vulnerabilities associated with implementing shared virtual memory in a trust zone?

The article does not address potential security vulnerabilities that may arise from implementing shared virtual memory in a trust zone. Additional analysis or security assessments may be required to identify and mitigate any security risks associated with this technology.

Original Abstract Submitted

an apparatus and method to implement shared virtual memory in a trust zone. for example, one embodiment of a processor comprises: a plurality of cores; a memory controller coupled to the plurality of cores to establish a first private memory region in a system memory using a first key associated with a first trust domain of a first guest; an input/output memory management unit (iommu) coupled to the memory controller, the iommu to receive a memory access request by an input/output (io) device, the memory access request comprising a first address space identifier and a guest virtual address (gva), the iommu to access an entry in a first translation table using at least the first address space identifier to determine that the memory access request is directed to the first private memory region which is not directly accessible to the iommu, the iommu to generate an address translation request associated with the memory access request, wherein based on the address translation request, a virtual machine monitor (vmm) running on one or more of the plurality of cores is to initiate a secure transaction sequence with trust domain manager to cause a secure entry into the first trust domain to translate the gva to a physical address based on the address space identifier, the iommu to receive the physical address from the vmm and to use the physical address to perform the requested memory access on behalf of the io device.