IP Library › Granted Patent US 12,333,025
Granted Patent B2
US 12,333,025 · App. 18/370,137 · Granted Jun 17, 2025

Protected data accesses using remote copy operations

Inventors: Ned Smith (Beaverton, OR); Kshitij A. Doshi (Tempe, AZ); Francesc Guim Bernat (Barcelona, ES); Kapil Sood (Washougal, WA); Tarun Viswanathan (El Dorado Hills, CA)
Assignee: Intel Corporation
G06F21/602G06F15/17331H04L9/3268
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 12,333,025
App. No.
18/370,137
Granted
Jun 17, 2025
Kind
B2
Abstract

Examples herein relate to an interface selectively providing access to a memory region for a work request from an entity by providing selective access to a physical address of the memory region and selective access to a cryptographic key for use by a memory controller to access the memory region. In some examples, providing selective access to a physical address conversion is based on one or more of: validation of a certificate received with the work request and an identifier of the entity being associated with a process with access to the memory region. Access to the memory region can be specified to be one or more of: create, read, update, delete, write, or notify. A memory region can be a page or sub-page sized region. Different access rights can be associated with different sub-portions of the memory region, wherein the access rights comprise one or more of: create, read, update, delete, write, or notify.

Claims (156)

1. A cloud service provider system configurable to be used in association with multiple tenants, the cloud service provider system to be used in providing at least one service associated with at least one of the multiple tenants, the cloud service provider being configurable for use in association with at least one public cloud and/or at least one private cloud, the cloud service provider system comprising:

server hardware for use in executing at least one workload associated with the providing of the at least one service; and

multiple memory regions configurable to be associated with the multiple tenants, at least one of the multiple memory regions also to be associated with the at least one workload, the multiple tenants to be assigned access privileges with respect to the multiple memory regions;

wherein:

the server hardware is configurable for use in association with circuitry for use in processing at least one remote direct memory access (RDMA) request associated with the at least one of the multiple memory regions;

the at least one RDMA request is configurable to request at least one RDMA write access to and/or at least one RDMA read access from the at least one of the multiple memory regions;

the at least one RDMA write access is configurable to comprise data encryption for use in subsequent RDMA transmission to the at least one of the multiple memory regions;

the at least one RDMA read access is configurable to comprise RDMA reception of encrypted data from the at least one of the multiple memory regions for subsequent decryption;

the access privileges that are to be assigned to the multiple tenants with respect to the multiple memory regions are to be mutually different from each other, at least in part;

the at least one RDMA request is associated with at least one requesting tenant of the multiple tenants;

the processing comprises determining, based upon which of the access privileges is to be assigned to the at least one requesting tenant, whether to permit the at least one RDMA request;

the cloud service provider system comprises physical server resources;

the physical server resources:

comprise the server hardware; and

are configurable to comprise accelerator circuits that comprise graphics processing units (GPUs);

the cloud service provider system is configurable to dynamically allocate, based upon resource utilization trend data, resource utilization performance modeling data, and future resource utilization prediction data associated with the at least one workload, one or more portions of the physical server resources for use in association with the executing of the at least one workload;

the GPUs are configurable to implement one or more artificial intelligence models associated with machine learning and/or neural networks; and

the cloud service provider system is to execute virtual machines and/or containers that are configurable to be associated with the multiple tenants, multiple memory regions, and the at least one workload.

2. The cloud service provider system of claim 1 , wherein:

the at least one requesting tenant comprises the at least one of the multiple tenants; and

the at least one of the multiple tenants is to be assigned at least one of the access privileges that is to result in the circuitry permitting the at least one RDMA request.

3. The cloud service provider system of claim 1 , wherein:

the at least one requesting tenant comprises at least one other of the multiple tenants; and

the at least one other of the multiple tenants is to be assigned at least one of the access privileges that is to result in the circuitry denying the at least one RDMA request.

4. The cloud service provider system of claim 1 , wherein:

the server hardware and/or the physical server resources are configurable to be comprised in the at least one public cloud and the at least one private cloud.

5. The cloud service provider system of claim 4 , wherein:

the server hardware and/or the physical server resources are configurable to be comprised in both at least one on-premises data center and at least one off-premises data center.

6. The cloud service provider system of claim 5 , wherein:

the at least one public cloud, the at least one private cloud, the at least one on-premises data center, and/or the at least one off-premises data center are configured for use in association with mobile edge compute; and

the access privileges are to be determined based upon one or more certificate-associated credentials.

7. At least one non-transitory machine-readable storage medium storing instructions for being executed by at least one machine that is to be associated with a cloud service provider system, the cloud service provider system being configurable to be used in association with multiple tenants, the cloud service provider system to be used in providing at least one service associated with at least one of the multiple tenants, the cloud service provider being configurable for use in association with at least one public cloud and/or at least one private cloud, the cloud service provider system comprising server hardware and multiple memory regions, the instructions, when executed by the at least one machine, resulting in the cloud service provider system being configured to enable performance of operations comprising:

executing, by the server hardware, at least one workload associated with the providing of the at least one service; and

configuring multiple memory regions to be associated with the multiple tenants, at least one of the multiple memory regions also to be associated with the at least one workload, the multiple tenants to be assigned access privileges with respect to the multiple memory regions;

wherein:

the server hardware is configurable for use in association with circuitry for use in processing at least one remote direct memory access (RDMA) request associated with the at least one of the multiple memory regions;

the at least one RDMA request is configurable to request at least one RDMA write access to and/or at least one RDMA read access from the at least one of the multiple memory regions;

the at least one RDMA write access is configurable to comprise data encryption for use in subsequent RDMA transmission to the at least one of the multiple memory regions;

the at least one RDMA read access is configurable to comprise RDMA reception of encrypted data from the at least one of the multiple memory regions for subsequent decryption;

the access privileges that are to be assigned to the multiple tenants with respect to the multiple memory regions are to be mutually different from each other, at least in part;

the at least one RDMA request is associated with at least one requesting tenant of the multiple tenants;

the processing comprises determining, based upon which of the access privileges is to be assigned to the at least one requesting tenant, whether to permit the at least one RDMA request;

the cloud service provider system comprises physical server resources;

the physical server resources:

comprise the server hardware; and

are configurable to comprise accelerator circuits that comprise graphics processing units (GPUs);

the cloud service provider system is configurable to dynamically allocate, based upon resource utilization trend data, resource utilization performance modeling data, and future resource utilization prediction data associated with the at least one workload, one or more portions of the physical server resources for use in association with the executing of the at least one workload;

the GPUs are configurable to implement one or more artificial intelligence models associated with machine learning and/or neural networks; and

the cloud service provider system is to execute virtual machines and/or containers that are configurable to be associated with the multiple tenants, multiple memory regions, and the at least one workload.

8. The at least one non-transitory machine-readable storage medium of claim 7 , wherein:

the at least one requesting tenant comprises the at least one of the multiple tenants; and

the at least one of the multiple tenants is to be assigned at least one of the access privileges that is to result in the circuitry permitting the at least one RDMA request.

9. The at least one non-transitory machine-readable storage medium of claim 7 , wherein:

the at least one requesting tenant comprises at least one other of the multiple tenants; and

the at least one other of the multiple tenants is to be assigned at least one of the access privileges that is to result in the circuitry denying the at least one RDMA request.

10. The at least one non-transitory machine-readable storage medium of claim 7 , wherein:

the server hardware and/or the physical server resources are configurable to be comprised in the at least one public cloud and the at least one private cloud.

11. The at least one non-transitory machine-readable storage medium of claim 10 , wherein:

the server hardware and/or the physical server resources are configurable to be comprised in both at least one on-premises data center and at least one off-premises data center.

12. The at least one non-transitory machine-readable storage medium of claim 11 , wherein:

the at least one public cloud, the at least one private cloud, the at least one on-premises data center, and/or the at least one off-premises data center are configured for use in association with mobile edge compute; and

the access privileges are to be determined based upon one or more certificate-associated credentials.

13. A method implemented using a cloud service provider system, the cloud service provider system being configurable to be used in association with multiple tenants, the cloud service provider system to be used in providing at least one service associated with at least one of the multiple tenants, the cloud service provider being configurable for use in association with at least one public cloud and/or at least one private cloud, the cloud service provider system comprising server hardware and multiple memory regions, the method comprising:

executing, by the server hardware, at least one workload associated with the providing of the at least one service; and

configuring multiple memory regions to be associated with the multiple tenants, at least one of the multiple memory regions also to be associated with the at least one workload, the multiple tenants to be assigned access privileges with respect to the multiple memory regions;

wherein:

the server hardware is configurable for use in association with circuitry for use in processing at least one remote direct memory access (RDMA) request associated with the at least one of the multiple memory regions;

the at least one RDMA request is configurable to request at least one RDMA write access to and/or at least one RDMA read access from the at least one of the multiple memory regions;

the at least one RDMA write access is configurable to comprise data encryption for use in subsequent RDMA transmission to the at least one of the multiple memory regions;

the at least one RDMA read access is configurable to comprise RDMA reception of encrypted data from the at least one of the multiple memory regions for subsequent decryption;

the access privileges that are to be assigned to the multiple tenants with respect to the multiple memory regions are to be mutually different from each other, at least in part;

the at least one RDMA request is associated with at least one requesting tenant of the multiple tenants;

the processing comprises determining, based upon which of the access privileges is to be assigned to the at least one requesting tenant, whether to permit the at least one RDMA request;

the cloud service provider system comprises physical server resources;

the physical server resources:

comprise the server hardware; and

are configurable to comprise accelerator circuits that comprise graphics processing units (GPUs);

the cloud service provider system is configurable to dynamically allocate, based upon resource utilization trend data, resource utilization performance modeling data, and future resource utilization prediction data associated with the at least one workload, one or more portions of the physical server resources for use in association with the executing of the at least one workload;

the GPUs are configurable to implement one or more artificial intelligence models associated with machine learning and/or neural networks; and

the cloud service provider system is to execute virtual machines and/or containers that are configurable to be associated with the multiple tenants, multiple memory regions, and the at least one workload.

14. The method of claim 13 , wherein:

the at least one requesting tenant comprises the at least one of the multiple tenants; and

the at least one of the multiple tenants is to be assigned at least one of the access privileges that is to result in the circuitry permitting the at least one RDMA request.

15. The method of claim 13 , wherein:

the at least one requesting tenant comprises at least one other of the multiple tenants; and

the at least one other of the multiple tenants is to be assigned at least one of the access privileges that is to result in the circuitry denying the at least one RDMA request.

16. The method of claim 13 , wherein:

the server hardware and/or the physical server resources are configurable to be comprised in the at least one public cloud and the at least one private cloud.

17. The method of claim 16 , wherein:

the server hardware and/or the physical server resources are configurable to be comprised in both at least one on-premises data center and at least one off-premises data center.

18. The method of claim 17 , wherein:

the at least one public cloud, the at least one private cloud, the at least one on-premises data center, and/or the at least one off-premises data center are configured for use in association with mobile edge compute; and

the access privileges are to be determined based upon one or more certificate-associated credentials.

19. A cloud service provider system configurable to be used in association with multiple tenants, the cloud service provider system to be used in providing at least one service associated with at least one of the multiple tenants, the cloud service provider being configurable for use in association with at least one public cloud and/or at least one private cloud, the cloud service provider system comprising:

server device resources for executing at least one workload associated with the providing of the at least one service; and

multiple memory regions for association with the multiple tenants, at least one of the multiple memory regions also to be associated with the at least one workload, the multiple tenants to be assigned access privileges with respect to the multiple memory regions;

wherein:

the server device resources are configurable for use in association with remote direct memory access (RDMA) device resources for processing at least one RDMA request associated with the at least one of the multiple memory regions;

the at least one RDMA request is configurable to request at least one RDMA write access to and/or at least one RDMA read access from the at least one of the multiple memory regions;

the at least one RDMA write access is configurable to comprise data encryption for use in subsequent RDMA transmission to the at least one of the multiple memory regions;

the at least one RDMA read access is configurable to comprise RDMA reception of encrypted data from the at least one of the multiple memory regions for subsequent decryption;

the access privileges that are to be assigned to the multiple tenants with respect to the multiple memory regions are to be mutually different from each other, at least in part;

the at least one RDMA request is associated with at least one requesting tenant of the multiple tenants;

the processing comprises determining, based upon which of the access privileges is to be assigned to the at least one requesting tenant, whether to permit the at least one RDMA request;

the cloud service provider system comprises physical server resources;

the physical server resources:

comprise the server device resources; and

are configurable to comprise accelerator device resources that comprise graphics processing unit (GPU) devices;

the cloud service provider system is configurable to dynamically allocate, based upon resource utilization trend data, resource utilization performance modeling data, and future resource utilization prediction data associated with the at least one workload, one or more portions of the physical server resources for use in association with the executing of the at least one workload;

the GPU devices are configurable to implement one or more artificial intelligence models associated with machine learning and/or neural networks; and

the cloud service provider system is to execute virtual machines and/or containers that are configurable to be associated with the multiple tenants, multiple memory regions, and the at least one workload.

20. The cloud service provider system of claim 19 , wherein:

the at least one requesting tenant comprises the at least one of the multiple tenants; and

the at least one of the multiple tenants is to be assigned at least one of the access privileges that is to result in the RDMA device resources permitting the at least one RDMA request.

21. The cloud service provider system of claim 19 , wherein:

the at least one requesting tenant comprises at least one other of the multiple tenants; and

the at least one other of the multiple tenants is to be assigned at least one of the access privileges that is to result in the circuitry denying the at least one RDMA request.

22. The cloud service provider system of claim 19 , wherein:

the server device resources and/or the physical server resources are configurable to be comprised in the at least one public cloud and the at least one private cloud.

23. The cloud service provider system of claim 22 , wherein:

the server device resources and/or the physical server resources are configurable to be comprised in both at least one on-premises data center and at least one off-premises data center.

24. The cloud service provider system of claim 23 , wherein:

the at least one public cloud, the at least one private cloud, the at least one on-premises data center, and/or the at least one off-premises data center are configured for use in association with mobile edge compute; and

the access privileges are to be determined based upon one or more certificate-associated credentials.

25. A cloud service provider system configurable to be used in association with multiple tenants, the cloud service provider system to be used in providing at least one service associated with at least one of the multiple tenants, the cloud service provider being configurable for use in association with at least one public cloud and/or at least one private cloud, the cloud service provider system comprising:

at least one data center, the at least one data center comprising multiple servers for use in association with the multiple tenants, the multiple servers comprising:

server hardware for use in executing at least one workload associated with the providing of the at least one service; and

multiple memory regions configurable to be associated with the multiple tenants, at least one of the multiple memory regions also to be associated with the at least one workload, the multiple tenants to be assigned access privileges with respect to the multiple memory regions;

wherein:

the server hardware is configurable for use in association with circuitry for use in processing at least one remote direct memory access (RDMA) request associated with the at least one of the multiple memory regions;

the at least one RDMA request is configurable to request at least one RDMA write access to and/or at least one RDMA read access from the at least one of the multiple memory regions;

the at least one RDMA write access is configurable to comprise data encryption for use in subsequent RDMA transmission to the at least one of the multiple memory regions;

the at least one RDMA read access is configurable to comprise RDMA reception of encrypted data from the at least one of the multiple memory regions for subsequent decryption;

the access privileges that are to be assigned to the multiple tenants with respect to the multiple memory regions are to be mutually different from each other, at least in part;

the at least one RDMA request is associated with at least one requesting tenant of the multiple tenants;

the processing comprises determining, based upon which of the access privileges is to be assigned to the at least one requesting tenant, whether to permit the at least one RDMA request;

the cloud service provider system comprises physical server resources;

the physical server resources:

comprise the server hardware; and

are configurable to comprise accelerator circuits that comprise graphics processing units (GPUs);

the cloud service provider system is configurable to dynamically allocate, based upon resource utilization trend data, resource utilization performance modeling data, and future resource utilization prediction data associated with the at least one workload, one or more portions of the physical server resources for use in association with the executing of the at least one workload;

the GPUs are configurable to implement one or more artificial intelligence models associated with machine learning and/or neural networks; and

the cloud service provider system is to execute virtual machines and/or containers that are configurable to be associated with the multiple tenants, multiple memory regions, and the at least one workload.

26. The cloud service provider system of claim 25 , wherein:

the at least one requesting tenant comprises the at least one of the multiple tenants; and

the at least one of the multiple tenants is to be assigned at least one of the access privileges that is to result in the Circuitry permitting the at least one RDMA request.

27. The cloud service provider system of claim 25 , wherein:

the at least one requesting tenant comprises at least one other of the multiple tenants; and

the at least one other of the multiple tenants is to be assigned at least one of the access privileges that is to result in the circuitry denying the at least one RDMA request.

28. The cloud service provider system of claim 25 , wherein:

the server hardware and/or the physical server resources are configurable to be comprised in the at least one public cloud and the at least one private cloud.

29. The cloud service provider system of claim 28 , wherein:

the at least one data center comprises at least one on-premises data center and at least one off-premises data center.

30. The cloud service provider system of claim 29 , wherein:

the at least one public cloud, the at least one private cloud, the at least one on-premises data center, and/or the at least one off-premises data center are configured for use in association with mobile edge compute; and

the access privileges are to be determined based upon one or more certificate-associated credentials.

Continuity (3)
Continuation 16845885 · Apr 10, 2020
Provisional Application 62832649 · Apr 11, 2019
Related Publication 20240111879A1 · Apr 4, 2024
References Cited (22)
US 9432183B1 · Axnix · 2016 [cited by examiner]
US 10691619B1 · Gibson et al. · 2020 [cited by applicant]
US 10901627B1 · BShara et al. · 2021 [cited by applicant]
US 20160380908A1 · Larsson · 2016 [cited by examiner]
US 20190079897A1 · Kochevar-Cureton · 2019 [cited by examiner]
US 20200213246A1 · Pan et al. · 2020 [cited by applicant]
US 20200401441A1 · Evans et al. · 2020 [cited by applicant]
“Storing a secure key in an embedded device's memory”, StackExchange Electrical Engineering, https://electronics.stackexchange.com/questions/198274/storing-a-secure-key-in-an-embedded-devices-memory, last edited Jul. 23… [cited by applicant]
AMD, “AMD Secure Encrypted Virtualization (SER) AMD EPYC Hardware Memory Encryption” AMD Developer Central, https://web.archive.org/web/20200307003329/https://developer.amd.com/sev/, Mar. 7, 2020, 5 pages. [cited by applicant]
AMD, “AMD's Secure Memory Encryption (SME) and Secure Encrypted Virtualization (SEV)” Huchtech, https://firmwaresecurity.com/2016/04/26/amds-secure-memory-encryption-sme-and-secure-encrypted-virtualization-sev/, Apr. 26… [cited by applicant]
Final Office Action for U.S. Appl. No. 16/845,885, Mailed Mar. 3, 2023, 31 pages. [cited by applicant]
First Office Action for U.S. Appl. No. 16/845,885, Mailed Aug. 16, 2022, 18 pages. [cited by applicant]
Flinck, Hannu, “Multi-access Edge Computing (MEC) Applications”, NOKIA Bell Labs, Mar. 29, 2017, 18 pages. [cited by applicant]
Guo, Chuanxiong, et al., “RDMA over Commodity Ethernet at Scale”, ACM, SIGCOMM '16, Aug. 22-26, 2016, 14 pages. [cited by applicant]
Hilland, Jeff, et al., “RDMA Protocol Verbs Specification (Version 1.0)”, Apr. 2003, 243 pages. [cited by applicant]
Intel, “Intel® Architecture Memory Encryption Technologies Specification”, Rev: 1.1, Dec. 2017, 30 pages. [cited by applicant]
Mellanox Technologies, “RDMA Aware Networks Programming User Manual”, Rev 1.7, © Copyright 2015. Mellanox Technologies, 216 pages. [cited by applicant]
Mellanox Technologies, “Security in Mellanox Technologies InfiniBand Fabrics”, Technical Overview, White Paper, © Copyright 2012, 7 pages. [cited by applicant]
Notice of Allowance for U.S. Appl. No. 16/845,885, Mailed Jun. 20, 2023, 9 pages. [cited by applicant]
Recio, Renato, “RDMA enabled NIC (RNIC) Verbs Overview”, Apr. 29, 2003, 28 pages. [cited by applicant]
Sabella, Dario, et al., “Developing Software for Multi-Access Edge Computing”, ETSI White Paper No. 20, 2nd edition—Feb. 2019, 38 pages. [cited by applicant]
Sabella, Dario, et al., “Security at the Edge an Overview”, Intel, IEEE 5G World Forum, Oct. 1, 2019, 38 pages. [cited by applicant]