Cryptographic computing including enhanced cryptographic addresses
An apparatus comprising a processor unit comprising circuitry to generate, for a first network host, a request for an object of a second network host, wherein the request comprises an address comprising a routable host ID of the second network host and an at least partially encrypted object ID, wherein the address uniquely identifies the object within a distributed computing domain; and a memory element to store at least a portion of the object.
1. An apparatus comprising:
a processor unit comprising:
circuitry to generate, for a first network host, a request for an object of a second network host, wherein the request comprises an address comprising a routable host ID of the second network host and an at least partially encrypted object ID, wherein the address uniquely identifies the object within a distributed computing domain, wherein the routable host ID in the request comprises an Internet Protocol address of the second network host, and wherein the distributed computing domain comprises a plurality of Internet Protocol hosts; and
a memory element to store at least a portion of the object.
2. The apparatus of claim 1 , wherein the partially encrypted object ID is unforgeable.
3. The apparatus of claim 1 , wherein the circuitry is to execute a memory access instruction having an operand that references the address.
4. The apparatus of claim 1 , wherein the object ID includes context information for a cryptographic operation associated with the object.
5. The apparatus of claim 1 , wherein the address comprises at least 128 bits.
6. The apparatus of claim 1 , wherein the routable host ID is 64 bits long and the object ID is 64 bits long.
7. The apparatus of claim 1 , wherein the circuitry is to use the address as a cryptographic key to decrypt the object.
8. The apparatus of claim 1 , wherein the distributed computing domain comprises the entire Internet.
9. The apparatus of claim 1 , wherein the circuitry is to generate the request responsive to a call instruction referencing the address and a determination to offload execution of a code object based on a current load of a processor unit running the first network host.
10. The apparatus of claim 1 , wherein the circuitry is to generate the request responsive to a determination that a page table does not include a mapping of the object ID to a physical address.
11. The apparatus of claim 1 , further comprising a key lookaside buffer to associate the host ID with a key to decrypt the object.
12. The apparatus of claim 11 , wherein the circuitry is to invoke an authorization protocol to obtain the key responsive to a miss in the key lookaside buffer.
13. Computer-readable media comprising instructions that, when executed by a machine, cause the machine to:
generate, by a first network host, a request for an object of a second network host, wherein the request comprises an address comprising a routable host ID of the second network host and an at least partially encrypted object ID, wherein the address uniquely identifies the object within a distributed computing domain, wherein the routable host ID in the request comprises an Internet Protocol address of the second network host, and wherein the distributed computing domain comprises a plurality of Internet Protocol hosts; and
access the object.
14. The media of claim 13 , wherein the partially encrypted object ID is unforgeable.
15. The media of claim 13 , the instructions to cause the machine to execute, by the first network host, a memory access instruction having an operand that references the address.
16. The media of claim 13 , wherein the object ID includes context information for a cryptographic operation associated with the object.
17. The media of claim 13 , wherein the address comprises at least 128 bits.
18. The media of claim 13 , wherein the routable host ID is 64 bits long and the object ID is 64 bits long.
19. The media of claim 13 , the instructions to cause the machine to use the address as a cryptographic key to decrypt the object.
20. The media of claim 13 , wherein the distributed computing domain comprises the entire Internet.
21. The media of claim 13 , the instructions to cause the machine to generate the request responsive to a call instruction referencing the address and a determination to offload execution of a code object based on a current load of a processor unit running the first network host.
22. The media of claim 13 , the instructions to cause the machine to generate the request responsive to a determination that a page table does not include a mapping of the object ID to a physical address.
23. A method comprising:
generating, by a first network host, a request for an object of a second network host, wherein the request comprises an address comprising a routable host ID of the second network host and an at least partially encrypted object ID, wherein the address uniquely identifies the object within a distributed computing domain, wherein the routable host ID of the request comprises an Internet Protocol address of the second network host, and wherein the distributed computing domain comprises a plurality of Internet Protocol hosts; and
accessing the object.