Highly efficient side-channel attack resistant memory cryptography based on key update

Abstract

A memory encryption system and method are disclosed, which rotates encryption keys to robustly resist side-channel analysis (SCA)-based attacks on the communication path between the encryption engine and external memory components within a trust boundary. A key data structure has multiple keys used to encrypt multiple blocks of memory in the external memory. The memory block encrypted using the oldest key in the key data structure is identified. Encrypted data is read from the identified memory block. The encrypted data from the identified memory block is decrypted. The data is then re-encrypted using a newly selected key (more recent than the oldest key) and rewritten to the identified memory block.

Description

Attached Figure Description

[0001] This disclosure will be more fully understood from the detailed description given below and from the accompanying drawings of various implementations of this disclosure.

[0002] Figure 1 An example memory encryption device is illustrated according to some embodiments, having components for encrypting and decrypting data written to an external memory component.

[0003] Figure 2 This is a functional block diagram of a memory encryption device having an inline encryption engine group and a memory update encryption engine group according to some embodiments.

[0004] Figure 3 This is a flowchart of an example method for decrypting and re-encrypting data written to an external memory component according to some embodiments of this disclosure.

[0005] Figure 4 This is a flowchart of an example method performed by a memory update encryption engine according to some embodiments of this disclosure.

[0006] Figure 5 This is a flowchart of an example method for calculating and utilizing Message Authentication Codes (MACs) for enhanced data integrity, according to some embodiments of this disclosure.

[0007] Figure 6 A block diagram of an example computer system in which some embodiments of the present disclosure may be operated is illustrated. Detailed Implementation

[0008] Various aspects of this disclosure relate to memory encryption systems and methods that effectively rotate encryption keys to robustly resist side-channel analysis (SCA)-based attacks on the communication path between the encryption engine and external memory components. An example of an SCA attack includes, but is not limited to, differential power analysis (DPA), where an attacker seeking to obtain the key used in encryption operations can study differences in the power distribution (i.e., power consumption patterns) of integrated circuit components while performing encryption operations. Using the systems and methods described herein, the performance of inline memory encryption engines is improved by leveraging updated memory encryption engines.

[0009] Traditional inline memory encryption systems face numerous challenges in becoming resistant to side-channel attacks. For decryption and re-encryption operations to be efficient, reading from and writing to external memory requires low latency. To meet high throughput requirements with low latency, numerous inline encryption engines often operate collaboratively (e.g., in parallel or in other configurations working together). If each of these numerous inline encryption engines is itself SCA-resistant (sometimes referred to as side-channel resistant), then the communication paths to and from external memory do not increase side-channel vulnerability. However, if the inline encryption engines themselves are side-channel resistant, the encryption system becomes very expensive in terms of gate count and area. An alternative approach used in some traditional encryption systems avoids the need for side-channel resistant inline encryption engines by updating the encryption keys in the inline encryption engines frequently enough to deter SCA attack attempts. The difficulty with this alternative lies in handling data encrypted with expired keys, which can negatively impact performance or even cause stalls.

[0010] The aspects of this disclosure address the aforementioned and other drawbacks by including multiple memory update encryption engines that work in conjunction with multiple inline encryption engines to achieve side-channel resistance without significantly impacting the performance of the memory encryption system. To prevent stalling, the memory update encryption engines update memory pages (e.g., all memory pages) in the external memory component encrypted with the oldest key from the key data structure (e.g., a key table) before the inline encryption engines perform a new write using a new key selected from the key data structure. This prevents the key data structure from growing in size and eliminates the need for additional internal memory space.

[0011] The advantages of this approach include, but are not limited to, the ability to tune the memory encryption system for optimizing key usage. This method recognizes that each key can be used multiple times during its lifetime. Therefore, using only the most recent key in the key data structure to encrypt data to be written to external memory pages may not be optimal. This method can select the key used for write operations and can randomly update the selected key using a weighted random process or a different selection process, depending on several factors (such as the size of the key data structure, the number of pages in external memory, the number of inline memory and memory update encryption engines, etc.), and can rotate the same key as long as it is newer than the oldest key.

[0012] Another advantage of the methods disclosed herein is that they are independent of memory technology. For example, these methods are equally applicable to Field Programmable Gate Array (FPGA) block random access memory (RAM), Application-Specific Integrated Circuit (ASIC) RAM, macrocells, registers, and any other type of memory technology. Furthermore, the overall implementation cost is reduced due to the zero overhead of external memory resources.

[0013] Figure 1 An example memory encryption device 110 according to some embodiments is illustrated, having cryptographic components for encrypting and decrypting data written to an external memory component. The memory encryption device 110 may reside within a trust boundary 105 (i.e., within which the possibility of data leakage is minimized, and within which data is secure against SCA attacks). The memory encryption device 110 may include an internal memory component 112, a random number generator component 114, and a cryptographic component 116 (e.g., ...). Figure 2 The diagram illustrates an inline memory encryption engine group and a memory update encryption engine group, as well as an interface 115 for communicating with an external memory component 150 residing outside the trust boundary 105, etc. In alternative embodiments, the functionality of one or more of the components can be combined or separated. During an SCA attack, the communication path 120 outside the trust boundary may compromise data security. Therefore, the cryptographic component 116 operates within the trust boundary to minimize vulnerabilities in the communication path 120.

[0014] Data can be written to or read from external memory 150 in finite-sized blocks (e.g., page-sized blocks or other sizes). The block size can be configurable. Storage blocks are typically encrypted. Random number generator component 114 can be a true random number generator (TRNG) or a deterministic random bit generator (DRBG), also known as a pseudo-random number generator (PRNG). Component 114 can generate data that can be stored in a key data structure (e.g., such as...). Figure 2 The key table 212A shown contains many keys (key tables, files, etc.). These keys can be used to encrypt blocks of storage, such as memory pages.

[0015] Internal memory 112 is within trust boundary 105 and is assumed to be protected against SCA attacks. Internal memory 112 may store key data structures and key maps (e.g., Figure 2 The key table 212A and key map 212B are shown in the diagram. Note that a single key in the key data structure can be used to encrypt multiple blocks of memory. For example, multiple memory pages can have the same page key. The key map (e.g., ...) Figure 2 The key map (212B) is a lookup data structure that provides a means of indexing its individual elements. For example, the key map 212B keeps track of the logical addresses of physical memory locations and their corresponding keys, i.e., which memory block is encrypted using which key. The key map may have one entry for each memory block, which includes an identifier (ID) of the key used to encrypt that memory block. The key map may also have a status field, such as currently encrypting, currently decrypting, etc.

[0016] Figure 2 It is based on some aspects of this disclosure within the trust boundary 105 Figure 1 A functional block diagram of a memory encryption device. As discussed above, Figure 1 The cryptographic component 116 may include an inline memory encryption engine group 216A and a memory update encryption engine group 216B within the trust boundary. Figure 2 Execution of memory encryption block 210 Figure 1 The functions of the memory encryption device 110 shown are as follows, and Figure 2 The external memory 250 in the middle is equivalent to Figure 1 The external memory component 150 is shown. The read / write path between the memory encryption block 210 and the external memory 250 is collectively shown as element 220 within the dashed ellipse. Element 220 is functionally equivalent to... Figure 1 The communication path 120 is shown. Although... Figure 2 Multiple read / write paths are shown, but there can be a merged input port for writing to external memory 250 and a merged output port for reading from external memory 250. Random numbers can be generated (e.g., by...). Figure 2 The random number generated by component 214 shown is used as a key stored in key table 212A. Data to be written to external memory 250 can be encrypted by selecting a specific key (e.g., key 1, key 2, key 3, ..., key N) from the stored keys using an encryption algorithm.

[0017] Although Figure 2 The inline memory encryption engine and the update encryption engine are shown separately as functional blocks 216A and 216B, but the inline memory encryption engine and the update encryption engine can reside in the same group of engines, their respective roles determined by configuration parameters. A non-exhaustive list of configuration parameters may include the number of available encryption engines 218, the size of the key table 212A, the size of each memory block, the total size of the external memory 250, and so on. Additionally, the number of encryption engines 218 for groups 216A and 216B need not be the same. For example, group 216A may have a different number of engines 218 than group 216B, because the update engine can operate at lower throughput to save area on the integrated circuit.

[0018] In some embodiments, the inline encryption engine group 216A, located within the trust boundary, can be used to encrypt data written to external memory and / or decrypt data read from external memory. Furthermore, the inline encryption engine group 216A can calculate a Message Authentication Code (MAC) based on the key currently used to encrypt the data or based on an additional key. The MAC is an indicator protecting the integrity and authenticity of the data. The MAC of encrypted data can be calculated using a key selected using a standard authentication encryption protocol, where the address of the storage block is incorporated into the protocol. For example, when using the Advanced Encryption Standard (AES) GCM (Galois Counter Mode) protocol, the counter value can be a concatenation of the counter and the storage block address. The MAC can also be written to an external memory address with encrypted data to enhance security against SCA attacks.

[0019] The update encryption engine group 216B, located within the trust boundary, helps update storage blocks by encrypting stored data using newer keys. A newer key refers to a key generated after the generation time of a specific key (e.g., the currently used key). Note that the chosen newer key should be newer than the currently used key, but not necessarily the most recently generated key. The update encryption engine group 216B ensures that the oldest keys in the key data structure are discarded to make room for newer keys. It also ensures that the key data structure remains at a fixed size, i.e., it does not store more than a predetermined maximum number of keys. To maintain a fixed size, the key data structure can be filled in a first-in, first-out (FIFO) manner. The update encryption engine group 216B can operate in the background in conjunction with the inline encryption engine group 216A (e.g., in parallel with the operation of the inline encryption engine group 216A). Various engines within engine groups 216A and 216B can read memory blocks and corresponding keys in a pipelined architecture, where the update encryption engine is subordinate to the inline encryption engine. In other words, if both the update encryption engine and the inline encryption engine attempt to update the storage block simultaneously, the update encryption engine operation can be aborted.

[0020] Figure 3 This is a flowchart of an example method 300 for performing SCA-resistant data transfer between a CPU and external memory according to some embodiments of the present disclosure. Method 300 can be executed by processing logic, which may include hardware (e.g., processing device, circuitry, dedicated logic, programmable logic, microcode, hardware device, integrated circuit, etc.), software (e.g., instructions that run or execute on the processing device), or a combination thereof. In some embodiments, method 300 can be performed by… Figure 1 The cryptographic component 116 shown is used to perform this.

[0021] Method 300 begins with operation 310, in which a key data structure (e.g., a key table, file, etc.) is accessed. The key data structure may include multiple keys used to encrypt multiple blocks of storage (e.g., memory pages) in external memory. Currently resident data in the storage blocks in external memory may have already been encrypted using the current set of keys. In some implementations, the key data structure may be maintained (e.g., created and / or updated) by the memory encryption device 110.

[0022] At operation 320, one or more memory blocks encrypted using the oldest key are identified. This operation can be performed by updating the encryption engine to facilitate inline encryption. A key map (e.g., key map 212B) can be used to identify one or more memory blocks encrypted using the oldest key. In some implementations, the key map can be maintained (e.g., created and / or updated) by the memory encryption device 110.

[0023] At operation 330, the inline encryption engine reads data from the identified storage block (encrypted using the oldest key). During the read, the inline encryption engine can read the key map (e.g., Figure 2 The key mapping (212B) in the code determines which key is currently being used to encrypt the storage block. If the MAC is also currently being written to the identified storage block, the inline encryption engine can also read the MAC.

[0024] At operation 340, the data read from the storage blocks(s) is decrypted using information stored in the key map and key table (e.g., accessing the key map using the address of the data's memory location to identify the appropriate key stored in the key table). If the MAC is read at operation 330, the inline encryption engine can check if the MAC is valid before decryption (e.g., by comparing the MAC read from the retrieved data with a previously stored value).

[0025] At operation 350, a newer key (i.e., one generated after the oldest key, i.e., a key generated earlier than any other key included in the key data structure) is selected from the key data structure. As mentioned earlier, the selected key should be newer than the oldest key, but not necessarily the most recently generated key. A random process (based on random key selection regardless of how many times each key is reused) or a weighted random process (based on random key selection, considering how many times each key is reused) can be used to select a newer key from the key data structure. Different selection processes can also be used.

[0026] At operation 360, the decrypted data is re-encrypted using a newer key. Alternatively, a certified encryption protocol (such as AES GCM) can be used to calculate the MAC. As mentioned earlier, in AES GCM, the calculated counter value can be a concatenation of the counter and the memory block address. This operation can be performed by an inline encryption engine.

[0027] At operation 370, the re-encrypted data (along with the MAC, if calculated at operation 360) is written to the storage block. Optionally, the key map 212B is updated by the inline memory encryption engine.

[0028] Figure 4 This is a flowchart illustrating an example method 400 of additional operations performed by a memory update encryption engine according to some embodiments of the present disclosure. Method 400 may be performed by processing logic, which may include hardware (e.g., processing device, circuitry, dedicated logic, programmable logic, microcode, hardware device, integrated circuit, etc.), software (e.g., instructions that run or execute on the processing device), or a combination thereof. In some embodiments, method 400 may be performed by… Figure 1 The cryptographic component 116 shown is used to perform this.

[0029] Method 400 begins with operation 410, where the updated encryption engine ensures that the oldest key in the key data structure is not currently being used to encrypt the external storage block. The method then proceeds to operation 420, where the updated encryption engine removes the oldest key from the key data structure. Operations 410 and 420 can occur between operations 340 and 350, which are performed by the inline encryption engine in method 300. Note that even though operations 330 to 370 described above are performed by the inline encryption engine, the updated encryption engine can also perform operations 330 to 370. However, in some embodiments, the inline encryption engine takes precedence over the updated encryption engine's update. For example, if both the updated encryption engine and the inline encryption engine attempt to update the storage block simultaneously, the updated encryption engine's operation is aborted.

[0030] At operation 430, a new key is generated (e.g., using random number generator 214). Key data structures, such as key tables, are repopulated with the new key because there is space in the fixed-size key data structure after the oldest key is eliminated at operation 420. Updating the encryption engine ensures that the size of the key data structure does not grow and optimizes the use of keys in the data structure through rotation.

[0031] Figure 5This is a flowchart of an example method 500 performed by either or both of an inline encryption engine and an update encryption engine according to some embodiments of this disclosure. Method 500 may be performed by processing logic, which may include hardware (e.g., processing device, circuitry, dedicated logic, programmable logic, microcode, hardware device, integrated circuit, etc.), software (e.g., instructions that run or execute on the processing device), or a combination thereof. In some embodiments, method 500 may be performed by… Figure 1 The password component 116 is used to execute.

[0032] At operation 510, the MAC is calculated based on the new key selected at operation 360 to re-encrypt the data. At operation 520, the calculated MAC is also written to an external memory address along with the encrypted data to provide additional security and integrity. Using a MAC generally improves security because it protects data from modification. When reading data from an external memory block, the MAC is verified before decryption.

[0033] Those skilled in the art will understand that, although Figures 3-5 The flowcharts illustrate specific sequences or orders, but the order of these processes can be modified unless otherwise stated. Therefore, the illustrated embodiments should be understood as examples only, and the illustrated processes can be performed in different orders, and some processes can be performed in parallel. Furthermore, one or more processes may be omitted in various embodiments. Therefore, not all processes are required in every embodiment. Other process flows are also possible.

[0034] Figure 6 An example machine of computer system 600 is illustrated, in which an instruction set can be executed to cause the machine to perform any or more methods discussed herein. In alternative implementations, the machine can be connected (e.g., networked) to other machines in a LAN, intranet, extranet, and / or the Internet. The machine can operate as a server or client machine in a client-server network environment, as a peer-to-peer (or distributed) network environment, or as a server or client machine in a cloud computing infrastructure or environment.

[0035] The machine can be a personal computer (PC), tablet PC, set-top box (STB), personal digital assistant (PDA), cellular phone, network device, server, network router, switch or bridge, Internet of Things (IoT) device, storage solution / controller, or any machine capable of executing a set of instructions (sequential or otherwise) specifying the actions the machine should take. Furthermore, while a single machine is illustrated, the term "machine" should also be considered as any collection of machines that individually or jointly execute one or more sets of instructions to perform any one or more methods discussed herein.

[0036] Example computer system 600 includes a processing device 602, main memory 604 (e.g., read-only memory (ROM), flash memory, dynamic random access memory (DRAM) such as synchronous DRAM (SDRAM) or Rambus DRAM (RDRAM), etc.), static memory 606 (e.g., flash memory, static random access memory (SRAM), etc.), and data storage device 618, which communicate with each other via bus 630. In one implementation, the processing device 602 may be an embedded CPU within a trust boundary 105, and the memory 606 may be... Figure 1 The external memory 150 shown.

[0037] Processing device 602 represents one or more general-purpose processing devices, such as microprocessors, central processing units, etc. More specifically, the processing device may be a Complex Instruction Set Computing (CISC) microprocessor, a Reduced Instruction Set Computing (RISC) microprocessor, a Very Long Instruction Word (VLIW) microprocessor, or a processor implementing other instruction sets, or multiple processors combining multiple instruction sets. Processing device 602 may also be one or more special-purpose processing devices, such as application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital signal processors (DSPs), network processors, etc. Processing device 602 is configured to execute instructions 626 for performing the operations discussed herein.

[0038] The computer system 600 may also include a network interface device 608 for communication via a network 620. The computer system 600 may also include a video display unit 610 (e.g., a liquid crystal display (LCD) or a cathode ray tube (CRT)), an alphanumeric input device 612 (e.g., a keyboard), a cursor control device 614 (e.g., a mouse), a graphics processing unit 622, a signal generation device 616 (e.g., a speaker), a graphics processing unit 622, a video processing unit 628, and an audio processing unit 632.

[0039] Data storage device 618 may include machine-readable storage medium 624 (also referred to as computer-readable medium) on which one or more sets of instructions 626 or software embodying any one or more methods or functions described herein are stored. The instructions 626 may also reside wholly or at least partially within main memory 604 and / or processing device 602 during execution by computer system 600, which also constitute machine-readable storage media.

[0040] In one implementation, instruction 626 includes methods for implementing and Figure 2The memory encryption module 210 contains functional instructions corresponding to these instructions. Although the machine-readable storage medium 624 is shown as a single medium in the example implementation, the term "machine-readable storage medium" should be considered to include a single medium or multiple media (e.g., a centralized or distributed database, and / or associated caches and servers) storing one or more sets of instructions. The term "machine-readable storage medium" should also be considered to include any medium capable of storing or encoding a set of instructions for execution by a machine and to cause the machine to perform any one or more methods of this disclosure. Therefore, the term "machine-readable storage medium" should be considered to include, but is not limited to, solid-state memory, optical media, and magnetic media.

[0041] Some parts of the foregoing detailed description have been presented based on the algorithms and symbolic representations of operations on data bits within computer memory. These algorithmic descriptions and representations are the most effective way for those skilled in the art of data processing to communicate the essence of their work to others skilled in the art. Algorithms here are, and are generally considered, self-consistent sequences of operations that lead to desired results. These operations are those that require physical manipulation of physical quantities. Typically, though not always, these quantities take the form of electrical or magnetic signals capable of being stored, combined, compared, and otherwise manipulated. Sometimes, primarily for common reasons, it has proven convenient to refer to these signals as bits, values, elements, symbols, characters, terms, numbers, etc.

[0042] However, it should be remembered that all these and similar terms will be associated with appropriate physical quantities and are merely convenient labels applied to those quantities. Unless otherwise clearly stated from the above discussion, it should be understood that throughout the description, discussions using terms such as “identify,” “determine,” “execute,” “select,” “generate,” or “verify” refer to the actions and processes of a computer system or similar electronic computing device, which manipulate and convert data represented as physical (electronic) quantities in the registers and memory of the computer system into other data represented as physical quantities in a similar manner in the computer system's memory or registers or other such information storage devices.

[0043] This disclosure also relates to an apparatus for performing the operations described herein. The apparatus may be specifically constructed for its intended purpose, or it may comprise a general-purpose computer selectively activated or reconfigured by a computer program stored in a computer. Such a computer program may be stored in a computer-readable storage medium, such as, but not limited to, any type of disk, including floppy disks, optical disks, CD-ROMs, USB sticks, flash memory (SD) cards and magneto-optical disks, read-only memory (ROM), random access memory (RAM), EPROM, EEPROM, magnetic cards or optical cards, or any type of medium suitable for storing electronic instructions, each coupled to a computer system bus.

[0044] The algorithms and displays presented herein are not inherently related to any particular computer or other device. Various general-purpose systems can be used with programs based on the teachings herein, or constructing more specialized devices to perform the methods may prove convenient. Various structures of these systems will emerge as illustrated in the following description. Furthermore, this disclosure is not described with reference to any particular programming language. It should be understood that the teachings of this disclosure as described herein can be implemented using a variety of programming languages.

[0045] In the foregoing specification, implementations of this disclosure have been described with reference to specific examples. It will be apparent that various modifications may be made thereto without departing from the broader spirit and scope of the implementations of this disclosure as set forth in the following claims. Therefore, the specification and drawings are to be considered illustrative rather than restrictive.

Claims

1. A method for computer hardware implementation, comprising: Access a key data structure that includes multiple encryption keys, which are used to encrypt multiple memory blocks in external memory; The memory update encryption engine identifies memory blocks among the plurality of memory blocks, which are encrypted using the oldest encryption key in the key data structure, wherein the oldest encryption key is removed from the key data structure in response to the oldest encryption key being identified as not currently used to encrypt the memory block; Read encrypted data from the identified memory block; Decrypt the encrypted data from the identified memory block; An encryption key is selected from the key data structure, wherein the selected encryption key is newer than the oldest encryption key; The memory update encryption engine re-encrypts the decrypted data from the identified memory block using the selected encryption key; An inline encryption engine configured for memory block encryption is allowed to take precedence over updates from a memory update encryption engine configured for memory block re-encryption that operates in conjunction with the inline encryption engine. as well as The re-encrypted data is written to the identified memory block.

2. The method according to claim 1, further comprising: Remove the oldest encryption key from the key data structure; as well as Generate a new encryption key to repopulate the key data structure.

3. The method according to claim 2, wherein the key data structure stores a predetermined fixed number of encryption keys.

4. The method of claim 3, wherein the key data structure is updated on a first-in-first-out (FIFO) basis, and wherein the oldest encryption key is eliminated to accommodate the new encryption key.

5. The method according to claim 1, wherein the method further comprises: Before decrypting the data, verify that the Message Authentication Code (MAC) associated with the oldest encryption key is valid.

6. The method according to claim 1, wherein the method further comprises: Before writing the re-encrypted data, calculate the MAC associated with the selected encryption key; as well as The calculated MAC is written to the identified memory block.

7. The method of claim 6, wherein the new MAC is calculated using the selected encryption key with an authenticated encryption protocol, the encryption protocol incorporating the address of the identified memory block.

8. The method of claim 1, wherein the encryption key is selected from the key data structure using a random process, a weighted random process, or a different selection process.

9. A system comprising: External memory with multiple memory blocks; as well as A computer processor, wherein the computer processor includes an inline encryption engine and a memory update encryption engine cooperating with the inline encryption engine, the computer processor being operatively coupled to the external memory to, within the trust boundary of the computer processor: Access a key data structure with multiple encryption keys, which are used to encrypt multiple memory blocks in the external memory; The memory update encryption engine identifies memory blocks among the plurality of memory blocks, which are encrypted using the oldest encryption key in the key data structure, wherein the oldest encryption key is removed from the key data structure in response to the oldest encryption key being identified as not currently used to encrypt memory blocks; Read encrypted data from the identified memory block; Decrypt the encrypted data from the identified memory block; An encryption key is selected from the key data structure, wherein the selected encryption key is newer than the oldest encryption key; The memory update encryption engine re-encrypts the decrypted data from the identified memory block using the selected encryption key; The inline encryption engine configured for memory block encryption is allowed to take precedence over updates from the memory update encryption engine configured for memory block re-encryption that operates in conjunction with the inline encryption engine. as well as The re-encrypted data is written to the identified memory block.

10. The system of claim 9, wherein the memory update encryption engine repopulates the key data structure using the newly generated encryption key.

11. The system according to claim 9, wherein the key data structure stores a predetermined fixed number of encryption keys.

12. The system of claim 9, wherein the memory update encryption engine verifies that the Message Authentication Code (MAC) associated with the oldest encryption key is valid.

13. The system of claim 9, wherein the inline encryption engine calculates a MAC associated with the selected encryption key and writes the calculated MAC into the identified memory block.

14. The system of claim 13, wherein the new MAC is calculated using the selected encryption key with an authenticated encryption protocol, the encryption protocol incorporating the address of the identified memory block.

15. The system of claim 9, wherein the inline encryption engine and the memory update encryption engine reside in the same engine group, and their roles are determined by a plurality of configuration parameters.

16. A non-transitory computer-readable storage medium storing instructions, said instructions, when executed by a processor, causing the processor to: Access a key data structure having multiple encryption keys used to encrypt multiple memory blocks in external memory outside the trust boundary of the processor, wherein the external memory is coupled to the processor, and wherein the processor includes an inline encryption engine and a memory update encryption engine that operates in conjunction with the inline encryption engine. The memory update encryption engine identifies memory blocks among the plurality of memory blocks, which are encrypted using the oldest encryption key in the key data structure, wherein the oldest encryption key is removed from the key data structure in response to the oldest encryption key being identified as not currently used to encrypt memory blocks; Read encrypted data from the identified memory block; Decrypt the encrypted data from the identified memory block; An encryption key is selected from the key data structure, wherein the selected encryption key is newer than the oldest encryption key; The memory update encryption engine re-encrypts the decrypted data from the identified memory block using the selected encryption key; The inline encryption engine configured for memory block encryption is allowed to take precedence over updates from the memory update encryption engine configured for memory block re-encryption; as well as The re-encrypted data is written to the identified memory block.

Images