Methods and arrangements for implicit integrity

Abstract

The logic may implement implicit integrity techniques to maintain the integrity of the data. The logic may perform operations on data stored in main memory, cache, flash memory, data storage, or any other memory. The logic may perform one or more pattern checks to determine duplication of entities within the data. The logic may determine an entropy index value and / or a Boolean value and / or may compare the result to a threshold to determine whether the data unit is valid. The logic may merge a tag with the data unit without expanding the data unit to create an encoded data unit. The logic may decode and process the encoded data unit to determine the data unit and the tag. The logic may determine a histogram of values for two or more entities, determine the sum of duplications of the two or more entities, and compare the sum to a threshold. The logic may determine whether the data unit is valid or corrupted.

Description

Technical Field

[0001] The embodiments described herein are in the field of data security and, more particularly, relate to methods and arrangements for performing implicit integrity operations. Background Art

[0002] The standard way to support data integrity is through the use of a message authentication code (MAC) (or, in the case of memory cache line integrity, an integrity check value (ICV)). A cryptographic hash function (e.g., SHA256, SHA3) generates a MAC to be stored along with the data unit, which effectively expands or increases the size of the data unit and incurs additional communication overhead. The communication overhead involves the unavoidable message expansion associated with the use of MACs and ICVs. For example, if a system uses an ICV to protect a cache line, the system must store the ICV value at the same time as the cache line is stored and read the ICV value with each cache line read operation. This also wastes memory access bandwidth resources because each read operation involves two memory read operations. The first memory operation retrieves the cache line data, and the second memory operation retrieves the ICV. Therefore, the implementation of data integrity measures affects the performance of the application. BRIEF DESCRIPTION OF THE DRAWINGS

[0003] Figure 1A An embodiment of a system including a multi-processor platform, a chipset, a bus, and accessories is depicted;

[0004] Figure 1B Depicting an embodiment of a state diagram for illustrating states of data units, including states of changed data units;

[0005] Figure 1C-1E Described are embodiments of memory logic circuitry for performing implicit data integrity operations, such as Figure 1A The memory logic circuit system shown in FIG.

[0006] Figure 1F-1G Describes the use of Figure 1A An embodiment of the memory logic circuitry of the memory logic circuitry shown in to encode and merge tag and data units and decode and separate tag and data units to store the tag and data units without message expansion;

[0007] Figure 1H Depicted are embodiments of memory logic circuitry for determining duplication of an entity, such as Figure 1A The memory logic circuit system shown in ;

[0008] Figure 1Idepicts an embodiment of a graph illustrating pass rates for cache lines using implicit data integrity and pass rates for cache lines using implicit integrity or using an integrity check value (ICV) stored in an ICV cache location;

[0009] Figure 1J An embodiment of an implicit data integrity operation is depicted that includes an error correction code in a tag for correcting corrupted coded data units;

[0010] Figure 1K An embodiment of a code snippet for performing pattern checking and comparing repetitions of entities within a data unit to a threshold value is depicted;

[0011] 1L(AC) depicts an embodiment of a code snippet for calculating an entropy index value based on repetitions of entities within a data unit;

[0012] 1M(AD) depicts an embodiment of a code snippet for encoding a data unit and a tag without message extension to merge the data unit and the tag;

[0013] Figure 2 Depicts such as Figure 1A An embodiment of the memory logic circuitry of the memory logic circuitry shown in ;

[0014] Figure 3A-3C A flow chart depicting an embodiment of encrypting and decrypting data units and tags, and merging and separating data units and tags; and

[0015] Figure 4-Figure 5 Embodiments of a storage medium and computing platform for implicit data integrity are described. DETAILED DESCRIPTION

[0016] The following is a detailed description of the embodiments depicted in the accompanying drawings. This detailed description is intended to cover all modifications, equivalents, and alternatives coming within the scope of the appended claims.

[0017] Embodiments may detect corruption without generating, storing, or verifying a mathematical summary of the contents of a data unit. Such summary, often referred to as a message authentication code (MAC) (or an integrity check value (ICV) in the case of memory cache line integrity), is typically expensive to maintain and use. Embodiments may implement an alternative approach, implicit integrity, which uses pattern techniques to support corruption detection for most user data without the need for message expansion. Many embodiments implement implicit integrity operations for compliant data units and a MAC or ICV for incompatible data units. In some embodiments, an incompatible data unit is an uncoded data unit that does not exhibit sufficient bit patterns to be relevant for a pattern check to be performed to ensure a security level equal to or above an entropy threshold. In some embodiments, the entropy threshold is a setting, and in other embodiments, the entropy threshold is a fixed value.

[0018] Embodiments may include memory logic circuitry for implementing an implicit integrity operation that detects a pattern of entities in a data unit, such as a pattern of two or more bits, such as a nibble, byte, word, doubleword, or a combination thereof. In some embodiments, the memory logic circuitry compares the repetition of the entity to a threshold value to determine whether the data unit exhibits at least one of the patterns having a greater repetition of the entity than a corresponding threshold value. The memory logic circuitry may implement the threshold value based on the probability that random data will exhibit the repetition of the entity. One factor in determining the threshold value involves a balance between the security level and the data throughput rate, which is the number of data units that are compatible with the implicit integrity operation.

[0019] The memory logic circuitry may include circuitry for implementing implicit integrity operations. In some embodiments, the memory logic circuitry includes code containing instructions executed on a processor and a processor for implementing implicit integrity operations. The code may be stored on a machine-readable medium and, if executed by the processor, causes the processor to perform one or more implicit integrity operations. The processor may be a general-purpose processor such as a computer's main application processor or a specialized processor designed to perform implicit integrity operations and / or other tasks. In other embodiments, the memory logic circuitry includes a combination of code, one or more processors, and circuitry such as memory, integrated circuits, discrete components, etc., for performing implicit integrity operations.

[0020] In some embodiments, the memory logic circuitry determines an entropy index value for each entity pattern of data units. The memory logic circuitry may calculate the entropy index value based on the probability that random data will exhibit the corresponding entity pattern. In such an embodiment, the memory logic circuitry compares the entropy index value against an entropy threshold. The entropy threshold may represent a security level, such as a 24-bit security level, a 48-bit security level, a 64-bit security level, a 128-bit security level, a 256-bit security level, and the like. For example, if a data unit includes an entity pattern associated with an entropy index value greater than an entropy threshold for 64-bit security, the memory logic circuitry may implement an implicit integrity operation that provides 64-bit security for the data integrity of the data unit without calculating and storing a MAC or ICV.

[0021] In some embodiments, the memory logic circuitry determines a maximum entropy index value among the entropy index values determined for each entity pattern and compares the maximum entropy index value to an entropy threshold value. In such embodiments, if at least one of the entity patterns has an entropy index value greater than the entropy threshold value, the memory logic circuitry may utilize a security level associated with the entropy threshold value to maintain data integrity.

[0022] In some embodiments, the memory logic circuitry can implement implicit integrity operations on data units, which involve encoding the data units for storage in memory or decoding the data units for processing. In further embodiments, to detect malware operations such as ransomware operations, the memory logic circuitry can examine data stored in memory to determine whether the data is encrypted.

[0023] The memory logic circuitry can perform a pattern check to determine whether a data unit is compatible with implicit integrity operations and determine an entropy index value associated with the data unit. For example, if the data unit is random data and the pattern check logic cannot detect a pattern of entities that exceeds a threshold for the pattern check, then the data unit is incompatible with implicit integrity operations. On the other hand, if the data unit exhibits a pattern that the pattern check logic can detect and that exceeds the threshold, then the data unit is compatible with implicit integrity operations. In many embodiments, the pattern check logic determines a count of one or more instances of the pattern to be compared to a threshold, and the threshold indicates a desired level of security for the implicit integrity operation.

[0024] After determining that the data unit is compatible with the implicit integrity operation, the memory logic circuit system can encode the data unit with the tag to create an encoded data unit. In some embodiments, the memory logic circuit system can embed the tag in the encoded data unit without expanding the size of the data unit. In other words, the encoded data unit with the embedded tag has the same size or the same number of bits as the data unit. In such an embodiment, the entropy index value and the entropy threshold indicate the number of bits, and if the size of the tag is no longer than the entropy index value of the data unit minus the entropy threshold, the memory logic circuit system can embed the tag without message expansion. In addition, the memory logic circuit system can embed a tag having a size as large as the entropy index value of the data unit minus the entropy threshold and still maintain the security level associated with the entropy threshold.

[0025] Many embodiments include memory logic circuitry for decoding an encoded data unit. In some embodiments, the memory logic circuitry decrypts the encoded data unit to determine the data unit and a tag embedded in the data unit. The tag can be any data. In some embodiments, the tag is an error correction code used to correct a second encoded data unit.

[0026] The memory logic circuit system can receive the encoded data unit from the memory and begin decrypting the encoded data unit. The decryption process can produce a set of data unit and tag pairs. In other words, there is a finite set of solutions to the decryption process in the form of data unit and tag pairs. After determining the set of pairs, the memory logic circuit system can identify the correct decoded data unit and tag pair. Identifying the correct data unit and tag pair can involve: performing a pattern check to detect duplication of entities in each data unit in the set of pairs, determining an entropy index value for each data unit, identifying a highest entropy index value, and comparing the highest entropy index value to an entropy threshold. If the highest entropy index value is greater than the entropy threshold, then the pair associated with the highest entropy index value is the correct data unit and tag to be decrypted from the encoded data unit.

[0027] It should be understood that the terms "high" or "low" or "higher" or "lower" when used to refer to the entropy or entropy index of a data unit are defined with respect to a particular metric used to quantify the entropy for that data unit. As discussed herein, "entropy" refers to a statistical entropy metric commonly used in the fields of thermodynamics and information theory, such that a data unit has "high" or "higher" entropy when it is indistinguishable or less distinguishable from random data, and has "low" or "lower" entropy when it is distinguishable or more distinguishable from random data. In contrast, the entropy metric used in implicit integrity calculations is the "entropy index." As defined herein, an entropy index value is "high" or "higher" when a data unit is distinguishable or more distinguishable from random data, and an entropy index value is "low" or "lower" when a data unit is indistinguishable or less distinguishable from random data. Also note that while some embodiments define the entropy index value as low for random data and high for non-random data, some embodiments may define the entropy index value as high for random data and low for non-random data. In such embodiments, the calculations and decisions are modified accordingly to generate the same results.

[0028] In some embodiments, if the highest entropy index value is not greater than the entropy threshold, the encoded data unit is corrupted. If the memory logic circuit system determines that the encoded data unit may be corrupted, the memory logic circuit system may implement corrective measures to repair the encoded data unit. For example, the memory logic circuit system may perform parity checking, error correction using tags embedded in previously decrypted data units, checksums, brute force algorithms that change one or more bits at a time, and the like. Once the memory logic circuit system corrects the encoded data unit or attempts to correct the encoded data unit, the memory logic circuit system may decrypt the encoded data unit to determine a set of data unit and tag pairs, determine an entropy index value for each data unit, and compare the entropy index value to the entropy threshold to determine the correct data unit and tag pair.

[0029] In a further embodiment, if the highest entropy index value is not greater than the entropy threshold, the coded data unit may be encrypted with a MAC or ICV, and the memory logic circuitry may search for the associated MAC or ICV to check the validity of the coded data unit. If no associated MAC or ICV is found, the memory logic circuitry may identify the coded data unit as corrupted or attempt to perform corrective action.

[0030] Various embodiments may be designed to address different technical issues associated with data integrity. Other technical issues may include generating, storing, and verifying mathematical generalizations of data units for data integrity; generating a message authentication code (MAC) or integrity check value and storing the MAC or ICV along with the encoded data unit to support data integrity; performing a cryptographic hash function such as SHA256 or SHA3 to generate the MAC or ICV; reading the MAC or ICV along with the encoded data unit to support data integrity calculations; performing multiple storage operations to store the encoded data unit and the MAC or ICV; performing multiple read operations to read the encoded data unit and the MAC or ICV; performing computationally intensive cryptographic operations; storing a larger amount of data than the data unit to store the encoded data unit and the MAC or ICV; and the like.

[0031] Different technical problems, such as the technical problems discussed above, can be solved by one or more different embodiments. For example, some embodiments that solve problems associated with data security can be implemented by one or more different technical means, such as performing implicit integrity operations on data stored in main memory, cache, flash memory, data storage, or any other memory; performing one or more pattern checks to determine duplication of entities within the data; determining an entropy index value and / or a Boolean value and / or comparing the result with a threshold to determine whether a data unit is valid; merging a tag with a data unit without expanding the data unit to create an encoded data unit; decoding and processing the encoded data unit to determine the data unit and the tag; determining a histogram of values for two or more entities, determining a sum of duplications of the two or more entities, and comparing the sum with a threshold; determining whether a data unit is valid and / or whether the data unit is corrupted; performing corrective measures to correct a corrupted encoded data unit; and the like.

[0032] Several embodiments include systems with multiple processor cores, such as central servers, servers, workstations, notebooks, netbooks, laptops, and other mobile devices (smartphones, tablets, etc.), other personal computers (PCs), and other server computers. Other embodiments include systems such as access points and / or stations (STAs) such as modems, routers, switch sensors, meters, controllers, instruments, monitors, home or office appliances, Internet of Things (IoT) devices (watches, glasses, headphones, etc.). Some embodiments can provide, for example, indoor and / or outdoor "smart" grid and sensor services. In various embodiments, these devices are related to specific applications such as healthcare, home, commercial office and retail, security, industrial automation and monitoring applications, and vehicular applications (cars, autonomous vehicles, aircraft, etc.), among others.

[0033] Turning now to the drawings. Figure 1AThe figure illustrates an embodiment of system 1000. System 1000 is a computer system, such as a distributed computing system, a supercomputer, a high-performance computing system, a computing cluster, a mainframe computer, a minicomputer, a client-server system, a personal computer (PC), a workstation, a server, a portable computer, a laptop computer, a tablet computer, a handheld device such as a personal digital assistant (PDA), or other device for processing, displaying, or transmitting information. Similar embodiments are implemented, for example, as entertainment devices such as portable music players or portable video players, smartphones or other cellular phones, telephones, digital video cameras, digital still cameras, external storage devices, and the like. Further embodiments implement larger-scale server configurations. In other embodiments, system 1000 may have a single processor with one core or more than one processor. Note that the term "processor" refers to a processor with a single core or a processor package with multiple processor cores.

[0034] like Figure 1A As shown in FIG, system 1000 includes a motherboard 1005 for mounting platform components. Motherboard 1005 is a point-to-point interconnect platform that includes a first processor 1010 and a second processor 1030 coupled via a point-to-point interconnect 1056, such as an Ultra Path Interconnect (UPI). In other embodiments, system 1000 may utilize another bus architecture, such as a multi-drop bus. Furthermore, each of processors 1010 and 1030 may be a processor package having multiple processor cores, including one or more processor cores 1020 and 1040, respectively. While system 1000 is an example of a dual-socket (2S) platform, other embodiments may include more than two sockets or a single socket. For example, some embodiments may include a four-socket (4S) platform or an eight-socket (8S) platform. Each socket is used to mount a processor and may be associated with a socket identifier. Note that the term "platform" refers to motherboard 1005 on which certain components, such as processors 1010 and 1030 and chipset 1060, are mounted. Some platforms may include additional components, and some platforms may only include sockets for mounting a processor and / or chipset.

[0035] First processor 1010 includes an integrated memory controller (IMC) 1014 and point-to-point (PP) interfaces 1018 and 1052. Similarly, second processor 1030 includes an IMC 1034 and PP interfaces 1038 and 1054. IMCs 1014 and 1034 couple processors 1010 and 1030 to respective memories—memory 1012 and memory 1032, respectively. Memories 1012 and 1032 may be part of the platform's main memory (e.g., dynamic random access memory (DRAM)), such as double data rate type 3 (DDR3) or type 4 (DDR4) synchronous DRAM (SDRAM). In this embodiment, memories 1012 and 1032 are locally attached to respective processors 1010 and 1030. In other embodiments, main memory may be coupled to the processors via a bus and a shared memory hub.

[0036] In this embodiment, IMCs 1014 and 1034 include memory logic circuitry 1015 and 1035. Memory logic circuitry 1015 and 1035 can provide implicit integrity operations to encode data units for storage in memories 1012 and 1032 and to decode encoded data units retrieved from memories 1012 and 1032. For example, memory logic circuitry 1015 and 1035 can provide a level of security for data units stored by IMCs 1014 and 1034 and retrieved from memories 1012 and 1032 without requiring the generation, storage, retrieval, or verification of mathematical generalizations of the contents, such as MACs. In some embodiments, the implicit integrity operations are implemented in code for execution on a processor, such as processor 1010 and / or processor 1030, and the memory logic circuitry includes the code, memory circuitry for storing the code, and circuitry within and / or external to the processor(s) that supports the implicit integrity operations through the execution of processor instructions of the code. In such embodiments, a machine-readable medium such as a cache within and / or external to the processor, flash storage 1067, memories 1012 and 1032, and / or data storage 1088 stores the code or portions of the code.

[0037] Processors 1010 and 1030 include a cache memory coupled to each of processor core(s) 1020 and 1040, respectively. In the present embodiment, processor core(s) 1020 and 1040 include memory logic circuitry 1026 and 1046, respectively. Memory logic circuitry 1026 and 1046 can operate in conjunction with or independently of other memory logic circuitry in system 1000 (such as memory logic circuitry 1015, 1035, 1061, and 1096) and can provide implicit integrity operations to encode data units for storage in memories such as main memory 1012 and 1032, flash memory 1067 coupled to chipset 1060, and / or data storage 1088 coupled to bus 1091, respectively. Memory logic circuitry 1026 and 1046 can provide implicit integrity operations to encode data units for storage in memory and to decode encoded data units retrieved from memory. In some embodiments, memory logic circuitry may reside elsewhere in system 1000, such as memory logic circuitry 1061 in chipset 1060, memory logic circuitry 1096 in data storage 1088, or any other location within or external to system 1000 but coupled to system 1000 that may store code for execution by processor core(s) 1020 and 1040 and / or contain circuitry for implementing implicit integrity operations.

[0038] In some embodiments, memory logic circuitry 1015, 1035, 1061, and / or 1096 may operate in conjunction with memory logic circuitry 1026 and 1046 to perform implicit integrity operations. For example, memory logic circuitry 1015 in IMC 1014 may implement all implicit integrity operations for memory 1012, memory logic circuitry 1026 in processor core(s) 1020 may implement all implicit integrity operations for memory 1012, or both IMC 1015 and processor core(s) 1020 may partially implement implicit memory operations for memory 1012 via memory logic circuitry 1015 and 1026.

[0039] In some embodiments, processor core(s) 1020 may perform implicit integrity operations, such as pattern checking, threshold comparisons, entropy determinations, entropy comparisons, encoding, and / or decoding, in registers, such as registers 1016. In further embodiments, logic circuitry within memory logic circuitry 1015 may perform implicit integrity operations, such as pattern checking, threshold comparisons, entropy determinations, entropy comparisons, encoding, and / or decoding.

[0040] Memory logic circuitry 1026 and 1046 may represent circuitry configured to implement implicit integrity operations, or may represent a combination of circuitry within a processor and a medium for storing code for implementing all or part of the functionality of implicit integrity operations within a memory such as a cache, memory 1012, a buffer, or a register such as register 1016 within processor 1010, or within the instruction pipeline of processor 1010.

[0041] In several embodiments, memory logic circuitry 1096 in data storage 1088 may perform implicit integrity operations on data units stored in data storage 1088 independently of other memory logic circuitry in system 1000 or in conjunction with the memory logic circuitry of one or more of processors 1010 and 1030 and / or chipset 1060.

[0042] Now refer to Figure 1A and Figure 1B . Figure 1B The figure illustrates an embodiment of a state diagram 1100 for a data unit 1105, illustrating different states of the data unit 1105, where the content of the data unit has been maliciously modified by an attacker or physically corrupted. Memory logic circuitry 1015, 1026, 1035, 1046, 1061, and / or 1096 may implement implicit integrity operations to detect content changes. An IMC, such as IMC 1014, may receive the data unit 1105 for storage in memory 1012. Memory logic circuitry 1015 may test the data unit 1105 to determine whether it is compatible with implicit integrity operations. Generally, implicit integrity operations rely on the ability to distinguish the data unit 1105 from random data. Entropy level, as discussed herein, refers to the level of randomness of the data unit. If the data unit 1105 is random data, meaning it has a high level of entropy, then the data unit 1105 may be incompatible with implicit integrity operations without introducing an encoding process to modify the randomness. If data unit 1105 is not random data, the data unit may have a low level of entropy and data unit 1105 may be compatible with implicit integrity operations.

[0043] In the plaintext state, data unit 1105 is not random data, but rather has one or more recognizable patterns. A pattern can be a repetition of an entity within data unit 1105. An entity is a combination of two or more bits, such as a nibble, a byte, a word, a doubleword, or a combination thereof. In many embodiments, memory logic circuitry 1015, 1026, 1035, 1046, 1061, and / or 1096 can perform a pattern check to detect one or more patterns to determine whether data unit 1105 is compatible with implicit integrity operations. In some embodiments, if data unit 1105 is not compatible with implicit integrity operations, memory logic circuitry 1015, 1026, 1035, 1046, 1061, and / or 1096 can utilize a cryptographic hash with a MAC or ICV to provide data integrity.

[0044] Once memory logic circuitry 1015, 1026, 1035, 1046, 1061, and / or 1096 verifies that data unit 1105 is low entropy, memory logic circuitry 1015, 1026, 1035, 1046, 1061, and / or 1096 may encrypt 1110 data unit 1105 to create coded data unit 1115. Ciphertext refers to the state of coded data unit 1115. In the ciphertext state, coded data unit 1115 has high entropy, and therefore one or more recognizable patterns are not recognizable in this state.

[0045] The encryption algorithm can approximate a random oracle using, for example, one or more cryptographic hash functions. A random oracle is an oracle that responds to each unique query with a random response consistently chosen from its output domain. If the query is repeated, the random oracle responds with the same output each time. In many embodiments, the random oracle is a randomly and consistently chosen mathematical function that maps every possible query to a fixed random response from its output domain.

[0046] If coded data unit 1115 is corrupted, creating corrupted coded data unit 1120, the state of the data unit is transformed into corrupted ciphertext. In the corrupted ciphertext state, corrupted coded data unit 1120 also has high entropy. Then, when memory logic circuitry 1015, 1026, 1035, 1046, 1061, and / or 1096 attempts to decrypt 1125 corrupted coded data unit 1120, decryption operation 1125 creates modified data unit 1130 in a corrupted plaintext state.

[0047] Any corruption of the ciphertext results in a new ciphertext value that differs from the original, and any decryption operation on this new ciphertext value results in a corrupted plaintext value that differs from the original plaintext value. Since decryption is the inverse of encryption, the decryption algorithm also approximates a random oracle. Therefore, corrupted plaintext values are also indistinguishable from random data. Due to the "avalanche effect" associated with the decryption oracle, corrupted plaintext is indistinguishable from random data. Even a single bit change in the ciphertext affects all bits of the decrypted plaintext. For these reasons, examining the entropy of the result of a decryption operation can be a reliable test for detecting corruption, an "implicit integrity" operation.

[0048] Memory logic circuitry 1015, 1026, 1035, 1046, 1061, and / or 1096 may determine that coded data unit 1115 is corrupted in response to decryption operation 1125, thereby producing modified data unit 1130 having high entropy. Memory logic circuitry 1015, 1026, 1035, 1046, 1061, and / or 1096 may determine that modified data unit 1130 has high entropy by performing a pattern check and determining that modified data unit 1130 is indistinguishable from random data via one or more thresholds or entropy thresholds.

[0049] Once the memory logic circuit system 1015, 1026, 1035, 1046, 1061 and / or 1096 determines that the modified data unit 1130 has high entropy, the memory logic circuit system 1015, 1026, 1035, 1046, 1061 and / or 1096 can perform corrective measures on the corrupted coded data unit 1120, identify the corrupted coded data unit 1120 as corrupted, and / or perform other data integrity operations.

[0050] Now refer to Figure 1A 、 Figure 1B and Figure 1C , Figure 1C The figure illustrates an embodiment of threshold comparison logic 1200 of memory logic circuitry 1015, 1026, 1035, 1046, 1061, and / or 1096. Threshold comparison logic 1200 may receive data unit 1105 as input, perform one or more pattern checks to quantify the presence of a pattern or repetition of entities within data unit 1105, and compare the repetition of the entities to one or more thresholds associated with the pattern checks. For example, data unit 1105 may be a cache line having 512 bits. Threshold comparison logic 1200 may perform one or more pattern checks that compare the amount or count of detected repetitions of the entities to a threshold value and output an indication, such as true or false, a logical 1 or 0, etc., to indicate whether the count of repetitions of the entities exceeds the threshold value for the pattern check.

[0051] In this embodiment, the threshold comparison logic 1200 includes a plurality of threshold comparison units 1210 to 1290, each of which outputs a Boolean value associated with a different pattern check, the Boolean value indicating whether the count of repeated entities associated with the pattern check exceeds a threshold associated with the pattern check. In these embodiments, the threshold comparison logic 1200 performs a logical OR operation 1290 on the output of one or more threshold comparison unit output values to determine whether any threshold comparison unit outputs an indication that the count of repeated entities for the pattern check exceeds the corresponding threshold. In several embodiments, the logic or circuitry of one or more or all of the threshold comparison units can determine whether the count of repeated entities corresponding to the pattern check exceeds the threshold without calculating the count. In other words, the logic or circuitry can directly calculate an output from a data unit received as input to indicate whether the count of repeated entities of the pattern of entities in the data unit exceeds the threshold without strictly performing two consecutive steps of determining the count and then comparing the count to the threshold.

[0052] In this embodiment, threshold comparison logic 1200 includes a specific set of eight threshold comparison units 1210 through 1280, each of which calculates an output indicating whether the count of repetitions of an entity according to a pattern exceeds a different threshold value T1 through T8, respectively. Other embodiments may include more or fewer threshold comparison units. Some embodiments may implement the same pattern check as in threshold comparison logic 1200, while other embodiments may implement different pattern checks for repetitions of entities according to different pattern comparisons.

[0053] A first threshold comparison unit 1210 in threshold comparison logic 1200 calculates a value indicating whether the number of identical bytes in data unit 1105 exceeds a first threshold T1. In many embodiments, first threshold comparison unit 1210 calculates this value directly from the input, data unit 1105. In further embodiments, first threshold comparison unit 1210 may compare each byte of data unit 1105 with each other byte, determine a count of the number of identical bytes, compare this count to a first threshold T1, and output an indication, such as true or false, or a logical 1 or 0, indicating whether the count exceeds first threshold T1. In some embodiments, first threshold comparison unit 1210 may calculate a value to output that represents the maximum count of identical bytes or the comparison of the maximum count to first threshold T1. In other embodiments, first threshold comparison unit 1210 may calculate more than one output based on comparisons of the first threshold to more than one count of identical bytes in data unit 1105. In a further embodiment, the first threshold comparison unit 1210 may output a Boolean value equal to “TRUE” only when the count of equal bytes is greater than the first threshold T1.

[0054] A second threshold comparison unit 1220 in threshold comparison logic 1200 calculates a value indicating whether the number of equal adjacent or consecutive bytes in data unit 1105 exceeds a second threshold value T2. In many embodiments, second threshold comparison unit 1220 calculates this value directly from the input, data unit 1105. In further embodiments, second threshold comparison unit 1220 may determine a value indicating how each byte of data unit 1105 is compared to every other byte, determine a count of the number of equal adjacent or consecutive bytes, compare this count to threshold value T2, and output an indication, such as true or false or a logical 1 or 0, indicating whether the count exceeds second threshold value T2. In some embodiments, second threshold comparison unit 1220 may calculate a value to output that represents the maximum count of the number of equal adjacent bytes or the comparison of the maximum count to second threshold value T2. In other embodiments, second threshold comparison unit 1220 may calculate more than one output based on the comparison of the second threshold value to more than one count of equal adjacent bytes in data unit 1105. In a further embodiment, the second threshold comparison unit 1220 may output a Boolean value equal to "true" only when the count of identical adjacent bytes is greater than a fixed value. In an even further embodiment, the second threshold comparison unit 1220 may determine a maximum count or a maximum count of the number of identical adjacent or consecutive 16-bit words.

[0055] The third threshold comparison unit 1230 in the threshold comparison logic 1200 calculates a value indicating whether the number of bytes in the data unit 1105 that are equal to a special value from a set of one or more special values exceeds a third threshold value T3. In many embodiments, the third threshold comparison unit 1230 calculates this value directly from the input, the data unit 1105. Special values may include one or more values that identify a specific type of data that may or may not be easily detected using other pattern checks. In one embodiment, the set of special values includes two values: 0x00 and 0xFF. The "0x" identifies these digits "00" and "FF" as hexadecimal format. In other embodiments, the set of special values may include more values or may include only one value. In some embodiments, the special values may or may not include the values: 0x00 and 0xFF.

[0056] In further embodiments, third threshold comparison unit 1230 may compare each byte of data unit 1105 to one or more special values to determine how many special values are present in data unit 1105, compare the count to threshold T3, and output an indication, such as true or false or a logical 1 or 0, to indicate whether the count exceeds third threshold T3. In several embodiments, third threshold comparison unit 1230 may calculate a value to be output representing the comparison of the count to third threshold T3, where the count is the sum of all bytes equal to any special value in the set of special values. In other embodiments, third threshold comparison unit 1230 may calculate more than one output based on the comparison of the third threshold to the count for each special value in the set of special values. In one embodiment, third threshold comparison unit 1230 may calculate a value to be output representing the maximum count or a comparison of the maximum count for each special value in data unit 1105. In further embodiments, third threshold comparison unit 1230 may output a Boolean value equal to "true" only when the count of bytes taking on the special value is greater than a fixed value.

[0057] A fourth threshold comparison unit 1240 in threshold comparison logic 1200 calculates a value indicating whether the number of mutually identical 16-bit words in data unit 1105 exceeds a fourth threshold value T4. In many embodiments, fourth threshold comparison unit 1240 calculates this value directly from the input, data unit 1105. In further embodiments, fourth threshold comparison unit 1240 determines a count of words with identical values in data unit 1105, compares this count to threshold value T4, and outputs an indication, such as true or false or a logical 1 or 0, indicating whether the count exceeds fourth threshold value T4. In some embodiments, fourth threshold comparison unit 1240 may calculate a value to output that represents the maximum count of identical 16-bit words or a comparison of the maximum count to fourth threshold value T4. In other embodiments, fourth threshold comparison unit 1240 may calculate more than one output based on comparisons of the fourth threshold value to more than one count of identical 16-bit words in data unit 1105. In a further embodiment, the fourth threshold comparison unit 1240 may output a Boolean value equal to "true" only when the count of identical 16-bit words is greater than a fourth threshold.

[0058] A fifth threshold comparison unit 1250 in threshold comparison logic 1200 calculates a value indicating whether the sum of the two highest doubleword frequencies in data unit 1105 exceeds a fifth threshold value T5. In many embodiments, fifth threshold comparison unit 1250 calculates this value directly from the input, data unit 1105. In further embodiments, fifth threshold comparison unit 1250 determines the frequency or count of each doubleword in data unit 1105, determines which two doublewords have the highest counts or repetitions, sums the counts of the two different doublewords in data unit 1105 with the highest counts, compares this sum to threshold value T5, and outputs an indication, such as true or false or a logic 1 or 0, indicating whether the sum exceeds fifth threshold value T5. For example, fifth threshold comparison unit 1250 may compare each doubleword in data unit 1105 with every other doubleword in data unit 1105, determine the sum of all repetitions of each different doubleword in the data unit, sum the two highest sums, and compare the sum of the two highest sums to fifth threshold value T5 to determine the output. In other embodiments, the fifth threshold comparison unit 1250 may output a comparison of the fifth threshold with the sum of the three highest sums, the sum of the four highest sums, and / or the sum of N highest sums, where N is a positive number or integer. In further embodiments, the fifth threshold comparison unit 1250 may output a Boolean value equal to "true" only when the sum of the two highest sums is greater than the fifth threshold T5.

[0059] The sixth threshold comparison unit 1260 in the threshold comparison logic 1200 calculates a value indicating whether the sum of the two highest nibble frequencies in the data unit 1105 exceeds a sixth threshold T6. In many embodiments, the sixth threshold comparison unit 1260 calculates this value directly from the input, the data unit 1105.

[0060] In a further embodiment, the sixth threshold comparison unit 1260 determines the frequency or count of each nibble in the data unit 1105, determines which two nibbles have the highest count or repetition, sums the counts of the two different nibbles in the data unit 1105 with the highest counts, compares the sum of the counts to a threshold value T6, and outputs an indication, such as true or false or a logical 1 or 0, to indicate whether the sum exceeds the sixth threshold value T6. For example, the sixth threshold comparison unit 1260 may compare each nibble in the data unit 1105 with every other nibble in the data unit 1105, determine the sum of all repetitions of each different nibble in the data unit, sum the two highest sums, and compare the sum of the two highest sums to the sixth threshold value T6.

[0061] In other embodiments, the sixth threshold comparison unit 1260 may calculate more than one output based on a comparison of the sixth threshold with the sum of the three highest sums, the sum of the four highest sums, and / or the sum of the N highest sums, where N is a positive number or integer. In further embodiments, the sixth threshold comparison unit 1260 may output a Boolean value equal to "true" only when the sum of the two highest sums is greater than the sixth threshold T6.

[0062] The seventh threshold comparison unit 1270 in the threshold comparison logic 1200 calculates a value indicating whether the sum of the two highest most significant nibble frequencies in the data unit 1105 exceeds a seventh threshold value T7. The data unit 1105 may include, for example, 16, 32, or 64 bytes. Each byte includes a most significant nibble and a least significant nibble. In many embodiments, the seventh threshold comparison unit 1270 calculates this value directly from the input, the data unit 1105.

[0063] In further embodiments, seventh threshold comparison unit 1270 may determine the frequency or count of each most significant nibble in data unit 1105, determine which two most significant nibbles have the highest count or repetition, sum the counts of the two different most significant nibbles in data unit 1105 with the highest counts, compare the sum of the counts to threshold value T7, and output an indication, such as true or false or a logical 1 or 0, indicating whether the sum exceeds seventh threshold value T7. For example, seventh threshold comparison unit 1270 may compare each most significant nibble in data unit 1105 with every other most significant nibble in data unit 1105; determine the sum of all repetitions of each different most significant nibble in the data unit; sum the two highest sums; and compare the sum of the two highest sums to seventh threshold value T7. In other embodiments, seventh threshold comparison unit 1270 may calculate more than one output based on a comparison of the seventh threshold to the sum of the three highest sums, the sum of the four highest sums, and / or the sum of the N highest sums. In a further embodiment, the seventh threshold comparison unit 1270 may output a Boolean value equal to “true” only when the sum of the two highest sums is greater than a seventh threshold value T7.

[0064] The eighth threshold comparison unit 1280 in the threshold comparison logic 1200 calculates a value indicating whether the sum of the two highest least significant nibble frequencies in the data unit 1105 exceeds an eighth threshold value T8. The data unit 1105 may include, for example, 16, 32, or 64 bytes. Each byte includes a most significant nibble and a least significant nibble. In many embodiments, the eighth threshold comparison unit 1280 calculates this value directly from the input, the data unit 1105.

[0065] In further embodiments, the eighth threshold comparison unit 1280 can determine the frequency or count of each least significant nibble in the data unit 1105, determine which two least significant nibbles have the highest count or repetition, sum the counts of the two different least significant nibbles in the data unit 1105 with the highest counts, compare the counts to a threshold value T8, and output an indication, such as true or false or a logical 1 or 0, indicating whether the count exceeds the eighth threshold value T8. For example, the eighth threshold comparison unit 1280 can compare each least significant nibble in the data unit 1105 with every other least significant nibble in the data unit 1105; determine the sum or count of all repetitions of each different least significant nibble in the data unit 1105; sum the two highest sums or counts; and output a comparison of the sum of the two highest sums or counts to the eighth threshold value T8. In other embodiments, the eighth threshold comparison unit 1280 can calculate more than one output based on a comparison of the eighth threshold value to the sum of the three highest sums or counts, the sum of the four highest sums or counts, and / or the sum of more than four highest sums or counts. In a further embodiment, the eighth threshold comparison unit 1280 may output a Boolean value equal to “true” only when the sum of the two highest sums is greater than an eighth threshold value T8.

[0066] The output of threshold comparison logic 1200 may include one or more outputs from threshold comparison units 1210 through 1280 and may be used as an input to a logical OR operation 1290. Logical OR operation 1290 may determine whether data unit 1105 passes by determining whether any of threshold comparison units 1210 through 1280 outputs a value, such as a "true" or logical 1, indicating that the repeat count or count sum of the entity exceeds the corresponding threshold. In other embodiments, data unit 1105 passes if more than one of threshold comparison units 1210 through 1280 indicates that the sum or count exceeds the corresponding threshold. In further embodiments, data unit 1105 passes if more than one of threshold comparison units 1210 through 1280 indicates that the sum or count is equal to or greater than the corresponding threshold.

[0067] Now refer to 1A, Figure 1B and Figure 1D , Figure 1DThe figure illustrates an embodiment of pattern checking logic 1300 of memory logic circuitry 1015, 1026, 1035, 1046, 1061, and / or 1096. Pattern checking logic 1300 may receive data unit 1105 as input and quantify the presence of patterns or repetitions of entities within data unit 1105. For example, data unit 1105 may be a cache line having 512 bits. Pattern checking logic 1300 may perform one or more pattern checks and output a value for each pattern check indicating the amount or count of repetitions of the pattern associated with that pattern check that were detected. In many embodiments, pattern checking logic 1300 outputs the number of repetitions to entropy determination logic 1390, such as Figure 1E Entropy determination logic 1400 in.

[0068] While the pattern checking logic 1300 includes a specific set of eight pattern checking units 1310 through 1380, other embodiments may include more or fewer pattern checks. Some embodiments may implement the same pattern checking, while other embodiments may implement different pattern checks that quantify the repetition of different patterns. In other embodiments, the pattern checking of the logic 1300 may involve Figure 1B The data unit is different from the data unit.

[0069] The first pattern check unit 1310 in the pattern check logic 1300 calculates a value indicating the number of bytes that are equal in the data unit 1105. For example, the first pattern check unit 1310 may compare each byte of the data unit 1105 with every other byte and output a count of the number of bytes that are equal. In some embodiments, the first pattern check unit 1310 may determine the largest count or maximum count of the number of bytes that are equal. In other embodiments, the first pattern check unit 1310 may output more than one count of bytes that are equal in the data unit 1105.

[0070] The second pattern check unit 1320 in the pattern check logic 1300 calculates a value indicating the number of adjacent or consecutive bytes that are equal in the data unit 1105. For example, the second pattern check unit 1320 may compare each byte of the data unit 1105 with every other byte and output a count of the number of adjacent or consecutive bytes that are equal. In some embodiments, the second pattern check unit 1320 may determine a maximum count or a maximum count of the number of adjacent or consecutive bytes that are equal. In other embodiments, the second pattern check unit 1320 may output more than one count of adjacent or consecutive bytes that are equal in the data unit 1105. In further embodiments, the second pattern check unit 1320 may determine a maximum count or a maximum count of the number of adjacent or consecutive 16-bit words that are equal.

[0071] A third pattern check unit 1330 in the pattern check logic 1300 calculates a value indicating the number of bytes in the data unit 1105 that are equal to a special value from a set of one or more special values. Special values may include one or more values that identify a specific type of data that may or may not be easily detected using other pattern checks. For example, the third pattern check unit 1330 may compare each byte of the data unit 1105 to one or more special values to determine how many special values are in the data unit 1105. In one embodiment, the set of special values includes two values: 0x00 and 0xFF. In other embodiments, the set of special values may include more values or may include only one value. In several embodiments, the special values may or may not include the values: 0x00 and 0xFF.

[0072] In some embodiments, the third pattern checking unit 1330 may determine a count that is the sum of all bytes equal to any special value in the set of special values. In other embodiments, the third pattern checking unit 1330 may determine a count for each special value in the set of special values and may output each count. In one embodiment, the third pattern checking unit 1330 may determine a count for each special value and output the largest count or the maximum count for the data unit 1105.

[0073] The fourth pattern check unit 1340 in the pattern check logic 1300 counts the number of 16-bit words in the data unit 1105 that are equal to each other. In other words, the fourth pattern check unit 1340 determines the count of words with the same value in the data unit 1105. In some embodiments, the fourth pattern check unit 1340 can determine the largest count or the maximum count of the number of equal 16-bit words. In other embodiments, the fourth pattern check unit 1340 can output more than one count of the 16-bit words that are equal in the data unit 1105.

[0074] A fifth pattern check unit 1350 in pattern check logic 1300 calculates the sum of the two highest doubleword frequencies in data unit 1105. In other words, fifth pattern check unit 1350 determines the frequency or count of each doubleword in data unit 1105, determines which two doublewords have the highest counts or repetitions, and then sums the counts of the two different doublewords in data unit 1105 with the highest counts. For example, fifth pattern check unit 1350 may compare each doubleword in data unit 1105 with every other doubleword in data unit 1105, determine the sum of all repetitions of each different doubleword in the data unit, sum the two highest sums, and output the sum of the two highest sums. In other embodiments, fifth pattern check unit 1350 may output the sum of the three highest sums, the sum of the four highest sums, and / or the sum of more than four highest sums.

[0075] The sixth pattern check unit 1360 in the pattern check logic 1300 calculates the sum of the two highest nibble frequencies in the data unit 1105. In other words, the sixth pattern check unit 1360 determines the frequency or count of each nibble in the data unit 1105, determines which two nibbles have the highest counts or repetitions, and then sums the counts of the two different nibbles in the data unit 1105 with the highest counts. For example, the sixth pattern check unit 1360 may compare each nibble in the data unit 1105 with every other nibble in the data unit 1105, determine the sum of all repetitions of each different nibble in the data unit, sum the two highest sums, and output the sum of the two highest sums. In other embodiments, the sixth pattern check unit 1360 may output the sum of the three highest sums, the sum of the four highest sums, and / or the sum of more than four highest sums.

[0076] Figure 1H The figure shows an example of logic circuitry 1700 for sixth pattern check unit 1360 in pattern check logic 1300. Logic circuitry 1700 may extract each nibble 1 through N 1710 of data unit 1105 for input to decoders 1 through N 1720.

[0077] Each decoder 1 to N 1720 can decode a nibble to determine which output of the decoder represents the nibble. For example, a nibble has four bits, so decoder 1 has 16 outputs, but represents rows 0 to 15. Each row 0 to 15 represents a different nibble. Decoder 1 determines which row corresponds to nibble 1 and outputs a bit at that row. In some embodiments, the output at row 0 corresponds to the nibble "0000", the output at row 1 corresponds to the nibble "0001", and so on until the output at row 15, which corresponds to the nibble "1111". If nibble 1 is "0001", decoder 1 can output a 0 bit at row 0, a 1 bit at row 1, and then a series of zero bits at rows 2 to 15. In other embodiments, decoders 1 to N can output a 0 bit at a row corresponding to a nibble and a 1 bit at each row that does not match a nibble.

[0078] After decoder 1 to N output rows 0 to 15, where each bit represents each half byte 1 to N, logic circuitry 1700 determines the matched sum 1730. In the present embodiment, there are 16 different summation outputs from this stage. These outputs constitute a histogram of half byte values generated from the input data. For example, where data unit 1105 is a cache line, logic circuitry passes 128 half bytes to 128 decoder circuits to create a histogram. Logic circuitry passes the histogram to a comparator tree, which calculates the two highest values from the histogram and sums the two highest values to generate an output.

[0079] For an embodiment in which decoders 1 to N output one bit for matching, the sum of all "0" rows from decoders 1 to N indicates a count of nibbles, e.g., "0000"; the sum of all "1" rows from decoders 1 to N indicates a count of nibbles, e.g., "0001"; the sum of all "2" rows from decoders 1 to N indicates a count of nibbles, e.g., "0010"; the sum of all "3" rows from decoders 1 to N indicates a count of nibbles, e.g., "0011"; the sum of all "4" rows from decoders 1 to N indicates a count of nibbles, e.g., "0100"; and so on up to the sum of all "15" rows from decoders 1 to N, which indicates a count of nibbles, e.g., "1111". Thereafter, comparator tree 1740 can determine the sum of the two highest nibble frequencies.

[0080] In some embodiments, the logic circuitry for each pattern checking unit 1310 through 1380 identifies each entity, compares each entity to one or more other entities, and sums the results of the comparisons to determine or calculate an output.

[0081] The seventh pattern check unit 1370 in the pattern check logic 1300 calculates the sum of the frequencies of the two highest most significant nibbles in the data unit 1105. The data unit 1105 may comprise, for example, 16, 32, or 64 bytes. Each byte comprises a most significant nibble and a least significant nibble. The seventh pattern check unit 1370 may determine the frequency or count of each most significant nibble in the data unit 1105, determine which two most significant nibbles have the highest counts or repetitions, and sum the counts of the two different most significant nibbles in the data unit 1105 with the highest counts. For example, the seventh pattern check unit 1370 may compare each most significant nibble in the data unit 1105 with every other most significant nibble in the data unit 1105; determine the sum of all repetitions of each different most significant nibble in the data unit; sum the two highest sums; and output the sum of the two highest sums. In other embodiments, the seventh pattern check unit 1370 may output the sum of the three highest sums, the sum of the four highest sums, and / or the sum of more than four highest sums.

[0082] The eighth pattern check unit 1380 in the pattern check logic 1300 calculates the sum of the two highest least significant nibbles' frequencies in the data unit 1105. The data unit 1105 may comprise, for example, 16, 32, or 64 bytes. Each byte comprises a most significant nibble and a least significant nibble. The eighth pattern check unit 1380 may determine the frequency or count of each least significant nibble in the data unit 1105, determine which two least significant nibbles have the highest counts or repetitions, and sum the counts of the two different least significant nibbles in the data unit 1105 with the highest counts. For example, the eighth pattern check unit 1380 may compare each least significant nibble in the data unit 1105 with every other least significant nibble in the data unit 1105; determine the sum of all repetitions of each different least significant nibble in the data unit 1105; sum the two highest sums; and output the sum of the two highest sums. In other embodiments, the eighth pattern check unit 1380 may output the sum of the three highest sums, the sum of the four highest sums, and / or the sum of more than four highest sums.

[0083] The output of pattern checking logic 1300 may include one or more of the outputs from pattern checking units 1310 through 1380 and may be used as an input to entropy determination logic 1390, such as Figure 1E Entropy determination logic 1400 is shown in FIG.

[0084] Now refer to Figure 1A 、 Figure 1C and Figure 1E , Figure 1EThe figure illustrates an embodiment of entropy determination logic 1400 for memory logic circuitry 1015, 1026, 1035, 1046, 1061, and / or 1096. Entropy determination logic 1400 may receive one or more outputs from pattern check logic 1300, calculate an entropy index value for each of the one or more outputs based on the probability of entity repetition occurring in random data, and determine whether one or more or any of the entropy index values implicitly indicates that data unit 1105 is distinguishable from random data (low entropy) or indistinguishable from random data (high entropy). For example, for a pattern check logic having eight outputs, such as pattern check logic 1200, entropy determination logic 1400 may calculate eight entropy index values and compare the entropy index values to an entropy threshold to determine whether any of the entropy index values equals or exceeds the entropy threshold. In one embodiment, entropy determination logic 1400 may calculate eight entropy index values, determine a maximum entropy index value of all the entropy index values, and compare the maximum entropy index value to the entropy threshold to determine whether any of the entropy index values equals or exceeds the entropy threshold.

[0085] In many embodiments, entropy determination logic 1400 compares all entropy index values to a single entropy threshold. This entropy threshold represents the expected (or likely) amount of effort required by an attacker to corrupt the plaintext data to produce at least one of the patterns considered in pattern checking logic 1200. This probability relates to the highest or maximum entropy index value. Threshold comparison operation 1490 compares the highest or maximum entropy index value to the entropy threshold to determine whether at least one pattern check employed by pattern checking logic 1200 has identified an entity exhibiting a pattern exceeding the entropy threshold. If at least one pattern check unit output does convert to an entropy index value exceeding the entropy threshold, data unit 1105 is low entropy, meaning that data unit 1105 is distinguishable from random data. On the other hand, if none of the pattern check unit outputs convert to an entropy index value exceeding the entropy threshold, data unit 1105 is high entropy, meaning that data unit 1105 is indistinguishable from random data.

[0086] The entropy determination logic 1400 may include a set of one or more entropy determination units for determining an entropy index value based on the probability that a pattern with substantial repetition occurs in the random data. In this embodiment, the entropy determination logic 1400 includes a set of eight entropy determination units 1410 to 1480, which determine entropy index values based on the outputs of the pattern checking units 1210 to 1280, respectively.

[0087] The entropy determination logic 1400 can calculate an entropy index value by determining the probability that the random data will or will not include the bit pattern identified by the pattern check logic 1200. For example, the first entropy determination unit 1410 can receive a count of equal bytes from the pattern check unit 1210 and can determine an entropy index value that is the probability that the randomly generated data unit will include the count. The threshold comparison operation unit 1490 can then select the rarest pattern, which is the pattern with the smallest probability in the random data and the highest entropy index value, and compare the highest entropy index value with the entropy threshold.

[0088] The entropy determination logic 1400 may convert a count or number of entities exhibiting a pattern in the data unit 1105 into an entropy index value. To convert the count into an entropy index value, consider a data unit of type π Pattern p (eg, equal to the maximum number of bytes). If data unit 1105 x presents mode p and exactly N entities from x exhibit this pattern (e.g., the maximum number of equal bytes is exactly N), we denote this fact as:

[0089]

[0090] Entropy index value E With pattern type π Correlation, and entropy index value E equal The negative logarithm of the probability, assuming x is random (e.g., x output by a random oracle).

[0091]

[0092] According to the above definition, in the random data value x Find the pattern in p ( π , N ) has a probability of 2 -E Entropy index value E Can be measured in bits. In addition, in the display mode p ( π , N The expected number of random numbers to be checked before the random value of ) is 2 E . As a result, with the pattern type π The entropy index value associated with the number of entities N E This is equivalent to finding a value x such that The logarithm of the expected number of random values to check before.

[0093] For example, the pattern checking unit in the pattern checking logic 1200 determines that equal byte numbers or equal word numbers are suitable for protection of memory and storage data because many data units in a computing system contain code or data structures that exhibit repetition of valid byte or word values. The entropy determination unit 1410 can determine the entropy index value E1 based on the count output from the pattern checking unit 1210. In some embodiments, the entropy determination unit 1410 can determine the entropy index value E1 associated with the data unit 1105 consisting of n bytes, which shows that m bytes are equal to each other, by the following equation:

[0094]

[0095] In a further embodiment, the entropy determination unit 1410 may determine an entropy index value E associated with the data unit 1105 consisting of n 16-bit words, which exhibits m words being equal to each other, by the following equation:

[0096]

[0097] In order to successfully attack the byte or word equality pattern check unit, the attacker needs to generate corrupted plaintext data that exhibits m or more equal byte / word values. The probability of observing such equality in random data is calculated as the birthday collision probability associated with n elements, m collisions, and 256 (for bytes) or 65536 (for words) birthdays.

[0098]

[0099]

[0100] These birthday conflict probabilities are slightly higher than the probability values associated with the entropy index values given above. -E . This is because these birthday conflict probabilities include all events where there are more than m values that are equal in the data unit. Based on the cumulative entropy index distribution calculated over 111 million cache lines for byte and word equality pattern checks, respectively, entropy index values corresponding to relatively high security levels for implicit integrity (e.g., 32-bit, 24-bit) are associated with high pass rates in regular client data cache lines. For example, for a security level of 32 bits, if a byte equality pattern check is used, the percentage of cache lines that exhibit this entropy index value or higher is 85.275%. For a security level of 24 bits, the percentage of cache lines that exhibit this entropy index value or higher increases to 91.48%.

[0101] In the case where a single arbitrary byte value may be repeated, the pattern checking unit that counts the number of bytes that are equal to each other and occupy consecutive or adjacent index positions in the pattern checking logic 1200 is successful not only on data units containing code and data structures but also on uninitialized memory entries. The entropy determination unit 1420 can calculate the entropy index E2 associated with the data unit 1105 consisting of n bytes, which shows m bytes that are adjacent to each other and equal, by the following equation:

[0102]

[0103] In order to successfully attack the adjacent byte equality pattern check unit 1420, the attacker needs to generate corrupted plaintext data that exhibits m or more adjacent equal bytes. In random data, the probability that this may occur is:

[0104]

[0105] For the same reasons discussed above, this is slightly higher than the value 2 associated with the entropy index E. -E . The pass rate associated with this pattern check may not be as high as the pass rate associated with a byte or word equality pattern check. For entropy index values corresponding to 32-bit and 24-bit security levels, based on the cumulative entropy index distribution for adjacent byte equality pattern checks calculated over 111 million cache lines, the percentage of cache lines exhibiting such or higher entropy indices are 63.678% and 65.82%, respectively. One benefit of using this pattern check comes from the fact that this pattern check can be combined with byte and word equality pattern checks, which exhibit even higher pass rates for the same client cache lines.

[0106] The pattern checking unit 1230, which counts the maximum number of bytes that take a unique value from a set V, can successfully characterize code, data structures, and uninitialized memory entries. In our implementation and measurements, as an example, we consider a set V consisting of two unique values: 0x00 and 0xFF. Such values are frequently encountered in memory cache line data. The entropy determination unit 1430 can determine the entropy index value E3 associated with a data unit 1105 consisting of n bytes, where m bytes take values from the set V with a cardinality |V|, using the following equation:

[0107]

[0108] In order for an attacker to successfully attack the pattern check unit 1230, the attacker needs to generate corrupted plaintext data that exhibits m or more bytes having a special value from the set of V special values. In truly random data, this may happen with a probability of:

[0109]

[0110] For entropy index values corresponding to 32-bit and 24-bit security levels, based on the cumulative entropy index distribution for this pattern check calculated over 111 million cache lines, the percentage of cache lines exhibiting such or higher entropy indices is 63.83% and 66.47%, respectively. This pattern check can also be combined with the previous pattern check, resulting in an even stronger pattern check logic 1200.

[0111] The pattern checking unit 1240 calculates the number of 16-bit words that are equal to each other. The entropy determining unit 1240 can determine the entropy index value E4 associated with the data unit 1105 consisting of n words by the following equation, where the number of words that are equal to each other is equal to m:

[0112]

[0113] In order to successfully attack the pattern check unit 1240, the attacker needs to generate corrupted plaintext data showing m or more identical words. In truly random data, the probability of this happening is:

[0114]

[0115] The pattern check unit 1250 that calculates the sum of the two highest doubleword frequencies can be applied to the memory pointer table. We have observed from our experimental set of 111 million that there are several cache lines that do not exhibit valid byte or word duplication or repetition, but contain several pairs (1-2) of identical 32-bit or 64-bit sequences. These cache lines contain the memory pointer table. Having two pairs of identical 32-bit values appearing in a random cache line may be a rare event and may occur at a rate of 2 -49.84 The entropy determination unit 1250 can determine the entropy index value E5 associated with the data unit 1105 consisting of n double words by the following equation, where the sum of the two highest double word frequencies is equal to m:

[0116]

[0117] In order to successfully attack the pattern check unit 1250, the attacker needs to generate corrupted plaintext data that exhibits a double word with the sum of the two highest frequencies greater than or equal to m. In truly random data, the probability of this happening is:

[0118]

[0119] As in the other cases, this probability is similar to, but slightly higher than, the value 2 -E, because it includes all events in which the sum of the two highest doubleword frequencies, according to the cumulative entropy index distribution for this pattern check calculated over 111 million cache lines, exceeds m. The percentage of cache lines exhibiting such an entropy index or higher is 73.096% for both the entropy index values corresponding to the 32-bit and 24-bit security levels.

[0120] Pattern checking units 1260, 1270, and 1280 perform pattern checking on half-byte-based patterns and can be applied to "half-binary" data units. "Half-binary" refers to data that does not exhibit a pattern at the word or byte granularity but has a sufficiently low entropy index value to support corruption detection via implicit integrity. An example of such data is media data such as images, video frames, etc. Such data units may exhibit half-byte repetitions. The pattern checking discussed herein can calculate the sum of the two highest half-byte frequencies in data unit 1105. Three variations of pattern checking consider all half-bytes, the most significant half-byte, and the least significant half-byte. Pattern checking unit 1260 can use all half-bytes of data unit 1105 to calculate the sum of the two highest half-byte frequencies. Pattern checking unit 1270 can use only the most significant half-byte of the bytes from data unit 1105 to calculate the sum of the two highest half-byte frequencies. Pattern checking unit 1280 can use only the least significant half-byte of the bytes from data unit 1105 to calculate the sum of the two highest half-byte frequencies.

[0121] In general, the entropy determination unit 1460 may calculate the entropy index E6 associated with the data unit 1105 consisting of n nibbles, where the sum of the two highest nibble frequencies is equal to m, by the following equation:

[0122]

[0123] In order to successfully attack the pattern check unit 1260, the attacker needs to generate corrupted plaintext data that exhibits two nibbles with a sum of the highest frequencies greater than or equal to m. In random data, the probability that this data pattern may occur is:

[0124]

[0125] The benefit of using such a pattern checking unit or pattern detector comes from the fact that it can be combined with byte and word related pattern checking, resulting in a combined scheme that can significantly improve the observed overall pass rate. For the 32-bit security level, the combined scheme exhibited a pass rate of 91.109% based on the cumulative entropy exponential distribution for this pattern check calculated over 111 million cache lines. For the 24-bit security level, the combined scheme exhibited a pass rate of 94.476% based on the cumulative entropy exponential distribution for this pattern check calculated over 111 million cache lines.

[0126] Now refer to Figure 1A 、 Figure 1B and Figure 1F , Figure 1F The diagram illustrates an embodiment 1500 for encoding and merging a tag 1515 with a data unit 1105 by memory logic circuitry 1015, 1026, 1035, 1046, 1061, and / or 1096. Memory logic circuitry 1015, 1026, 1035, 1046, 1061, and / or 1096 may receive as input a data unit 1105 associated with a tag 1515 for storage in a memory such as memory 1012. Through the encoding process, the tag 1515 is embedded into the encoded data unit 1520 before the encoded data unit 1520 is stored in memory to support implicit integrity. In many embodiments, memory logic circuitry 1015, 1026, 1035, 1046, 1061, and / or 1096 merges the tag 1515 with the data unit 1105 without expanding the size of the data unit 1105. In other words, in these embodiments, the encoded data unit 1520 has the same size (same number of bits) as the data unit 1105 .

[0127] Memory logic circuitry 1015, 1026, 1035, 1046, 1061, and / or 1096 may be configured to Figure 1E The maximum entropy index value E for data unit 1105 determined by entropy determination logic 1400 shown in FIG is “split” into two entropy index values E1 and E2. The first entropy index value E1 is equal to the security level of implicit integrity, which is supported by the implicit integrity operation of memory logic circuitry 1015, 1026, 1035, 1046, 1061 and / or 1096. In many embodiments, the first entropy index value is combined with Figure 1E The entropy threshold discussed in the entropy comparison operation unit 1490 shown in FIG.

[0128] The second entropy index value, E2 = E-E1, is the difference between the entropy index value, E, of data unit 1105 and the supported security level, E1, and is equal to the length of the tag that can be embedded in encoded data unit 1520 without expanding the data unit. For example, if data unit 1105 exhibits a 24-bit entropy index value, the entropy index can be split into two parts. The first part, E1 = 16 bits, reflects the overall security level provided. The second part, E2 = 8 bits, is the maximum length of tag 1515 that memory logic circuitry 1015, 1026, 1035, 1046, 1061, and / or 1096 can embed in encoded data unit 1520 without expansion. This implicit integrity operation advantageously provides a zero-overhead compression technique with respect to storage space, allowing tag 1515 to be incorporated into data unit 1105 without incurring typical compression costs, such as reserved bits for dictionaries, offsets, length values, and the like. In many embodiments, tag 1515 can be any value. For example, tag 1515 may contain access control information, policy data, error correction information, and / or any other data.

[0129] Figure 1G The figure shows a decoding process that separates tag 1515 and data unit 1105 from coded data unit 1520. When tag 1515 is incorporated into coded data unit 1520 without expansion, the decoding process does not uniquely return data unit 1105. When memory logic circuitry 1015, 1026, 1035, 1046, 1061, and / or 1096 decodes coded data unit 1520, the decoding process generates lists of decoded pairs 1620, 1630, through 1640. Each decoded pair in lists of decoded pairs 1620, 1630, through 1640 includes a data unit and a tag. If coded data unit 1520 has not been damaged, one of the decoded pairs 1640 includes data unit 1105 and tag 1515.

[0130] Based on the specifications of the encoding process, data unit 1105 will be the least random data unit in the decoded pair. Therefore, memory logic circuitry 1015, 1026, 1035, 1046, 1061, and / or 1096 can determine which decoded pair in the lists of decoded pairs 1620, 1630, and 1640 includes data unit 1105 and label 1515 by implementing entropy determination logic 1400 to calculate the maximum entropy index value for each data unit in the decoded pair. In particular, entropy determination logic 1400 can calculate, for example, entropy index values E1 through E8 and determine the highest entropy index value of entropy index values E1 through E8. The decoded pair with the highest maximum entropy index value includes data unit 1105 and label 1515.

[0131] For illustration, the list of decoding pairs 1620, 1630, and 1640 includes a maximum entropy index value Ea for decoding pair 1620, a maximum entropy index value Eb for decoding pair 1630, and a maximum entropy index value Ec for decoding pair 1640. These maximum entropy index values Ea, Eb, and Ec are the maximum values of the entropy index values calculated by entropy determination logic 1400 for the data units within each of these decoding pairs. By comparing the maximum entropy index values Ea, Eb, and Ec to determine which decoding pair has the highest maximum entropy index value, the separation logic of memory logic circuitry 1015, 1026, 1035, 1046, 1061, and / or 1096 can determine which decoding pair includes data unit 1105 and tag 1515. In this embodiment, Ec is greater than Eb and greater than Ea, so decoding pair 1640 includes data unit 1105 and tag 1515.

[0132] In many embodiments, entropy determination logic 1400 compares the maximum entropy index value Ec to an entropy threshold to determine whether Ec is greater than the entropy threshold. The entropy threshold may relate to a security level, such as a 64-bit security level. Memory logic circuitry 1015, 1026, 1035, 1046, 1061, and / or 1096 may provide protection against intentional alteration of encoded data units 1520 by requiring data units 1105 to exhibit an entropy index value above the entropy threshold. By determining which of the returned data units is least random, obtaining its associated tag 1515, and confirming that the maximum entropy index value of the data unit is greater than the entropy threshold, memory logic circuitry 1015, 1026, 1035, 1046, 1061, and / or 1096 may provide lossless recovery of embedded tag value tag 1515.

[0133] If Ec is less than the entropy threshold, coded data unit 1520 may be corrupted and decoding pair 1640 may be invalid. In such instances, embodiments may perform one or more different data integrity operations. For example, memory logic circuitry 1015, 1026, 1035, 1046, 1061, and / or 1096 may determine that coded data unit 1520 is corrupted; may perform corrective measures on coded data unit 1520 and perform the decoding process again; may determine that coded data unit 1520 was not encoded with an implicit integrity operation and may search for an associated MAC or ICV to decode coded data unit 1520 with the MAC or ICV; and / or may search for error correction information to perform error correction on coded data unit 1520. In further embodiments, memory logic circuitry 1015, 1026, 1035, 1046, 1061, and / or 1096 may perform other data integrity operations.

[0134] Figure 1IAn embodiment of a graph 1800 depicts a display of cache line pass rates using implicit data integrity and cache line pass rates using integrity check values (ICVs), where the ICVs are stored in ICV cache locations. Graph 1800 shows that if a small cache location for the ICV is used, the cumulative pass rate jumps to over 95%.

[0135] The results in chart 1800 are based on security level (31 bits) and were collected from 111 million representative client workload cache lines and from 1.47 billion representative server workload cache lines. The pass rate comparison is between the standard ICV cache hit rate and the embodiments of memory logic 1015, 1026, 1035, 1046, 1061 and / or 1096 and indicates the percentage of cache lines that are compatible with the corresponding integrity operation.

[0136] The chart shows pass rates for a number of different client workloads, such as Microsoft Office, transcoding, and video players. When extended pattern matching is used, the pass rate is approximately 98%. Overall, the average pass rate with extended pattern matching is 91%. For server data, the corresponding pass rate is 84%. Chart 1800 also shows the integrity check value (ICV) cache hit rate for these algorithms.

[0137] Now refer to Figure 1A 、 Figure 1B and Figure 1J , Figure 1J The diagram illustrates an embodiment of an implicit data integrity operation 1900 performed by memory logic circuitry 1015, 1026, 1035, 1046, 1061, and / or 1096 that includes error correction codes in tags for correcting corrupted coded data units. In this embodiment, memory logic circuitry 1015, 1026, 1035, 1046, 1061, and / or 1096 may decrypt encrypted blocks 1 through N illustrated in row 1910. Decoder logic shown in row 1920 of memory logic circuitry 1015, 1026, 1035, 1046, 1061, and / or 1096 may decrypt and separate blocks 1 through N and associated tags 0 through N shown in block 1930.

[0138] In this embodiment, the encoder logic computes each error correction code from a ciphertext block rather than a plaintext block. Furthermore, for embodiments in which message blocks form a chain, the encoder logic embeds each error correction code in an adjacent message block so that the error correction code can be obtained from a tag included, for example, in a previously decoded encrypted block. In some embodiments, the encoder logic of memory logic circuitry 1015, 1026, 1035, 1046, 1061, and / or 1096 may encrypt blocks 1 through N and decrypt blocks 1 through N in groups of M blocks, where M can be any positive integer. In some embodiments, the encoder logic may encrypt the last block, block N, without embedding a tag or if the tag contains information unrelated to error correction (e.g., information related to access control). In several embodiments, the encoder logic may not embed a tag with an error correction code for the first block in the chain, but may instead store the error correction code separately.

[0139] Each encrypted block 1 through N may include a tag with an error correction code for subsequent encrypted blocks. In particular, tags 0 through N include an error correction code for correcting errors in encrypted blocks 1 through N. Tag 0 is the error correction code for encrypted block 1. Tag 0 may be merged with the previously separated block 0 in encrypted block 0 or may be stored in a separate location in memory from which the decoder logic receives encrypted block 1. If the decoder logic determines that the decoded pairs determined from encrypted block 1 (such as decoded pairs 1620, 1630, and 1640) all have maximum entropy index values less than an entropy threshold, the decoder logic may determine that encrypted block 1 is corrupted and may perform error correction on encrypted block 1 using tag 0. Thereafter, the decoder logic may attempt to decrypt and separate encrypted block 1 again to determine that block 1 and tag 1 are uncorrupted decrypted data units and tags for encrypted block 1.

[0140] After separating Block 1 and Tag 1 from Encrypted Block 1, the decoder logic can decode and separate Encrypted Block 2. If the decoder logic determines that Encrypted Block 2 is corrupted, the correction logic circuitry 1015, 1026, 1035, 1046, 1061, and / or 1096 of the memory logic can perform error correction measures on Encrypted Block 2 using the error correction code in Tag 1. Thereafter, the decoder logic can decode Encrypted Block 2 to determine that Block 2 and Tag 2 are an uncorrupted decryption pair for Encrypted Block 2 based on Block 2 having the highest maximum entropy index value and verification that the maximum entropy index value for Block 2 is greater than the entropy threshold. This process can continue until the decoder logic has decrypted encrypted blocks up to Encrypted Block N.

[0141] Figure 1K An embodiment of a code snippet for performing a pattern check and comparing the repetition of entities within a data unit or message to a threshold value is depicted. In this embodiment, the code snippet performs the Figure 1CThe output of this code snippet includes a Boolean response of true or false. A "true" output indicates that the data unit passed, and a "false" output indicates that the data unit failed or did not pass.

[0142] If the pattern checking logic determines that the repetition of entities in the data unit for at least one pattern equals or exceeds the threshold for the at least one pattern, the code snippet passes the data unit. Otherwise, the code snippet outputs a failure.

[0143] In some embodiments, if a data unit such as data unit 1105 fails, the data unit may be corrupted, may be an encoded data unit, or may include data that is too random for the current embodiment to distinguish the data unit from random data.

[0144] In further embodiments, the code snippet may test the data for compatibility with implicit integrity operations. If the data unit is distinguishable from random data, memory logic circuitry 1015, 1026, 1035, 1046, 1061, and / or 1096 may use the implicit integrity operation to encrypt the data unit for storage in memory, or merge the tag with the data unit during encryption and store the encrypted data unit in memory.

[0145] If the data unit is indistinguishable from random data, memory logic circuitry 1015, 1026, 1035, 1046, 1061 and / or 1096 may protect the data unit with a MAC or ICV and store both the encrypted data unit and the MAC or ICV in memory.

[0146] FIG1L(AC) depicts an embodiment of a code snippet for performing pattern checking and comparing the repetition of entities within a data unit to an entropy index threshold. In this embodiment, the code snippet performs the following steps: Figure 1C The output of this code snippet includes a maximum security operator for indicating the maximum entropy index value for a data unit, a best behavior operator for indicating the pattern with the highest or maximum entropy index value, and a cumulative security operator for indicating the probability of detecting a pattern in random data.

[0147] After performing the entropy determination, the encoder logic of memory logic circuitry 1015, 1026, 1035, 1046, 1061, and / or 1096 may determine a maximum size tag that may be merged with the data unit in the encrypted data unit for storage in memory. In some embodiments, the encoder logic may confirm that a fixed-size tag may be embedded with the data unit in the encrypted data unit. Note that an encrypted data unit is an encoded data unit that is encoded using an encryption operation.

[0148] 1M(AD) depicts an embodiment of a code snippet for encoding a data unit with a tag to merge the data unit with the tag without message expansion, the data unit being a cache line. The code snippet implements an implicit integrity operation of the cipher logic of memory logic circuitry 1015, 1026, 1035, 1046, 1061, and / or 1096 to embed the tag along with the cache line in an encrypted data unit using an Advanced Encryption Standard (AES) key.

[0149] The code segment is used in conjunction with the decoding code segment not shown in the figure. The encoding segment determines whether the data unit is encodable. Both the encoding code segment and the decoding code segment are verified by Figure 1D The threshold comparison logic 1300 shown in FIG. Figure 1E The output of the entropy determination logic 1400 shown in is used to determine whether the data unit has low entropy. Thereafter, the code snippets use the first set of secrets and a mask that exposes the most significant bit of the cache line to retrieve the most significant bit. Then, the code snippets use the second set of secrets and a mask that exposes information about the least significant bit of the cache line to obtain multiple suggested values for the least significant bit and the embedded tag. By doing so, the code snippets can embed or extract any tag into any cache line with a sufficiently high entropy index without typical overhead such as compression metadata, offsets, etc. For the purposes of this description in this embodiment, the data unit or cache line is referred to as message A.

[0150] The code snippet first uses the first stage key K to generate the amount A' d Encrypt message A. The purpose of this encryption stage is to support strong obfuscation and diffusion of the input bits of message A, so that each bit of the entity to be encoded (A') is strongly dependent on all bits of the original message A.

[0151] Equation 1

[0152] The code snippet uses the two masks defined in Equation 2-4. The low-order mask m1 is the first k-bit secret value that can be derived from the master key or adjustment T. The high-order mask M1 is the second k-bit secret value, also derived from the master key or adjustment T, followed by 2k zeros.

[0153] m 1 ← derived from the master key or adjustment T k Bit Secret Equation 2

[0154] S M ←Derived from the master key or adjusted T k Bit Secret Equation 3

[0155] Equation 4

[0156] We note that in the following description, the operator msb w () and lsb w () refer to the entity w The most and least significant bits, operator {0} w means w A string of zeros, the symbol "|" indicates a cascade operation.

[0157] From the secret S 2 The code snippet computes the secret used during the encoding and decoding process. S 1 、 S 3 and S 4 . Code snippet in domain GF( p q ) performs the calculation, where p is a prime modulus and the upper limit (log2 p )∙ q = n The derivation of these secrets is shown in Equation 5.

[0158]

[0159] Equation 5

[0160] .

[0161] From Equation 5, it is clear that the secret S 1 、 S 3 and S 4 May be dense, "look random" and related to secret S 2 Just as hard to guess. Secret S 1 、 S3 and S 4 satisfies some interesting properties that are useful during encoding and decoding. S 1 and S 3 Multiplication returns 1. S 2 and S 3 Multiplication returns the low-order mask m 1 . S 2 and S 4 Multiplication returns a high-order mask M 1 .at last, S 1 and S 4 Multiplication equals m 1 -1 ∙M 1, which should also be difficult to guess, especially for larger k These properties are shown in Equation 6.

[0162] Equation 6.

[0163] To encode the quantity A' together with the label B, the algorithm encodes the quantity Q Calculated as:

[0164] Equation 7

[0165] Where in Equation 7, the code snippet is in GF( p q ) is used to perform the calculation. The code snippet then uses the encryption key K e Encrypt Q to generate ciphertext C.

[0166] Equation 8

[0167] The ciphertext C represents the encrypted data unit of the original message A, where the encryption operation includes the operation of embedding the tag B into the ciphertext. The length of C is equal to the length of A, so the memory logic circuit system can store C without using additional storage for the tag. Length parameter k Should be ≤n / 2.

[0168] Although the code snippets for decoding encrypted data unit C are not included in FIG1M(ad), the decryptor logic of memory logic circuitry 1015, 1026, 1035, 1046, 1061, and / or 1096 can use the same key as the encryptor logic in the above code snippets. The encryptor logic can receive an encrypted data unit having ciphertext C from memory.

[0169] In many embodiments, to process the ciphertext C, the code snippet first uses the key K e Decrypt C to obtain the quantity Q. Algorithm settings:

[0170] Equation 9

[0171] The algorithm then multiplies Q with the secret S3 to obtain the value V1:

[0172] Equation 10

[0173] Lemma 1: If no corruption occurs, then the value V1 should be equal to A ΄ + B ∙ m 1

[0174] Proof of Lemma 1: Using the properties of Equation 6, Q ∙ S 3 = A ΄∙ S 1∙ S 3+ B ∙ S 2∙ S 3 = A ΄ + B ∙ m 1. From the value V1, the algorithm computes a second quantity V2, which is defined as the n-2k most significant bits of V1:

[0175] Equation 11

[0176] Lemma 2: If no corruption has occurred, then the value V2 should be equal to the n-2k most significant bits of A'.

[0177] Proof of Lemma 2: Without obvious loss of generality, we can assume that the finite field GF( p k ) does not carry propagate on 2k-bit quantities. It is easy to see that the quantity B∙m1 is no larger than 2k bits. Furthermore, adding B∙m1 to A' does not cause a carry to propagate from the 2k least significant bits of A' + B∙m1 to its n-2k most significant bits. Therefore:

[0178] Equation 12

[0179] And Lemma 2 is proved.

[0180] After recovering the n-2k most significant bits of A', the code snippet proceeds to recover the proposed value of the 2k least significant bits of A'. To accomplish this, the code snippet combines Q with the secret S 4 Multiply and subtract the recovered n-2k most significant bits of A' by S 1∙ S 4, to obtain the value V3:

[0181] Equation 13

[0182] Lemma 3: If no corruption occurs, then the value V3 is equal to lsb 2k ( A ΄) ∙m 1 -1 ∙M 1+ B ∙ M 1.

[0183] Proof of Lemma 3: Using the properties of Equation 6, Q ∙ S 4 = A ΄∙ S 1∙ S 4+ B ∙ S 2∙ S 4 = A ΄ ∙m 1 -1 ∙M 1+ B ∙ M 1. On the other hand, ( V 2|{0} 2k )∙ S 1∙ S 4 = (msb n-2k ( A ΄) |{0} 2k )∙ m 1 -1 ∙M 1. From A ΄ ∙m 1 -1 ∙M Subtract this amount from 1, resulting in an equal lsb 2k ( A ΄) ∙m 1 -1 ∙M The value of 1. Therefore, Lemma 3 is proved.

[0184] Starting from the value V3, the code snippet calculates the quantity V4, which is defined as:

[0185] Equation 14

[0186] Lemma 4: If no corruption occurs, then the value V4 should be equal to the quantity lsb 2k ( A ΄) ∙m 1 -1 ∙M The 2k least significant bits of 1.

[0187] Proof of Lemma 4: We can assume that the finite field GF( p q ) does not carry propagate on 2k-bit quantities. From the definition of the high-order mask M1 and the fact that the size of the label B does not exceed k bits, it is clear that the quantity B∙M1 has its 2k least significant bits set to zero. The result is:

[0188] Equation 15

[0189] And Lemma 4 is proved.

[0190] The code snippet can be obtained from Equation 15 and from the values V4 and m 1 -1 ∙M Determine the 2k-bit unknown quantity LSB using the knowledge of 1 2k ( A Equation 15 describes a system of equations where the unknown is the quantity lsb 2k ( A ΄), there are as many equations as there are unknowns, and the equations are linear. If the determinant of Equation Group 15 is not zero, then Equation Group 15 will deterministically return the 2k least significant bits of A' from which the embedded tag B will be derived. This will lead to a contradiction, namely that our n-bit encoding is deterministically reversible, resulting in perfect recovery of the n-bit original message and the k-bit tag. Since, this is impossible, the determinant of Equation Group 15 must always be zero. This property is also observed in practice. For these reasons, for the least significant bit lsb 2k ( A ΄), Equation 15 returns not a single solution but 2k possible solutions, starting from the least significant bit lsb 2k ( A ΄) derives 2k corresponding values for label B.

[0191] From these solutions, only one solution (a pair) is the least random, and in many embodiments, this pair should exhibit a pattern associated with some minimum security level or entropy threshold. For example, the entropy threshold can be 24 bits. If the solution with the highest entropy index value returned with the 2k possible solutions does not exhibit an entropy index value above the entropy threshold, corruption is detected. If the highest maximum entropy index value is also greater than the entropy threshold, the code snippet can be protected by setting label B equal to the solution with 2 k The embedded label B is recovered by associating the label with the message with the highest maximum entropy index value among the possible solutions.

[0192] When solving the system of equations 15, the code snippet obtains multiple solutions. Let one solution be V5. From the values V2 and V5, the code snippet obtains a suggested value A'' for the encoding amount A' which is the concatenation of V2 and V5.

[0193] Equation 16

[0194] From the value A'', the code snippet calculates the proposed value B'' for the embedded tag. The process followed is based on Equation 7:

[0195] Equation 17

[0196] The code snippet repeats the steps of Equation 16 and Equation 17 and adds the following code for all 2 of Equation 15: k The solution is to invert the encryption of Equation 1 to obtain the 2 k values. The final implicit integrity operation involves implementing entropy determination logic 1400 to determine a suggested value A from the return value with the highest maximum entropy index value and its associated label B. This value A is the least random of the return values and is further checked by the code snippet to determine whether the calculated maximum entropy index value for this value A is above the entropy threshold. If so, the code snippet returns value A and the associated label B as the decoded value and label. If the encoded data unit is corrupted, then 2 of Equation 15 k A solution will result in 2 k The probability that the minimum random solution exhibits an entropy index value above a certain threshold E is equal to 2 -(E-k). This fact shows that the algorithm supports a security level of Ek bits of implicit integrity. This fact also shows that the entropy index E that characterizes the data unit being encoded is the sum of two entropy index values. The first value is equal to Ek, and further equal to the security level provided. The second value is equal to k bits, and further equal to the length of the tag that can be embedded in message A without message expansion. This concept can be further applied to groups of message blocks. For example, setting E = 10 and k = 6 on a set of 8 cache lines results in 32 bits of security and the ability to embed 48 bits of additional content into the cache line.

[0197] Reference again Figure 1A , first processor 1010 is coupled to chipset 1060 via PP interconnects 1052 and 1062, and second processor 1030 is coupled to chipset 1060 via PP interconnects 1054 and 1064. Direct media interfaces (DMIs) 1057 and 1058 may couple PP interconnects 1052 and 1062, and PP interconnects 1054 and 1064, respectively. DMI may be a high-speed interconnect that facilitates, for example, eight gigatransfers per second (GT / s), such as DMI 3.0. In other embodiments, processors 1010 and 1030 may be interconnected via a bus.

[0198] Chipset 1060 may include a controller hub, such as a platform controller hub (PCH). Chipset 1060 may include a system clock for performing clock functions and include interfaces for I / O buses, such as Universal Serial Bus (USB), Peripheral Component Interconnect (PCI), Serial Peripheral Interconnect (SPI), Integrated Circuit (I2C), etc., to facilitate the connection of peripheral devices on the platform. In other embodiments, chipset 1060 may include more than one controller hub, such as a chipset with a memory controller hub, a graphics controller hub, and an input / output (I / O) controller hub.

[0199] In this embodiment, chipset 1060 may include an interface (I / F) 1066 coupled to flash memory 1067. I / F 1066 may be, for example, Peripheral Component Interconnect Express (PCI-e). Chipset 1060 may also be coupled to a Trusted Platform Module (TPM) 1072 and a UEFI, BIOS, and flash memory component 1074 via an interface (I / F) 1070. TPM 1072 is a dedicated microcontroller designed to protect hardware by integrating encryption keys into the device. UEFI, BIOS, and flash memory component 1074 may provide pre-boot code.

[0200] In addition, chipset 1060 includes an I / F 1066 to couple chipset 1060 to a high-performance graphics engine, namely, graphics card 1065. In other embodiments, system 1000 may include a flexible display interface (FDI) between processors 1010 and 1030 and chipset 1060. The FDI interconnects the graphics processor cores in the processors with chipset 1060.

[0201] Various I / O devices 1092 are coupled to bus 1081, as well as a bus bridge 1080 that couples bus 1081 to a second bus 1091 and an I / F 1068 that connects bus 1081 to chipset 1060. In one embodiment, second bus 1091 may be a low pin count (LPC) bus. Various devices may be coupled to second bus 1091, including, for example, a keyboard 1082, a mouse 1084, a communication device 1086, and a data storage unit 1088 that may store code such as a compiler 1096. Additionally, an audio I / O device 1090 may be coupled to second bus 1091. Many of I / O devices 1092, communication devices 1086, and data storage unit 1088 may reside on motherboard 1005, while keyboard 1082 and mouse 1084 may be additional peripheral devices. In other embodiments, some or all of the I / O devices 1092 , communication devices 1086 , and data storage unit 1088 are add-on peripheral devices and do not reside on the mainboard 1005 .

[0202] Figure 2 An embodiment of a memory logic circuitry 2000 for performing implicit data integrity operations is depicted. The memory logic circuitry 2000 may reside in any memory controller, such as an integrated memory controller, a solid-state drive controller, a flash memory controller, a hard drive controller, a cache controller, and the like. The memory logic circuitry 2000 may also implement any or all of the operations or processes discussed in conjunction with the memory logic circuitry 1015, 1026, 1035, 1046, 1061, and / or 1096 with any type of data storage device. For example, the memory logic circuitry 2000 may encode or encrypt data stored in a computer such as a memory controller. Figure 1A Some or all of the data units in the main memory of the memory 1012 shown in FIG and stored in Figure 1A Some or all of the data units in the data storage device 1088 shown in .

[0203] Memory logic circuitry 2000 may include circuitry; a combination of circuitry, code, and a processor that executes the code; or a combination of code and a processor that executes the code, such as in conjunction with Figure 1K1L(ac) and 1M(ad). For example, memory logic circuitry 2000 may include a state machine and / or an application specific integrated circuit (ASIC) to perform some or all of the functionality of memory logic circuitry 2000.

[0204] Memory logic circuitry 2000 may receive unencoded data units to store in memory, or receive encoded data units retrieved from memory. In some embodiments, memory logic circuitry 2000 may test data units to detect encrypted data units that should be unencoded data units.

[0205] Memory logic circuitry 2000 may include randomness logic 2005. Randomness logic 2005 may determine the randomness of a data unit. In many embodiments, memory logic circuitry 2000 may determine whether a data unit is compatible with implicit integrity operations. In this embodiment, randomness logic 2005 includes pattern check logic 2010, threshold comparison logic 2020, and entropy determination logic 2030. Randomness logic 2005 may selectively implement threshold comparison logic 2020, pattern check logic 2010, entropy determination logic 2030, or both.

[0206] Threshold comparison logic 2020 may calculate a value indicating whether an entity pattern exists in a data unit and whether the number of repetitions of the pattern in the data unit exceeds a threshold for the pattern, such as in combination with Figure 1C and Figure 1D In many embodiments, threshold comparison logic 2020 determines this value directly from the input, data element 1105, without first determining a count of repetitions and comparing that count to a threshold. For embodiments implemented at least partially in an integrated circuit, such embodiments advantageously make efficient use of silicon area on the integrated circuit, and for embodiments implementing such functionality in code, such embodiments make efficient use of processor cycles.

[0207] In further embodiments, threshold comparison logic 2020 may determine a count of patterns of entities in a data unit and compare each count or value to a set of one or more threshold values. In many embodiments, threshold comparison logic 2020 determines or has different threshold values for each pattern in threshold comparison unit(s) 2021. For example, threshold comparison logic 2020 may include or have access to a threshold table. The threshold table may include threshold values for one or more different security levels. For example, the threshold table may include a value for each pattern in threshold comparison unit(s) 2021 for 32-bit security, 64-bit security, 128-bit security, etc. In further embodiments, threshold comparison logic 2020 may include an equation or calculation for each threshold value in the threshold table to adjust the threshold value based on the selected security level.

[0208] Threshold comparison logic 2020 can compare each count of a pattern from threshold comparison unit(s) 2021 to determine whether each count is greater than or equal to a corresponding threshold. Threshold comparison logic 2020 can determine an indication for each threshold comparison unit(s) 2021, such as a true or false indication or a logical one or logical zero indication. In many embodiments, if threshold comparison logic 2020 identifies the presence of at least one pattern in a data unit and the count of repetitions of the pattern exceeds a corresponding threshold, the data unit can be distinguished from random data. Threshold comparison logic 2020 can output an indication, such as a true or false indication or a logical one or logical zero indication, to indicate, respectively, that the data unit is distinguishable from random data or cannot be distinguished from random data. For example, threshold comparison logic 2020 can include Boolean logic 2022 to determine true for each count that is greater than or equal to a corresponding threshold, and false for each count that is less than the corresponding threshold. In some embodiments, Boolean logic 2022 can output true to indicate that at least one of the counts is equal to or greater than the corresponding threshold, or false to indicate that no count is equal to or greater than the corresponding threshold.

[0209] The pattern check logic 2010 can attempt to identify one or more bit patterns in the data unit. In many embodiments, the bit pattern can include the repetition of one or more entities. An entity is a group of two or more bits such as a nibble, a byte, a word, and a double word. A nibble can be half of a byte, which is four bits. A byte is 8 bits. A word can be 16 bits and a double word can be 32 bits. In other embodiments, a word can be defined as a different number of bits, such as 8 bits or 32 bits, and a double word is the size of two words, but the discussion herein defines a word as 16 bits to avoid confusion.

[0210] The mode check logic 2010 may include one or more mode check units 2012, such as Figure 1C. The pattern checking unit(s) 2012 may divide the data unit into entities such as nibbles, bytes, words, or double words and determine whether a particular pattern of one or more entities exists in the data unit. For example, the pattern checking unit(s) 2012 may determine a count of the total number of repetitions of identical entities in the data unit. In some embodiments, the entity may be a particular nibble, byte, word, or double word, such as a particular value or any value from a set of particular values. In some embodiments, the pattern checking unit(s) 2012 may determine a count of each distinct entity in the data unit and determine a maximum count or two highest counts.

[0211] In some embodiments, the pattern checking logic 2010 may selectively implement one or more pattern checking units 2012 based on the data unit or other factors. In other embodiments, the pattern checking logic 2010 may implement all available pattern checking unit(s) 2012 for each data unit.

[0212] After performing the pattern check, each of the pattern checking unit(s) 2012 may output a count or value representing, indicating, or equal to the sum of the repetitions of entities in the data unit corresponding to the pattern detected by the pattern checking unit. In some embodiments, the pattern checking logic 2010 sends the output to the entropy determination logic 2030.

[0213] The entropy determination logic 2030 may receive a count from each of the pattern checking unit(s) 2012 and determine an entropy index value for the count associated with the data unit from each of the pattern checking unit(s) 2012. In some embodiments, the entropy determination logic 2030 may selectively determine an entropy index value for the count from one or more of the pattern checking unit(s) 2012.

[0214] After determining the entropy index value, the entropy comparison logic 2032 of the entropy determination logic 2030 may compare the entropy index value with an entropy threshold value. In many embodiments, the entropy comparison logic 2032 includes maximum logic 2034 that determines a maximum entropy index value based on the entropy index values calculated from the counts for each of the pattern check unit(s) 2012, and compares the maximum entropy index value with the entropy threshold value. The entropy threshold value may be related to a security level, and both the maximum entropy index value and the entropy threshold value may indicate a number of bits or a bit count.

[0215] The memory logic circuitry 2000 may determine whether a data unit is corrupted or incompatible with implicit integrity operations based on a comparison of a maximum entropy index value for the data unit with an entropy threshold. In several embodiments, if the maximum entropy index value is less than the entropy threshold and the data unit is unencoded data received by the memory logic circuitry 2000 for storage in memory, the validity logic 2060 of the memory logic circuitry 2000 may determine that the data unit is incompatible with implicit integrity operations and perform standard data integrity operations, such as calculating and separately storing a MAC or ICV associated with the data unit. On the other hand, if the maximum entropy index value is greater than the entropy threshold and the data unit is unencoded data received by the memory logic circuitry 2000 for storage in memory, the validity logic 2060 of the memory logic circuitry 2000 may determine that the data unit is compatible with implicit integrity operations and pass the data unit and an optional associated tag to the encoder logic 2040.

[0216] Encoder logic 2040 may receive an unencoded data unit compatible with the implicit integrity operation of memory logic circuitry 2000 and implement encryptor logic 2042 to encrypt the data unit. Encryptor logic 2042 may include one or more keys, adjustments, masks, etc. to encrypt the data unit. In many embodiments, encoder logic 2040 receives a data unit with a tag or generates or selects a tag to be included with the data unit. For example, encoder logic 2040 may receive the data unit and perform a hash operation to determine an error correction code to be included in the tag with the data unit.

[0217] The encoder logic 2040 may include a merger logic 2044 for operating in conjunction with the encryptor logic 2042 to encrypt and merge the data unit with the tag during the creation of the encoded data unit. In some embodiments, the merger logic 2044 may determine whether the tag can be merged with the data unit. For example, the merger logic 2044 may subtract an entropy threshold from the maximum entropy index value for the data unit to determine the maximum size of the tag. If the tag is less than or equal to the maximum size for the tag, the merger logic 2044 may merge the tag with the data unit in the encoded data unit without expanding the size of the data unit. In other embodiments, the encoder logic 2040 may generate a tag that is less than or equal to the maximum size for the tag.

[0218] After creating or determining the coded data unit for the data unit, the memory logic 2000 may store the coded data unit in memory.

[0219] The memory logic circuitry 2000 may also include decoder logic 2070 for decoding encoded data units retrieved from the memory. Decoder logic 2070 may include decryptor logic 2072, separator logic 2074, and selection logic 2076. Decryptor logic 2072 may include one or more keys, adjustments, masks, etc. to decrypt the encoded data units. In some embodiments, decryptor logic 2072 may operate in conjunction with separator logic 2074 to decrypt and separate the tag and data unit from the encoded data unit. In some embodiments, decryptor logic 2072 and separator logic 2074 generate a list of suggested pairs of data units and tags when decoding the encoded data units. If the encoded data unit is not corrupted, the suggested pair list includes the data unit and tag that can be identified by selecting the least random data unit from the data units in the suggested pair list.

[0220] The decoder logic 2070 may include selection logic 2076 to interact with the randomness logic 2005 to determine which data unit in the list of proposed pairs has the lowest level of randomness. In many embodiments, the selection logic 2076 may interact with the entropy determination logic 2030 to determine the least random data unit of the proposed pair. In other embodiments, the selection logic 2076 may interact with the threshold comparison logic 2020 to determine the least random data unit. In further embodiments, the selection logic 2076 may interact with both the threshold comparison logic 2020 and the entropy determination logic 2030 to determine the least random data unit of the proposed pair.

[0221] The entropy determination logic 2030 may also compare the maximum entropy index value for the least random data unit with an entropy threshold to determine whether the entropy of the least random data unit exceeds or equals the entropy threshold. If the entropy of the least random data unit exceeds or equals the entropy threshold, the decoder logic 2070 may output the least random data unit and an optional associated tag. On the other hand, if the entropy of the least random data unit is less than the entropy threshold, the decoder logic 2070 may determine that the encoded data unit is damaged and notify the validity logic 2060. The validity logic 2060 may determine to perform corrective action on the encoded data unit, if applicable, and instruct the correction logic 2062 to perform the corrective action. The correction logic 2062 may perform corrective action such as error correction using an error correction code or other corrective action.

[0222] After performing the corrective action, the decoder logic 2070 can restart the decryption and separation operations to generate a list of suggested pairs of data units and tags. Thereafter, the randomness logic 2005 can determine the least random data unit in each pair and compare the maximum exponent value of the least random data unit in the suggested pair list to the entropy threshold to determine whether the data unit is valid. If so, the decoder logic 2070 can output the least random data unit and an optional associated tag. If the maximum exponent value of the least random data unit in the suggested pair list is less than the entropy threshold, the decoder logic 2070 can notify the validity logic 2060, which can then determine to perform corrective action, determine that the encoded data unit is corrupted, or begin standard decoder operation by searching for a MAC or ICV and decrypting the encoded data unit.

[0223] If corrective action is not available, then in some embodiments, validity logic 2060 may determine that the coded data unit is invalid or corrupted and instruct corruption logic 2064 so corruption logic 2064 may perform further data integrity operations.

[0224] Figure 3A-3C A flow chart depicting an embodiment of encrypting and decrypting data units and tags, as well as merging and separating data units and tags. Figure 3A The figure shows that Figure 2 Memory logic circuit system 2000 or Figure 1A Flowchart 3000 of memory logic of memory logic circuitry 1015, 1026, 1035, 1046, 1061, and / or 1096 in encrypting and storing unencrypted data in memory. Flowchart 3000 begins with receiving an unencrypted data unit by the memory logic circuitry (element 3010). The memory logic circuitry may perform a pattern check (element 3015) based on a threshold value, such as Figure 1C The pattern check logic 1200 in the memory determines whether the unencrypted data unit passes or fails. Alternatively, the memory logic circuitry may perform a pattern check based on an entropy index value (element 3020). In further embodiments, the memory logic circuitry may optionally perform a pattern check based on a threshold value (element 3015) and perform a pattern check based on an entropy index value (element 3020).

[0225] In many embodiments, if at least one pattern is detected to have a repetition or count of entities or occurrences of the at least one pattern that exceeds a corresponding threshold for the at least one pattern, the unencrypted data unit passes a threshold-based pattern check (element 3015). In some embodiments, if the unencrypted data unit passes the pattern check utilizing the threshold, the memory logic circuitry determines that the unencrypted data unit is low entropy and compatible with implicit integrity operations (element 3025).

[0226] The memory logic circuitry may perform a pattern check based on the entropy index value (element 3020) by performing a pattern check that determines a count of repetitions of a physical pattern in a data unit. Figure 1D The pattern checking unit(s) illustrated in FIG3 may perform a pattern check. In some embodiments, the pattern checking unit outputs a count for each pattern and sends the count to the entropy determination logic. The entropy determination logic may determine an entropy index value for the count from each pattern checking unit, determine a maximum entropy index value of the entropy index values, and compare the maximum entropy index value to an entropy threshold. In some embodiments, if the maximum entropy index value exceeds the entropy threshold, the unencrypted data unit passes the entropy index value-based pattern check (element 3020). If the unencrypted data unit passes, the memory logic circuitry determines that the unencrypted data unit is valid or compatible with implicit integrity operations (element 3025).

[0227] If the unencrypted data unit is valid or compatible (element 3025), the memory logic circuitry may encode the unencrypted data unit using an encryption operation to generate an encrypted data unit (element 3030) for storage in memory (element 3035). In some embodiments, the memory logic circuitry incorporates the tag with the data unit in the encrypted data unit. In other embodiments, the memory logic circuitry does not incorporate the tag with the data unit in the encrypted data unit.

[0228] In situations where an unencrypted data unit fails a threshold-based pattern check and / or an entropy index value-based pattern check, the memory logic circuitry may determine that the unencrypted data unit is corrupted or incompatible (element 3040). For example, the memory logic circuitry may test data units in the memory that should be plaintext to determine whether they are distinguishable from random data. In such an embodiment, if an unencrypted data unit that should be plaintext is indistinguishable from random data through a pattern check, the memory logic circuitry may determine that the unencrypted data unit is corrupted (element 3040). Once the memory logic circuitry determines that the unencrypted data unit is corrupted, the memory logic circuitry may perform corrective actions (element 3045) and send the corrected unencrypted data unit to element 3015 for a threshold-based pattern check and / or to element 3020 for a pattern check utilizing an entropy index value.

[0229] If the unencrypted data unit is incompatible with implicit integrity operations, the memory logic circuit system may encode the unencrypted data unit using an alternative encoding / encryption scheme (element 3050) to create an encoded data unit to store the encoded data unit in memory 3035.

[0230] Figure 3B FIGURE 31 shows a flow chart 3100 for generating an encoded data unit for storage in a memory, such as Figure 2 The implicit integrity operation of the encoder logic 2040 in . The flowchart begins by Figure 2 The memory logic circuitry of memory logic circuitry 2000 shown in FIG. 1 receives a data unit to be stored in memory (element 3110). In some embodiments, the data unit may include data to be stored, for example, on a data storage device, on a flash drive, or in a cache. In further embodiments, the memory logic circuitry may receive a tag associated with the data unit. In other embodiments, the memory logic may generate a tag associated with the data unit.

[0231] After receiving a data unit to be stored in memory, the memory logic circuitry may encode the data unit using a process that embeds the tag with the data unit in an encoded data unit, where the encoded data unit has the same number of bits as the data unit (element 3115). In other words, the encoded data unit is the same size as the data unit, so the memory logic circuitry can store the tag without additional storage overhead. In some embodiments, the process of encoding the data unit and tag is an encryption process that uses a master key and an adjustment and generates an additional key and / or mask based on the master key and / or adjustment to encrypt the data unit and the embedded tag.

[0232] Figure 3C The figure shows that Figure 2 Memory logic circuit system 2000 or Figure 1A Flowchart 3200 is a flowchart of decoding an encrypted data unit by memory logic circuitry 1015, 1026, 1035, 1046, 1061, and / or 1096 in FIG. Flowchart 3200 begins by decoding an encrypted data unit to determine a set of one or more suggested pairs, where each pair includes a data unit and a tag (element 3210). In such an embodiment, the encrypted data unit is an encoded data unit, such as in Figure 3B The encoded data unit generated in flowchart 3100 in .

[0233] After determining the groups of more than one pair, the memory logic circuitry may determine an entropy index value for each proposed data unit in the groups of more than one pair (element 3215). The memory logic circuitry may determine the entropy index value based on a sum or count of repetitions of an entity associated with the bit pattern in each data unit.

[0234] The memory logic circuitry may determine a maximum entropy index value or a maximum entropy index value from the set of entropy index values (element 3220) and compare the maximum entropy index value to an entropy threshold value (element 3225). If the maximum entropy index value exceeds the entropy threshold value (element 3230), the memory logic circuitry may identify the proposed pair associated with the maximum entropy index value as a decoded data unit and a tag (element 3250).

[0235] If the maximum entropy index value does not exceed the entropy threshold (element 3230), the memory logic circuitry may perform one or more different data integrity actions. In some embodiments, the memory logic circuitry performs corrective action for the cryptographic data unit corruption (element 3235) and restarts at element 3210. In further embodiments, the memory logic circuitry performs an alternative decoding scheme to decode the cryptographic data unit corruption (element 3240). In many embodiments, the memory logic circuitry identifies the cryptographic data unit as corrupted (element 3245).

[0236] Figure 4The figure shows an example of a storage medium 4000 for storing processor data structures. The storage medium 4000 may include an article of manufacture. In some examples, the storage medium 4000 may include any non-transitory computer-readable medium or machine-readable medium, such as optical, magnetic, or semiconductor storage. The storage medium 4000 may store various types of computer-executable instructions, such as instructions for implementing the logic flows and / or techniques described herein. Examples of computer-readable or machine-readable storage media may include any tangible medium capable of storing electronic data, including volatile or non-volatile memory, removable or non-removable memory, erasable or non-erasable memory, writable or rewritable memory, etc. Examples of computer-executable instructions may include any suitable type of code, such as source code, compiled code, interpreted code, executable code, static code, dynamic code, object-oriented code, visual code, etc. The examples are not limited to this context.

[0237] Figure 5 The figure shows an example computing platform 5000. In some examples, such as Figure 5 As shown in FIG5 , computing platform 5000 may include a processing component 5010, other platform components, or a communication interface 5030. According to some examples, as mentioned above, computing platform 5000 may be implemented in a computing device such as a server in a system, such as a server farm or data center, that supports a manager or controller for managing configurable computing resources as described above. In addition, communication interface 5030 may include a wake-up radio (WUR) and may be capable of waking up the main radio of computing platform 5000.

[0238] According to some examples, the processing component 5010 can perform processing operations or logic for the apparatus 5015 described herein. The processing component 5010 can include various hardware elements, software elements, or a combination of both. Examples of hardware elements can include a device, a logic device, a component, a processor, a microprocessor, a circuit, a processor circuit, a circuit element (e.g., a transistor, a resistor, a capacitor, an inductor, etc.), an integrated circuit, an application specific integrated circuit (ASIC), a programmable logic device (PLD), a digital signal processor (DSP), a field programmable gate array (FPGA), a memory cell, a logic gate, a register, a semiconductor device, a chip, a microchip, a chipset, etc. Examples of software elements that can reside in the storage medium 5020 can include a software component, a program, an application, a computer program, an application program, a device driver, a system program, a software development program, a machine program, operating system software, middleware, firmware, a software module, a routine, a subroutine, a function, a method, a process, a software interface, an application program interface (API), an instruction set, a computing code, a computer code, a code segment, a computer code segment, a word, a value, a symbol, or any combination thereof. Determining whether to use hardware elements and / or software elements to implement an example can vary depending on any number of factors, such as desired computing rate, power levels, thermal tolerances, processing cycle budget, input data rate, output data rate, memory resources, data bus speed, and other design or performance constraints, as desired for a given example.

[0239] In some examples, other platform components 5025 may include common computing elements such as one or more processors, multi-core processors, coprocessors, memory units, chipsets, controllers, peripherals, interfaces, oscillators, timing devices, video cards, audio cards, multimedia input / output (I / O) components (e.g., digital displays), power supplies, etc. Examples of memory units may include, but are not limited to, various types of computer-readable and machine-readable storage media in the form of one or more high-speed memory cells, such as read-only memory (ROM), random-access memory (RAM), dynamic RAM (DRAM), double data rate DRAM (DDRAM), synchronous DRAM (SDRAM), static RAM (SRAM), programmable ROM (PROM), erasable programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), flash memory, polymer memory such as ferroelectric polymer memory, OVA memory, phase change or ferroelectric memory, silicon-oxide-nitride-oxide-silicon (SONOS) memory, magnetic or optical cards, device arrays such as redundant array of independent disks (RAID) drives, solid-state memory devices (e.g., USB memory), solid-state drives (SSDs), and any other type of storage medium suitable for storing information.

[0240] In some examples, communication interface 5030 may include logic and / or features for supporting a communication interface. For these examples, communication interface 5030 may include one or more communication interfaces that operate according to various communication protocols or standards to communicate via direct or network communication links. Direct communication may occur using communication protocols or standards described in one or more industry standards (including descendants and variants), such as those associated with the PCI Express specification. Network communication may occur using communication protocols or standards, such as those described in one or more Ethernet standards promulgated by the Institute of Electrical and Electronics Engineers (IEEE). For example, one such Ethernet standard may include IEEE 802.3-2012, Carrier Sense Multiple Access with Collision Detection (CSMA / CD) Access Method and Physical Layer Specification, published in December 2012 (hereinafter referred to as "IEEE 802.3"). Network communication may also occur according to one or more OpenFlow specifications, such as the OpenFlow Hardware Abstraction API specification. Network communications may also occur in accordance with the Infiniband Architecture Specification, Volume 1, Version 1.3, released in March 2015 (the "Infiniband Architecture Specification").

[0241] The computing platform 5000 can be part of a computing device, which can be, for example, a server, a server array or server farm, a web server, a network server, an Internet server, a workstation, a minicomputer, a mainframe computer, a supercomputer, a network appliance, a web appliance, a distributed computing system, a multiprocessor system, a processor-based system, or a combination thereof. Thus, in various embodiments of the computing platform 5000, the functionality and / or specific configurations of the computing platform 5000 described herein can be included or omitted as appropriately desired.

[0242] The components and features of computing platform 5000 may be implemented using any combination of discrete circuitry, ASICs, logic gates, and / or single-chip architectures. Furthermore, features of computing platform 5000 may be implemented using microcontrollers, programmable logic arrays, and / or microprocessors, or any combination of the foregoing where appropriate. Note that hardware, firmware, and / or software elements may be collectively or individually referred to herein as "logic."

[0243] It should be understood that Figure 5 The exemplary computing platform 5000 shown in the block diagram of FIG can represent a functional descriptive example of many potential implementations. Therefore, the division, omission, or inclusion of block functions depicted in the figures does not infer that hardware components, circuits, software, and / or elements for implementing these functions must be divided, omitted, or included in the embodiment.

[0244] One or more aspects of at least one example may be implemented by representative instructions stored on at least one machine-readable medium representing various logic within the processor, which, when read by a machine, computing device, or system, may cause the machine, computing device, or system to fabricate the logic to perform the techniques described herein. Such representations, known as "IP cores," may be stored on a tangible, machine-readable medium and supplied to various customers or manufacturing facilities to be loaded into fabrication machines that actually fabricate the logic or processor.

[0245] Various examples may be implemented using hardware elements, software elements, or a combination of both. In some examples, hardware elements may include devices, components, processors, microprocessors, circuits, circuit elements (e.g., transistors, resistors, capacitors, inductors, etc.), integrated circuits, application specific integrated circuits (ASICs), programmable logic devices (PLDs), digital signal processors (DSPs), field programmable gate arrays (FPGAs), memory cells, logic gates, registers, semiconductor devices, chips, microchips, chipsets, etc. In some examples, software elements may include software components, programs, applications, computer programs, application programs, system programs, machine programs, operating system software, middleware, firmware, software modules, routines, subroutines, functions, methods, processes, software interfaces, application program interfaces (APIs), instruction sets, computing code, computer code, code segments, computer code segments, words, values, symbols, or any combination thereof. Determining whether to implement an example using hardware elements and / or software elements may vary based on any number of factors, such as desired computing rate, power level, thermal tolerance, processing cycle budget, input data rate, output data rate, memory resources, data bus speed, and other design or performance constraints, as desired for a given implementation.

[0246] Some examples may include an article of manufacture or at least one computer-readable medium. The computer-readable medium may include a non-transitory storage medium for storing logic. In some examples, the non-transitory storage medium may include one or more types of computer-readable storage media capable of storing electronic data, including volatile or non-volatile memory, removable or non-removable memory, erasable or non-erasable memory, writable or rewritable memory, etc. In some examples, the logic may include various software elements, such as a software component, a program, an application, a computer program, an application program, a system program, a machine program, operating system software, middleware, firmware, a software module, a routine, a subroutine, a function, a method, a process, a software interface, an API, an instruction set, a computing code, a computer code, a code segment, a computer code segment, a word, a value, a symbol, or any combination thereof.

[0247] According to some examples, a computer-readable medium may include a non-transitory storage medium for storing or maintaining instructions that, when executed by a machine, computing device, or system, causes the machine, computing device, or system to perform methods and / or operations according to the examples. Instructions may include any suitable type of code, such as source code, compiled code, interpreted code, executable code, static code, dynamic code, and the like. Instructions may be implemented according to a predefined computer language, manner, or syntax for instructing a machine, computing device, or system to perform a specific function. Instructions may be implemented using any suitable high-level, low-level, object-oriented, visual, compiled, and / or interpreted programming language.

[0248] The data processing system that is suitable for storing and / or executing program code will comprise at least one processor that is directly or indirectly coupled to memory element by system bus.Memory element can comprise local memory, mass storage and cache memory that adopt during the actual execution of program code, and it provides temporary storage of at least some program codes, to reduce the number of times that code must be retrieved from mass storage during execution.Term " code " covers a wide range of software components and construction, comprises application, driver, process, routine, method, module, firmware, microcode and subroutine.Therefore, term " code " can be used to refer to any instruction set, and when being executed by processing system, described instruction set performs one or more operations of expectation.

[0249] The logic circuitry, devices, and interfaces described herein can perform functions implemented in hardware as well as in code executed on one or more processors. Logic circuitry refers to hardware or hardware and code that implements one or more logic functions. Circuitry is hardware and can refer to one or more circuits. Each circuit can perform a specific function. The circuitry of the circuitry can include discrete electronic components interconnected with one or more conductors, integrated circuits, chip packages, chipsets, memory, and the like. Integrated circuits include circuits produced on a substrate such as a silicon wafer and can include components. Furthermore, integrated circuits, processor packages, chip packages, and chipsets can include one or more processors.

[0250] A processor can receive signals, such as instructions and / or data, at one or more inputs and process the signals to generate at least one output. As code is executed, it changes the physical states and characteristics of the transistors that make up the processor's pipeline. The physical states of the transistors are converted into logical bits of 1 and 0 that are stored in registers within the processor. The processor can transfer the physical states of transistors to registers and transfer the physical states of transistors to another storage medium.

[0251] A processor may include circuitry for performing one or more sub-functions that are implemented to perform the overall functionality of the processor. An example of a processor is a state machine or an application-specific integrated circuit (ASIC), which includes at least one input and at least one output. The state machine may manipulate the at least one input by performing a predetermined series of serial and / or parallel operations or transformations on the at least one input to generate at least one output.

[0252] The logic described above can be part of a design for an integrated circuit chip. The chip design is created in a graphical computer programming language and stored on a computer storage medium or data storage medium (such as a disk, tape, physical hard drive, or virtual hard drive such as in a storage access network). If the designer does not have the chip fabrication or the photolithography masks used to fabricate the chip, the designer sends the resulting design directly or indirectly to such an entity, either physically (e.g., by providing a copy of the storage medium storing the design) or electronically (e.g., via the Internet). The stored design is then converted into an appropriate format (e.g., GDSII) for fabrication.

[0253] The resulting integrated circuit chips can be distributed by the manufacturer in raw wafer form (i.e., as a single wafer with multiple unpackaged chips), as bare chips, or in packaged form. In the latter case, the chips are mounted in a single-chip package (such as a plastic carrier with leads that are attached to a motherboard or other higher-level carrier) or in a multi-chip package (such as a ceramic carrier with either surface interconnects or buried interconnects, or both). In any case, the chips are then integrated with other chips, discrete circuit components, and / or other signal processing devices as part of (a) an intermediate product such as a processor board, server platform, or motherboard, or (b) a final product.

[0254] Several embodiments have one or more potential advantageous effects. For example, implementing implicit integrity operations advantageously reduces data storage requirements and the additional reads and writes associated with standard data integrity operations using, for example, MACs and ICVs. Performing one or more pattern checks to determine duplication of entities within the data advantageously distinguishes the data unit from random data. Determining an entropy index value and / or a Boolean value and / or comparing the result to a threshold value advantageously determines whether the data unit is valid or compliant. Combining a tag with a data unit to create an encoded data unit without expanding the data unit advantageously reduces data storage requirements and the additional reads and writes associated with standard data integrity operations using, for example, MACs and ICVs. Decoding and processing the encoded data unit to determine the data unit and the tag advantageously reduces data storage requirements and the additional reads and writes associated with standard data integrity operations using, for example, MACs and ICVs. Determining a histogram of values for two or more entities, determining the sum of duplications of the two or more entities, and comparing the sum to a threshold value advantageously distinguishes the data unit from random data. Determining whether a data unit is valid and / or whether a data unit is corrupted may advantageously distinguish a data unit from random data or advantageously detect malware such as ransomware.

[0255] Examples of further embodiments

[0256] The following examples relate to further embodiments. Details in the examples may be used anywhere in one or more embodiments.

[0257] Example 1 is an apparatus for determining the integrity of a data unit. The apparatus comprises: a memory; and memory logic circuitry, coupled to the memory, configured to perform one or more pattern checks to determine repetitions of an entity within the data unit, wherein the entity comprises a pattern of two or more bits, wherein the one or more pattern checks comprise a first pattern check for determining repetitions of identical entities and a second pattern check for determining repetitions of adjacent and identical entities; and determining whether the data unit is valid based on the repetitions of the entity within the data unit determined by the one or more pattern checks. In Example 2, the apparatus of Example 1, wherein the memory comprises one or more buffers, one or more registers, one or more levels of cache, one or more flash memory, one or more dynamic random access memory, one or more hard drives, one or more solid-state drives, or a combination thereof. In Example 3, the apparatus of Example 1, wherein the memory logic circuitry comprises one or more circuits, one or more processors, code, or a combination thereof. In Example 4, the apparatus of Example 1, wherein the memory logic circuitry is configured to calculate an entropy index value based on a probability of occurrence of the repetition of the entity in random data, and to determine whether the data unit is valid based on a comparison of the entropy index value with an entropy threshold. In Example 5, the apparatus of Example 1, wherein the memory logic circuitry includes threshold comparison logic to compare the repetition of the entity within the data unit with a threshold in a threshold set to distinguish the repetition of the entity within the data unit from random data.

[0258] In Example 6, the apparatus of Example 5, wherein the threshold comparison logic includes Boolean logic for assigning a Boolean value to each of the one or more pattern checks based on a comparison of the repetitions of the entity within the data unit with a threshold value in the threshold group, and performing a logical operation using the Boolean value to determine whether the data unit is valid. In Example 7, the apparatus of Example 1, wherein the memory logic circuitry includes maximum logic for determining a maximum entropy index value based on the entropy index value and entropy comparison logic for comparing the maximum entropy index value with the entropy threshold value. In Example 8, the apparatus of Example 1, wherein the memory logic circuitry includes validity logic for determining that the data unit is valid in response to the threshold comparison logic determining that a sum of repetitions of a first entity among the entities within the data unit exceeds a threshold value associated with the first entity from the threshold group, or the entropy comparison logic determining that at least one of the entropy index values exceeds the entropy threshold value, or both. In Example 9, the apparatus of Example 6, wherein the memory logic circuitry includes validity logic to determine that the data unit is corrupted in response to the threshold comparison logic determining that the repetition of the entity within the data unit does not exceed any threshold from the threshold set, the threshold comparison logic determining that all entropy index values do not exceed the entropy threshold, or both. In Example 10, the apparatus of Example 2, wherein the memory logic circuitry includes encoder logic to encode the data unit and the tag to create an encoded data unit, wherein the tag is embedded in the encoded data unit, wherein the length of the encoded data unit is the length of the data unit. In Example 11, the apparatus of Example 10, wherein the memory logic circuitry includes decoder logic to decode the encoded data unit to determine the data unit and the tag, the decoder logic to decode the encoded data unit to produce one or more possible data unit and tag pairs, wherein one of the one or more data unit and tag pairs includes the data unit and the tag, wherein the one pair is associated with a highest entropy index value among the entropy index values for each of the one or more data unit and tag pairs, the highest entropy index value being greater than the entropy threshold.

[0259] In Example 12, the apparatus of Example 1, wherein the memory logic circuitry includes threshold comparison logic for comparing repetitions of the entity within the data unit to a threshold in a threshold set to distinguish the repetitions of the entity within the data unit from random data. In Example 13, the apparatus of Example 1, wherein the entity comprises a nibble, a byte, a word, a doubleword, or a combination thereof. In Example 14, the apparatus of Example 1, wherein adjacent entities have consecutive index positions. In Example 15, the apparatus of Example 1, wherein the memory logic circuitry includes pattern check logic for detecting entities in the data unit that are equal and are special values, wherein the special value is a value that is frequently encountered in data units and is infrequently encountered in random or corrupted data units. In Example 16, the apparatus of Example 1, wherein the one or more pattern checks include a third pattern check for determining repetitions of entities having N highest counts, wherein N is a positive number. In Example 17, the apparatus of Example 1, wherein the memory logic circuitry includes: pattern checking logic for determining a histogram of values of two or more entities and for determining a sum of repetitions of the two or more entities; and threshold comparison logic for comparing the sum to a threshold of the threshold set. In Example 18, a system for determining integrity of a data unit includes a processor coupled to the memory logic circuitry, wherein the memory includes a dynamic random access memory coupled to the processor according to any one of claims 1-17.

[0260] Example 19 is a method for determining the integrity of a data unit. The method includes: performing, by a memory logic circuit system, one or more pattern checks to determine repetitions of an entity within the data unit, wherein the entity includes a pattern of two or more bits; wherein the one or more pattern checks include a first pattern check for determining repetitions of equal entities and a second pattern check for determining repetitions of adjacent and equal entities; and determining whether the data unit is valid based on the repetitions of the entity within the data unit determined by the one or more pattern checks. In Example 20, the method of Example 19 further includes comparing the repetitions of the entity within the data unit with a threshold value in a threshold group to distinguish the repetitions of the entity within the data unit from random data. In Example 21, the method of Example 20 further includes assigning a Boolean value to each of the one or more pattern checks based on the comparison of the repetitions of the entity within the data unit with a threshold value in the threshold group, and performing a logical operation using the Boolean value to determine whether the data unit is valid. In Example 22, the method of Example 19 further includes: determining a maximum entropy index value based on the entropy index values for the data units, and comparing the maximum entropy index value with an entropy threshold value.

[0261] In Example 23, the method of Example 22, wherein the entropy threshold is a security level associated with determining whether the data unit is valid. In Example 24, the method of Example 19 further includes: determining that the data unit is valid by determining that a sum of repetitions of a first entity among the entities within the data unit exceeds a threshold associated with the first entity in the threshold group and at least one entropy index value exceeds an entropy threshold. In Example 25, the method of Example 19 further includes: determining that the data unit is damaged by determining that repetitions of the entity within the data unit do not exceed any threshold from the threshold group, determining that all entropy index values do not exceed an entropy threshold, or both, wherein the entropy index value is determined based on a probability that repetitions of the entity appear in random data. In Example 26, the method of Example 19 further includes: encoding the data unit and the tag to create an encoded data unit, wherein the tag is embedded in the encoded data unit, and wherein the length of the encoded data unit is the length of the data unit. In Example 27, the method of Example 26 further includes: decoding the encoded data unit to determine the data unit and the tag, wherein decoding the encoded data unit produces one or more possible data unit and tag pairs, wherein one of the one or more data unit and tag pairs includes the data unit and the tag, wherein the pair is associated with a highest entropy index value among the entropy index values of the one or more data unit and tag pairs, and the highest entropy index value is greater than the entropy threshold. In Example 28, the method of Example 19, wherein performing one or more pattern checks includes: performing a first pattern check of the one or more pattern checks based on a first threshold of the threshold group, and performing a second pattern check of the one or more pattern checks based on a second threshold of the threshold group. In Example 29, the method of Example 19, wherein performing the one or more pattern checks includes detecting equal entities in the data unit, wherein the entities include nibbles, bytes, words, double words, or a combination thereof. In Example 30, the method of Example 19, wherein performing the one or more pattern checks includes detecting equal entities in the data unit and located at consecutive index positions.

[0262] In Example 31, the method of Example 19, wherein performing the one or more pattern checks includes detecting entities in the data unit that are equal and are special values, wherein the special value is a value that is frequently encountered in data units and rarely encountered in random or corrupted data units. In Example 32, the method of Example 19, wherein performing the one or more pattern checks includes detecting entities in the data unit that are equal and are special values, wherein the special values include 0x00 and 0xFF. In Example 33, the method of Example 19, wherein performing the one or more pattern checks includes determining a histogram of values of two or more entities, determining a sum of repetitions of the two or more entities, and comparing the sum to a threshold value of the threshold set. In Example 34, a computer-readable medium having instructions stored thereon that, when executed, cause a computer to perform operations comprising the operations of any of Claims 19-33. Example 35 is an apparatus for determining the integrity of a data unit, the apparatus comprising components for performing any of Claims 19-33. Example 36 is a program for causing a computer to perform operations comprising the operations of any of Claims 19-33. Example 37 is a computer-readable storage medium for storing the program of claim 36.

[0263] Example 38 is a system for determining the integrity of a data unit. The system includes: a memory including dynamic random access memory; a processor coupled to the dynamic random access memory; and memory logic circuitry coupled to the processor and the memory, configured to perform one or more pattern checks to determine duplication of an entity within the data unit, wherein the entity comprises a pattern of two or more bits, wherein the one or more pattern checks include a first pattern check for determining duplication of equal entities and a second pattern check for determining duplication of adjacent and equal entities; and to determine whether the data unit is valid based on the duplication of the entity within the data unit determined by the one or more pattern checks. In Example 39, the system of Example 38, wherein the memory includes one or more buffers, one or more registers, one or more levels of cache, one or more flash memory, one or more hard disk drives, one or more solid-state drives, or a combination thereof. In Example 40, the system of Example 38, wherein the memory logic circuitry includes one or more circuits, one or more processors, code, or a combination thereof.

[0264] In Example 41, the system of Example 38, wherein the memory logic circuitry includes threshold comparison logic for comparing the repetition of the entity within the data unit with a threshold value in a threshold group to distinguish the repetition of the entity within the data unit from random data. In Example 42, the system of Example 41, wherein the threshold comparison logic includes Boolean logic for assigning a Boolean value to each of the one or more pattern checks based on a comparison of the repetition of the entity within the data unit with a threshold value in the threshold group, and performing a logical operation using the Boolean value to determine whether the data unit is valid. In Example 43, the system of Example 38, wherein the memory logic circuitry includes maximum logic for determining a maximum entropy index value based on an entropy index value for the data unit and entropy comparison logic for comparing the maximum entropy index value to an entropy threshold. In Example 44, the system of Example 38, wherein the entropy threshold is a security level associated with determining whether the data unit is valid. In Example 45, the system of Example 38, wherein the memory logic circuitry includes validity logic for determining that the data unit is valid in response to the threshold comparison logic determining that a sum of repetitions of a first entity in the entities of the data unit exceeds a threshold value associated with the first entity from the threshold set and the entropy comparison logic determining that at least one entropy index value exceeds an entropy threshold. In Example 46, the system of Example 38, wherein the memory logic circuitry includes validity logic for determining that the data unit is corrupted in response to the threshold comparison logic determining that the repetitions of the entity within the data unit do not exceed any threshold value from the threshold set, the threshold comparison logic determining that all entropy index values determined for the data unit do not exceed an entropy threshold, or both. In Example 47, the system of Example 38, wherein the memory logic circuitry includes encoder logic for encoding the data unit with a tag to create an encoded data unit, wherein the tag is embedded in the encoded data unit, and wherein a length of the encoded data unit is a length of the data unit.

[0265] In Example 48, the system of Example 47, wherein the memory logic circuitry includes decoder logic for decoding the encoded data unit to determine the data unit and the tag, the decoder logic for decoding the encoded data unit to produce one or more possible data unit and tag pairs, wherein one of the one or more data unit and tag pairs includes the data unit and the tag, wherein the pair is associated with a highest entropy index value among the entropy index values for each of the one or more data unit and tag pairs, the highest entropy index value being greater than an entropy threshold. In Example 49, the system of Example 38, wherein the memory logic circuitry includes pattern check logic for performing a third pattern check of the one or more pattern checks and a fourth pattern check of the one or more pattern checks, and threshold comparison logic for comparing a count of entity occurrences in a first pattern to a first threshold of the threshold set and comparing a count of entity occurrences in a second pattern to a second threshold of the threshold set. In Example 50, the system of Example 38, wherein the memory logic circuitry includes pattern check logic for detecting equal entities in the data unit, wherein the entities include nibbles, bytes, words, doublewords, or a combination thereof. In Example 51, the system of Example 38, wherein the memory logic circuitry includes pattern checking logic for detecting entities in the data unit that are equal and located at consecutive index positions. In Example 52, the system of Example 38, wherein the memory logic circuitry includes pattern checking logic for detecting entities in the data unit that are equal and are of a special value, wherein the special value is a value that is frequently encountered in data units and is infrequently encountered in random or corrupted data units. In Example 53, the system of Example 38, wherein the memory logic circuitry is configured to calculate an entropy index value based on a probability that repetitions of the entity occur in random data, and to determine whether the data unit is valid based on a comparison of the entropy index value to an entropy threshold. In Example 54, the system of Example 38, wherein the memory logic circuitry includes: pattern checking logic for determining a histogram of values of two or more entities and for determining a sum of the repetitions of the two or more entities; and threshold comparison logic for comparing the sum to a threshold of the threshold set.

[0266] Example 55 is a non-transitory machine-readable medium containing instructions that, when executed by a processor, cause the processor to perform operations comprising: performing, by memory logic circuitry, one or more pattern checks to determine repetitions of an entity within a data unit, wherein the entity comprises a pattern of two or more bits; wherein the one or more pattern checks comprise a first pattern check for determining repetitions of equal entities and a second pattern check for determining repetitions of adjacent and equal entities; and determining whether the data unit is valid based on the repetitions of the entity within the data unit determined by the one or more pattern checks. In Example 56, the machine-readable medium of Example 55, wherein the operations further comprise comparing the repetitions of the entity within the data unit to a threshold value from a threshold set to distinguish the repetitions of the entity within the data unit from random data. In Example 57, the machine-readable medium of Example 55, wherein the operations further comprise assigning a Boolean value to each of the one or more pattern checks based on the comparison of the repetitions of the entity within the data unit to a threshold value from a threshold set, and performing a logical operation using the Boolean value to determine whether the data unit is valid. In example 58, the machine-readable medium of example 55, wherein the operations further comprise determining a maximum entropy index value based on the entropy index value determined for the data unit, and comparing the maximum entropy index value to an entropy threshold value. In example 59, the machine-readable medium of example 58, wherein the entropy threshold value is a security level associated with determining whether the data unit is valid.

[0267] In Example 60, the machine-readable medium of Example 55, wherein the operation further comprises determining that the data unit is valid by determining that a sum of repetitions of a first entity of the entities within the data unit exceeds a threshold value associated with the first entity from the threshold group and at least one entropy index value exceeds the entropy threshold. In Example 61, the machine-readable medium of Example 55, wherein the operation further comprises determining that the data unit is damaged by determining that the repetitions of the entities within the data unit do not exceed any threshold value from the threshold group, determining that all entropy index values do not exceed the entropy threshold, or both. In Example 62, the machine-readable medium of Example 55, wherein the operation further comprises encoding the data unit with a tag to create an encoded data unit, wherein the tag is embedded in the encoded data unit, and wherein a length of the encoded data unit is a length of the data unit. In example 63, the machine-readable medium of example 62, wherein the operation further comprises decoding the encoded data unit to determine the data unit and the tag, wherein decoding the encoded data unit produces one or more possible data unit and tag pairs, wherein one of the one or more data unit and tag pairs includes the data unit and the tag, wherein the pair is associated with a highest entropy index value among the entropy index values for each of the one or more data unit and tag pairs, the highest entropy index value being greater than an entropy threshold. In example 64, the machine-readable medium of example 55, wherein performing the one or more pattern checks comprises: performing a first pattern check of the one or more pattern checks based on a first threshold of the threshold group and performing a second pattern check of the one or more pattern checks based on a second threshold of the threshold group. In example 65, the machine-readable medium of example 55, wherein performing the one or more pattern checks comprises detecting equal entities in the data unit, wherein the entities comprise nibbles, bytes, words, doublewords, or a combination thereof. In example 66, the machine-readable medium of example 55, wherein performing the one or more pattern checks comprises detecting equal entities in the data unit and located at consecutive index positions.

[0268] In example 67, the machine-readable medium of example 55, wherein performing the one or more pattern checks comprises detecting entities in the data unit that are equal and are special values, wherein the special value is a value that is frequently encountered in data units and rarely encountered in random or corrupted data units. In example 68, the machine-readable medium of example 55, wherein the operation further comprises calculating an entropy index value based on a probability that repetitions of the entity occur in random data, and determining whether the data unit is valid based on a comparison of the entropy index value to an entropy threshold. In example 69, the machine-readable medium of example 55, wherein performing the one or more pattern checks comprises determining a histogram of values for two or more entities, determining a sum of repetitions of the two or more entities, and comparing the sum to a threshold of a threshold group.

[0269] Example 70 is an apparatus for determining the integrity of a data unit. The apparatus includes: a component for performing one or more pattern checks by a memory logic circuit system to determine the repetition of an entity within the data unit, wherein the entity includes a pattern of two or more bits; wherein the one or more pattern checks include a first pattern check for determining repetitions of equal entities and a second pattern check for determining repetitions of adjacent and equal entities; and a component for determining whether the data unit is valid based on the repetition of the entity within the data unit determined by the one or more pattern checks. In Example 71, the apparatus of Example 70 further includes a component for comparing the repetition of the entity within the data unit with a threshold value in a threshold group to distinguish the repetition of the entity within the data unit from random data. In Example 72, the apparatus of Example 71 further includes a component for assigning a Boolean value to each of the one or more pattern checks based on the comparison of the repetition of the entity within the data unit with a threshold value in the threshold group, and performing a logical operation using the Boolean value to determine whether the data unit is valid. In Example 73, the apparatus of Example 70 further includes a component for determining a maximum entropy index value based on the entropy index value of the data unit and comparing the maximum entropy index value with an entropy threshold. In Example 74, the apparatus of Example 73, wherein the entropy threshold is a security level associated with determining whether the data unit is valid. In Example 75, the apparatus of Example 70 further includes a component for determining that the data unit is valid by determining that the sum of repetitions of a first entity among the entities within the data unit exceeds a threshold associated with the first entity from the threshold group and at least one entropy index value exceeds the entropy threshold. In Example 76, the apparatus of Example 70 further includes a component for determining that the data unit is damaged by determining that the repetitions of the entity within the data unit do not exceed any threshold from the threshold group, determining that all entropy index values do not exceed the entropy threshold, or both, wherein the entropy index value is determined based on a probability that the repetition of the entity appears in random data. In Example 77, the apparatus of Example 70 further includes a component for encoding the data unit and the tag to create an encoded data unit, wherein the tag is embedded in the encoded data unit, wherein the length of the encoded data unit is the length of the data unit. In Example 78, the apparatus of Example 77 further includes a component for decoding the encoded data unit to determine the data unit and the tag, wherein decoding the encoded data unit produces one or more possible data unit and tag pairs, wherein one of the one or more data unit and tag pairs includes the data unit and the tag, wherein the pair is associated with a highest entropy index value among the entropy index values for each of the one or more data unit and tag pairs, and the highest entropy index value is greater than an entropy threshold.

[0270] In Example 79, the apparatus of Example 70, wherein the means for performing the one or more pattern checks includes means for performing a first pattern check of the one or more pattern checks based on a first threshold value of the threshold group and a second pattern check of the one or more pattern checks based on a second threshold value of the threshold group. In Example 80, the apparatus of Example 70, wherein the means for performing the one or more pattern checks includes means for detecting equal entities in the data unit, wherein the entities include nibbles, bytes, words, double words, or a combination thereof. In Example 81, the apparatus of Example 70, wherein the means for performing the one or more pattern checks includes means for detecting entities in the data unit that are equal and located at consecutive index positions. In Example 82, the apparatus of Example 70, wherein the means for performing the one or more pattern checks includes means for detecting entities in the data unit that are equal and are special values, wherein the special value is a value that is frequently encountered in data units and rarely encountered in random or damaged data units. In Example 83, the apparatus of Example 70, wherein the means for performing the one or more pattern checks includes means for detecting entities in the data unit that are equal and are special values, wherein the special values include 0x00 and 0xFF. In Example 84, the apparatus of Example 70, wherein the means for performing the one or more pattern checks includes means for determining a histogram of values of two or more entities, determining a sum of repetitions of the two or more entities, and comparing the sum to a threshold of the threshold set.

Claims

1. An apparatus for determining the integrity of a data unit, the apparatus comprising: Memory; and memory logic circuitry coupled to the memory to perform one or more pattern checks for determining repetitions of entities within the data unit, wherein the entities comprise a pattern of two or more bits, wherein the one or more pattern checks include a first pattern check for determining repetitions of entities that are equal and a second pattern check for determining repetitions of entities that are adjacent and equal; and determining whether the data unit is valid based on the repetitions of entities within the data unit determined by the one or more pattern checks, wherein the memory logic circuit system is configured to calculate an entropy index value based on a probability of repetition of the entity appearing in random data, and to determine whether the data unit is valid based on a comparison of the entropy index value with an entropy threshold, and wherein the memory logic circuit system includes: maximum value logic for determining a maximum entropy index value based on the entropy index value; and entropy comparison logic for comparing the maximum entropy index value with the entropy threshold.

2. The device according to claim 1, wherein The memory logic circuit system includes validity logic for determining that the data unit is valid in response to the threshold comparison logic determining that the sum of repetitions of a first entity of the entities within the data unit exceeds a threshold value associated with the first entity from the threshold group, or in response to the entropy comparison logic determining that at least one of the entropy index values exceeds the entropy threshold, or both.

3. The device according to claim 1, wherein The memory logic circuitry includes encoder logic to encode the data unit and a tag to create an encoded data unit, wherein the tag is embedded in the encoded data unit, wherein a length of the encoded data unit is a length of the data unit.

4. The device according to claim 3, wherein The memory logic circuit system includes decoder logic for decoding the encoded data unit to determine the data unit and the tag, the decoder logic for decoding the encoded data unit to produce one or more possible data unit and tag pairs, wherein one pair of the one or more data unit and tag pairs includes the data unit and the tag, wherein the pair is associated with a highest entropy index value among the entropy index values for each of the one or more data unit and tag pairs, and the highest entropy index value is greater than the entropy threshold.

5. The device according to claim 1, wherein The memory logic circuitry includes threshold comparison logic for comparing the repetition of the entity within the data unit to a threshold value in a threshold set to distinguish the repetition of the entity within the data unit from random data.

6. The device according to claim 1, wherein The one or more pattern checks include a third pattern check for determining repetitions of entities having N highest counts, where N is a positive number.

7. An apparatus for determining the integrity of a data unit, the apparatus comprising: means for performing, by the memory logic circuitry, one or more pattern checks to determine repetitions of entities within the data unit, wherein the entities comprise a pattern of two or more bits; wherein the one or more pattern checks include a first pattern check for determining repetitions of entities that are equal and a second pattern check for determining repetitions of adjacent and equal entities; and means for determining whether the data unit is valid based on repetition of the entity within the data unit determined by the one or more pattern checks, Wherein, the component for determining is configured to calculate an entropy index value based on the probability of repetition of the entity appearing in random data, and determine whether the data unit is valid based on a comparison of the entropy index value with an entropy threshold, and wherein, the component for determining includes: a component for determining a maximum entropy index value based on the entropy index value; and a component for comparing the maximum entropy index value with the entropy threshold.

8. The apparatus of claim 7, further comprising means for comparing the repetition of the entity within the data unit with a threshold value in a threshold set to distinguish the repetition of the entity within the data unit from random data.

9. The apparatus according to claim 8 further comprises a component for determining that the data unit is damaged by determining that the repetition of the entity within the data unit does not exceed any threshold from the threshold group, determining that all entropy index values do not exceed an entropy threshold, or both, wherein the entropy index value is determined based on a probability that the repetition of the entity occurs in random data.

10. The apparatus of claim 7, further comprising means for encoding the data unit and the tag to create an encoded data unit, wherein the tag is embedded in the encoded data unit, wherein a length of the encoded data unit is a length of the data unit.

11. The apparatus of claim 10 , further comprising a component for decoding the encoded data unit to determine the data unit and the label, wherein decoding the encoded data unit produces one or more possible data unit and label pairs, wherein one of the one or more data unit and label pairs includes the data unit and the label, wherein the pair is associated with a highest entropy index value among the entropy index values for each of the one or more data unit and label pairs, and the highest entropy index value is greater than the entropy threshold.

12. The device according to claim 7, wherein The means for performing the one or more pattern checks comprises means for detecting equal entities in the data unit, wherein the entities comprise nibbles, bytes, words, doublewords, or a combination thereof.

13. The device according to claim 7, wherein The means for performing the one or more pattern checks includes means for detecting entities in the data units that are equal and located at consecutive index positions.

14. The device according to claim 7, wherein The means for performing the one or more pattern checks includes means for detecting entities in the data units that are equal and are special values, wherein the special value is a value that is frequently encountered in data units and rarely encountered in random or corrupted data units.

15. The device according to claim 7, wherein Means for performing the one or more pattern checks include means for determining a histogram of values for two or more entities, determining a sum of repetitions of the two or more entities, and comparing the sum to a threshold in a threshold set.

16. A system for determining integrity of a data unit, the system comprising: memory including dynamic random access memory; a processor coupled to the dynamic random access memory; and memory logic circuitry coupled to the processor and the memory for performing one or more pattern checks to determine repetitions of entities within the data unit, wherein the entities comprise a pattern of two or more bits, wherein the one or more pattern checks comprise a first pattern check for determining repetitions of entities that are equal and a second pattern check for determining repetitions of adjacent and equal entities; and for determining whether the data unit is valid based on the repetitions of the entities within the data unit determined by the one or more pattern checks, wherein the memory logic circuit system is configured to calculate an entropy index value based on a probability of repetition of the entity appearing in random data, and to determine whether the data unit is valid based on a comparison of the entropy index value with an entropy threshold, and wherein the memory logic circuit system includes: maximum value logic for determining a maximum entropy index value based on the entropy index value; and entropy comparison logic for comparing the maximum entropy index value with the entropy threshold.

17. The system according to claim 16, wherein: The memory includes one or more buffers, one or more registers, one or more levels of cache, one or more flash memories, one or more hard disk drives, one or more solid state drives, or a combination thereof.

18. The system according to claim 16, wherein: The memory logic circuitry includes pattern check logic for detecting equal entities in the data units, wherein the entities include nibbles, bytes, words, doublewords, or combinations thereof.

19. A machine-readable medium comprising instructions that, when executed by a processor, cause the processor to perform operations comprising: performing, by the memory logic circuitry, one or more pattern checks to determine repetitions of entities within the data unit, wherein the entities comprise a pattern of two or more bits; wherein the one or more pattern checks include a first pattern check for determining repetitions of entities that are equal and a second pattern check for determining repetitions of adjacent and equal entities; and determining whether the data unit is valid based on a repetition of the entity within the data unit determined by the one or more pattern checks, The operation further comprises calculating an entropy index value based on a probability of repetition of the entity appearing in random data, and determining whether the data unit is valid based on a comparison of the entropy index value with an entropy threshold, and The operation further includes: determining a maximum entropy index value based on the entropy index value; and comparing the maximum entropy index value with the entropy threshold value.

20. The machine-readable medium of claim 19, wherein: The operations also include comparing the repetition of the entity within the data unit to a threshold value in a threshold set to distinguish the repetition of the entity within the data unit from random data.

21. The machine-readable medium of claim 19, wherein: Performing the one or more pattern checks includes performing a first pattern check of the one or more pattern checks based on a first threshold value of a threshold group, and performing a second pattern check of the one or more pattern checks based on a second threshold value of the threshold group.

Images