Patent ID: 8856504
Filing Date: 2014-10-07
Classification: G06F,H04L

Abstract:
1. A method, comprising: receiving, by a trust anchor on a central processing unit (CPU) having a plurality of processing cores, a virtual machine (VM) image, wherein the VM image is encrypted using a VM image encryption key; obtaining the VM image encryption key; configuring a first encrypt/decrypt block with the VM image encryption key; generating a memory session key; configuring a second encrypt/decrypt block with the memory session key; fetching one or more pages of the VM image into a memory accessible by the plurality of processing cores, wherein each fetched page is decrypted by the first encrypt/decrypt block using the VM image encryption key and subsequently encrypted by the second encrypt/decrypt block using the memory session key; configuring a third encrypt/decrypt block with the memory session key, wherein the third encrypt/decrypt block is present between a first cache and a second cache on the CPU, and wherein the first cache is local to one of the processing cores on the CPU and the second cache shared by the plurality of processing cores on the CPU; identifying a memory address associated with data to be read from the second cache into the first cache; generating a keystream using at least the memory session key, a nonce, and the memory address, and decrypting, using the generated keystream, the data while being read from the second cache to the first cache.