Module security 

Security features for GPU kernel protection and compliance.

This module provides enterprise-grade security features:

• Memory Encryption: Encrypt sensitive GPU memory regions
• Kernel Sandboxing: Isolate kernels with resource limits and access controls
• Compliance Reports: Generate audit-ready compliance documentation

Feature Flags

• crypto - Enables real AES-256-GCM and ChaCha20-Poly1305 encryption (requires aes-gcm, chacha20poly1305, argon2, rand, zeroize crates)

Without the crypto feature, a demo XOR-based implementation is used (NOT suitable for production - only for testing/development).

Memory Encryption

use ringkernel_core::security::{MemoryEncryption, EncryptionConfig, EncryptionAlgorithm};

let config = EncryptionConfig::new()
    .with_algorithm(EncryptionAlgorithm::Aes256Gcm)
    .with_key_rotation_interval(Duration::from_secs(3600));

let encryption = MemoryEncryption::new(config)?;
let encrypted = encryption.encrypt_region(&sensitive_data)?;
let decrypted = encryption.decrypt_region(&encrypted)?;

Kernel Sandboxing

use ringkernel_core::security::{KernelSandbox, SandboxPolicy, ResourceLimits};

let policy = SandboxPolicy::new()
    .with_memory_limit(1024 * 1024 * 1024)  // 1GB
    .with_execution_timeout(Duration::from_secs(30))
    .deny_k2k_to(&["untrusted_kernel"]);

let sandbox = KernelSandbox::new(policy);
sandbox.apply_to_kernel(&kernel_handle)?;

Compliance Reports

use ringkernel_core::security::{ComplianceReporter, ComplianceStandard, ReportFormat};

let reporter = ComplianceReporter::new()
    .with_standard(ComplianceStandard::SOC2)
    .with_standard(ComplianceStandard::GDPR);

let report = reporter.generate_report(ReportFormat::Pdf)?;

Structs

ComplianceCheck

A single compliance check.

ComplianceReport

A complete compliance report.

ComplianceReporter

Compliance reporter for generating compliance documentation.

ComplianceSummary

Summary statistics for a compliance report.

EncryptedRegion

An encrypted memory region.

EncryptionConfig

Configuration for memory encryption.

EncryptionKey

Represents an encryption key with metadata.

EncryptionStats

Statistics for memory encryption operations.

KernelSandbox

Kernel sandbox for isolation and resource control.

MemoryEncryption

Memory encryption manager for GPU memory protection.

ResourceLimits

Resource limits for sandboxed kernels.

SandboxPolicy

Sandbox policy defining what a kernel can access.

SandboxStats

Statistics for sandbox enforcement.

SandboxViolation

A recorded sandbox violation.

Enums

AccessLevel

Access control for kernel operations.

ComplianceStandard

Compliance standard for reporting.

ComplianceStatus

Compliance check result.

EncryptionAlgorithm

Encryption algorithm for GPU memory protection.

KeyDerivation

Key derivation function for encryption keys.

ReportFormat

Report output format.

ViolationType

Sandbox violation type.