Multi-tenant encryption for storage class memory

1. An apparatus comprising:

a memory controller communicatively coupled to a processor element, the memory controller to:

add a tenant encryption key to a key table of the processor element, the tenant encryption key corresponding to a tenant of a plurality of tenants;

add a unique tenant identification to the key table to identify the tenant encryption key; and

configure a physical address comprising a set of bits in a page table for at least one memory page of a storage class memory (SCM) to include an indication of the unique tenant identification and an SCM physical address, wherein the indication of the unique tenant identification includes a first subset of the set of bits and the SCM physical address includes a second subset of the set of bits.

2. The apparatus of claim 1 , comprising the processor element, the processor element implemented to provide a computing environment for the plurality of tenants.

3. The apparatus of claim 1 , the memory controller to add the indication of the unique tenant identification to a portion of the physical address.

4. The apparatus of claim 1 , wherein the set of bits of the physical address comprises 52 bits, the unique tenant identification comprises 6 bits, and the first subset of the set of bits comprises the 6 most significant bits of the physical address, the memory controller to add the indication of the unique tenant identification to the 6 most significant bits of the physical address.

5. The apparatus of claim 1 , the memory controller to encrypt the SCM corresponding to the at least one memory page based in part on the tenant encryption key.

6. The apparatus of claim 1 , the memory controller to:

receive a memory access request including an indication of the physical address, the physical address to include the indication of the unique tenant identification and the SCM physical address; and

access the SCM based on the SCM physical address and the tenant encryption key corresponding the unique tenant identification.

7. The apparatus of claim 1 , the memory controller to encrypt or decrypt the at least one memory page of the SCM using the tenant encryption key.

8. The apparatus of claim 1 , the memory controller to:

receive a memory access request including an indication of the physical address, the physical address to include the indication of the unique tenant identification and the SCM physical address;

translate the SCM physical address from a first domain to a second domain;

add the translated SCM physical address to a context table for an input output (I/O) memory access; and

add an indication of a second unique tenant identification to the context table.

9. The apparatus of claim 8 , the memory controller to:

retrieve an information element from the SCM based on a memory access to the SCM physical address and the tenant encryption key corresponding to the unique tenant identification; and

encrypt the information element based on a tenant key corresponding to the second unique tenant identification.

10. The apparatus of claim 9 , the memory controller to add the encrypted information element to a direct memory access (DMA) buffer of an I/O device, the I/O device corresponding to the second unique tenant identification.

11. The apparatus of claim 10 , the memory controller to:

generate an initial encryption key; and

wrap the initial encryption key to generate the tenant encryption key.

12. At least one non-transitory machine-readable storage medium comprising instructions that when executed by a processor element, cause the processor element to:

add a tenant encryption key to a key table of the processor element, the tenant encryption key corresponding to a tenant of a plurality of tenants;

add a tenant identification to the key table to identify the tenant encryption key; and

configure a physical address comprising a set of bits in a page table for at least one memory page of a storage class memory (SCM) to include an indication of the tenant identification and an SCM physical address, wherein the indication of the tenant identification includes a first subset of the set of bits and the SCM physical address includes a second subset of the set of bits.

13. The at least one non-transitory machine-readable storage medium of claim 12 , the medium comprising instructions that further cause the processor element to add the indication of the tenant identification to a portion of the physical address.

14. The at least one non-transitory machine-readable storage medium of claim 12 , wherein the set of bits of the physical address comprises 52 bits, the tenant identification comprises 6 bits, and the first subset of the set of bits comprises the 6 most significant bits of the physical address, the medium comprising instructions that further cause the processor element to add the indication of the tenant identification to the 6 most significant bits of the physical address.

15. The at least one non-transitory machine-readable storage medium of claim 12 , comprising instructions that further cause the processor element to encrypt the SCM corresponding to the at least one memory page based in part on the tenant encryption key.

16. The at least one non-transitory machine-readable storage medium of claim 12 , comprising instructions that further cause the processor element to:

receive a memory access request including an indication of the physical address, the physical address to include the indication of the tenant identification and the SCM physical address; and

access the SCM based on the SC physical address and the tenant encryption key corresponding the tenant identification.

17. The at least one non-transitory machine-readable storage medium of claim 16 , comprising instructions that further cause the processor element to access the SCM comprising encrypting or decrypting a memory page of the SCM using the tenant encryption key.

18. The at least one non-transitory machine-readable storage medium of claim 12 , comprising instructions that further cause the processor element to:

receive a memory access request including an indication of the physical address, the physical address to include the indication of the tenant identification and the SCM physical address;

translate the SCM physical address from a first domain to a second domain;

add the translated SCM physical address to a context table for an input output (I/O) memory access; and

add an indication of a second tenant identification to the context table.

19. The at least one non-transitory machine-readable storage medium of claim 18 , comprising instructions that further cause the processor element to:

retrieve an information element from the SCM based on a memory access to the SCM physical address and the tenant encryption key corresponding to the tenant identification; and

encrypt the information element based on a tenant key corresponding to the second tenant identification.

20. The at least one non-transitory machine-readable storage medium of claim 19 , comprising instructions that further cause the processor element to add the encrypted information element to a direct memory access (DMA) buffer of an I/O device, the I/O device corresponding to the second tenant identification.

21. A system comprising:

a storage class memory (SCM);

a memory controller coupled to the storage class memory to access the SCM; and

logic, at least a portion of which is implemented in hardware, the logic to:

add a tenant encryption key to a key table of a processor element, the tenant encryption key corresponding to a tenant of a plurality of tenants;

add a tenant identification to the key table to identify the tenant encryption key; and

configuring a physical address comprising a set of bits in a page table for at least one memory page of the SCM to include an indication of the tenant identification and an SCM physical address, wherein the indication of the tenant identification includes a first subset of the set of bits and the SCM physical address includes a second subset of the set of bits.

22. The system of claim 21 , the logic to add the indication of the tenant identification to a portion of the physical address.

23. The system of claim 21 , the logic to:

receive a memory access request including an indication of the physical address, the physical address to include the indication of the tenant identification and the SCM physical address;

translate the SCM physical address from a first domain to a second domain;

add the translated SCM physical address to a context table for an input output (I/O) memory access; and

add an indication of a second tenant identification to the context table.

24. A computer-implemented method comprising:

adding a tenant encryption key to a key table of a processor element, the tenant encryption key corresponding to a tenant of a plurality of tenants;

adding a tenant identification to the key table to identify the tenant encryption key; and

configuring a physical address comprising a set of bits in a page table for at least one memory page of a storage class memory (SCM) to include an indication of the tenant identification and an SCM physical address, wherein the indication of the tenant identification includes a first subset of the set of bits and the SCM physical address includes a second subset of the set of bits.

25. The computer-implemented method of claim 24 , comprising adding the indication of the tenant identification to a portion of the physical address.

26. The computer-implemented method of claim 24 , comprising:

receiving a memory access request including an indication of the physical address, the physical address to include the indication of the tenant identification and the SCM physical address; and

accessing the SCM based on the SCM physical address and the tenant encryption key corresponding the tenant identification.