Periodic Re-encryption Delayed Write Optimization Method for Secure NVM Systems

Abstract

This invention discloses a periodic re-encryption delay write optimization method for secure NVM systems. Based on SECRET configuration, it implements a periodic re-encryption delay ERED, including word-level re-encryption delay W-ERED and row-level re-encryption delay L-ERED. The word-level re-encryption delay W-ERED tracks the overflow of local counters by assigning flag bits. Within the same period, only words whose local counters have overflowed are encrypted using the new row counter, while words whose local counters have not overflowed are encrypted using the old row counter. The row-level re-encryption delay L-ERED tracks and identifies the overflow of row counters, ensuring that within the same period, only rows whose row counters have overflowed are encrypted using the new master counter, while rows whose row counters have not overflowed are encrypted using the old master counter. This invention, applied to NVM systems, can efficiently provide data confidentiality for NVM, further reducing the number of bit flips in write operations, lowering write latency and write power consumption, and extending device lifespan.

Description

Technical Field

[0001] This invention relates to the field of re-encryption delay technology, and in particular to a periodic re-encryption delay write optimization method for secure NVM systems. Background Technology

[0002] The SECRET encryption scheme is a low-hardware, low-memory counter-based encryption optimization scheme that incorporates two optimization strategies: "smart encryption" and "energy masking." It not only reduces the number of bit flips per write-back but also lowers write energy and latency, improving NVM device lifespan without compromising encryption security. Smart encryption integrates word-level encryption and zero-word elimination techniques. Word-level encryption discovers that most words remain unmodified during cache line write-back operations. It assigns a separate 2-bit local counter to each word in a data line, allowing data encryption at a granularity smaller than that of a cache line (64 bits). The 2-bit local counter can handle up to four corresponding writes before overflowing. Whenever a local counter overflows, the row counter for that data line is incremented by 1, all local counters for that line are reset to zero, and the line is re-encrypted using the new row counter and local counters. Zero-word elimination is based on the observation that for most real-world workloads, a significant portion of plaintext written to memory is zero. The zero-word elimination technique uses a 1-bit zero flag for each word to track zero words (i.e., words with all zeros) in the cache line and keeps the zero words in their last encrypted state, thus saving the overhead of re-encrypting zero words.

[0003] Furthermore, programming an NVM cell to an intermediate state consumes more energy and latency than programming it to an end state. Plaintext typically contains long strings of 0s or 1s, but encrypted ciphertext usually consists of numerous 01 / 10 pairs. Programming an NVM cell to a 01 / 10 state consumes 3-4 times more energy than programming it to a 00 / 11 state. Therefore, writing ciphertext directly into memory is extremely energy-intensive.

[0004] Based on this, SECRET uses an "energy mask" to convert high-energy states in the ciphertext to be written back to NVM into low-energy states, thereby reducing the total write energy of the cache line. Both the zero flag and the energy mask flag are stored in memory in an encrypted state to ensure system security.

[0005] However, while SECRET outperforms BLE and DEUCE solutions in terms of reducing write power and write latency as well as improving device lifetime, it still has the following problems.

[0006] First, for programs with numerous write operations involving modifications to specific words, SECRET will frequently re-encrypt the entire cache line due to frequent overflows of a particular local counter. Second, in the SECRET and combined counter mode encryption scheme, whenever a local counter overflows, the line counter increments, and then the entire line of data is re-encrypted using the new line counter; this is referred to as line-level re-encryption. The line counter can reach a maximum of 127. When it exceeds 127, the main counter needs to be incremented by 1, and all data lines within the page corresponding to that main counter need to be re-encrypted using the new main counter; this is referred to as page-level re-encryption. Line counter overflows cause temporary program "pauses." For some programs, when an 8-bit line counter is set, it overflows on average every 0.2 seconds. Although the RSR mechanism minimizes CPU "pauses" caused by waiting for page re-encryption, there are still two shortcomings: First, when a write-back operation causes another counter of the page being re-encrypted to overflow, or when no free RSR is available, the CPU is still forced to pause. Second, for code segments with poor locality, when re-encryption occurs, the RSR mechanism needs to re-encrypt all data lines of the overflowing page. Even for code segments with good locality, the RSR mechanism still requires re-encryption of 52% of the page data each time it re-encrypts.

[0007] One of the main challenges facing NVM systems is effectively handling write operations. Compared to read operations, NVM writes have significantly higher latency (3 to 8 times higher), consume more power, and have lower device robustness (10). 6 -10 8 Therefore, the system needs to minimize the number of write operations. In reality, most programs typically modify only a small number of bits in a single write operation. Based on this observation, Zhou et al. proposed the DCW technique to reduce the number of bits written to the NVM. This technique compares the new data with the old data in the NVM during a write operation, and only the modified bits in the cache line are written to the NVM memory, while the unmodified bits are not written again. Cho et al. further proposed the FNW technique based on DCW, which further reduces the number of bits written to the NVM by reversing the data once more than half of the bits have been modified. With these write optimization techniques, the average number of bits written to the NVM per write operation is reduced to 10% to 15%.

[0008] For NVM systems, due to their non-volatile nature, data can remain retained for a very long time after power loss, posing a significant security risk to the computer system. Therefore, encryption techniques are often used in NVM to ensure the confidentiality of its internally stored data. However, directly applying traditional encryption techniques to NVM introduces the "write amplification" problem. This is because all highly secure encryption algorithms inevitably follow the avalanche effect (or diffusion effect), where even a change in a single bit in the plaintext data can cause a change in 50% of the bits in the encrypted data. This irrelevant bit write leads to a significant increase in write power, write latency, write bandwidth, and device lifespan, and also causes techniques optimized for NVM writes, such as DCW and FNW, to fail. Taking the commonly used counter-mode encryption technique as an example, because the non-reusability of OTPs is a strong guarantee of the security of counter-mode encryption, the row counter in counter-mode encryption increments with each write to ensure that each cache line has a unique OTP for each write. However, in NVM systems, this security comes at the cost of write endurance and bandwidth. Regardless of the input data to the cache line, the diffusion effect of AES causes new OTPs to differ significantly from old OTPs, resulting in substantial modifications to the calculated ciphertext. This leads to a 50% bit flip during each write operation. The application of encryption algorithms increases the number of bits written to NVM by almost four times. This increase in bit writing correspondingly increases write power consumption by four times, reduces device lifetime (related to endurance) by four times, and significantly reduces NVM write bandwidth due to power limitations. Therefore, to minimize the number of bit flips in a single NVM write, BLE and DEUCE proposed word-level encryption techniques based on traditional counter-level encryption to eliminate re-encryption of unmodified words during write operations. SECRET technology further eliminates write operations to zero words and uses energy masks to reduce write power consumption. However, this technology still requires further improvement. Summary of the Invention

[0009] The purpose of this invention is to address the technical deficiencies in existing technologies by providing a periodic re-encryption delay write optimization method for secure NVM systems. Based on SECRET, this method further reduces the number of bit flips in a single NVM write operation, reduces write latency and write power consumption, and extends the lifespan of NVM devices, addressing the shortcomings of SECRET.

[0010] The technical solution adopted to achieve the purpose of this invention is:

[0011] A periodic re-encryption delay write optimization method for secure NVM systems utilizes periodic re-encryption delay (ERED) technology to perform write operations on NVM based on SECRE to encrypt plaintext, including word-level re-encryption delay (W-ERED) and line-level re-encryption delay (L-ERED).

[0012] Among them, word-level re-encryption delay W-ERED tracks the overflow of local counters by allocating flag bits; within the same period, only words whose local counters have overflowed are encrypted with the new row counter, while words whose local counters have not overflowed are encrypted with the old row counter, in order to avoid re-encrypting the entire data row due to frequent overflow of a specific local counter, thereby reducing the number of bit flips in write operations.

[0013] Among them, the row-level re-encryption delay (L-ERED) tracks and identifies the overflow of the row counter, so that in the same period, only rows whose row counters have overflowed are encrypted with the new master counter, while rows that have not overflowed are encrypted with the old master counter, thereby reducing the number of data rows that need to be re-encrypted when the row counter overflows.

[0014] The steps for encrypting plaintext during NVM write operations using the periodic re-encryption delay (ERED) technique are as follows:

[0015] After plaintext data is evicted from LLC, the local counter overflow detection unit detects which words' local counters are marked as overflowing and calculates the old line counter based on the mask bits.

[0016] The row counter overflow detection unit detects which rows' row counters are marked as overflowing and calculates the old master counter based on the mask bits;

[0017] The AES parallel encryption engine calculates the OTP for all words based on the line address, local counter, line counter, main counter, and overflow flag for each word.

[0018] The zero-word detection unit detects which words in the plaintext are zero words; zero words will not be written back to the NVM.

[0019] All newly modified non-zero words are processed with the corresponding OTP to generate new ciphertext.

[0020] After converting the high-energy state to a low-energy state using the energy masking unit, it is written back to the NVM.

[0021] The steps for decrypting ciphertext during NVM read operations using the periodic re-encryption delay (ERED) technique are as follows:

[0022] When the ciphertext data arrives on the chip from the NVM, the metadata is decrypted first, and then the low-energy ciphertext is restored to the real ciphertext through the de-energy masking unit.

[0023] The local counter overflow detection unit detects which words' local counters are marked as overflowing and calculates the old line counter based on the mask bits;

[0024] The row counter overflow detection unit detects which rows' row counters are marked as overflowing and calculates the old master counter based on the mask bits;

[0025] The AES parallel encryption engine calculates the OTP corresponding to all words based on the line address, local counter, line counter, main counter, and overflow flag of each word.

[0026] The ciphertext of all words marked with zero is decrypted by performing operations with their corresponding OTPs to generate the corresponding plaintext. Words marked with zero do not need to be decrypted; the zero word is directly appended to the plaintext.

[0027] The metadata includes a zero flag, an energy flag, and ECC.

[0028] This invention addresses the drawback of SECRET, which requires frequent re-encryption of the entire cache line due to frequent overflows of a specific local counter. It proposes a more efficient word-level encryption scheme, ERED technology, which further reduces the number of bit flips in write operations, lowers write latency, and reduces write power consumption.

[0029] This invention designs a periodic re-encryption delay scheme ERED based on SECRET, including word-level re-encryption delay W-ERED and row-level re-encryption delay L-ERED. W-ERED tracks the overflow of local counters by allocating flag bits. Within the same period, only words whose local counters have overflowed are encrypted using the new row counter, while words whose local counters have not overflowed are still encrypted using the old row counter. This avoids re-encrypting the entire data row due to frequent overflows of a specific local counter, effectively reducing the number of bit flips in write operations. L-ERED tracks and identifies the overflow of row counters, ensuring that within the same period, only rows whose row counters have overflowed are encrypted using the new master counter, while rows that have not overflowed are encrypted using the old master counter. This significantly reduces the number of data rows that need to be re-encrypted when the row counter overflows. Attached Figure Description

[0030] Figure 1 This is a schematic diagram of the device used in the periodic re-encryption delayed write optimization processing for the secure NVM system of the present invention.

[0031] Figure 2This is a schematic diagram illustrating the working principle of the periodic-based word-level re-encryption delay W-ERED of the present invention.

[0032] Figure 3 This is a schematic diagram illustrating the working principle of the periodic row-level re-encryption delay (L-ERED) of this invention.

[0033] Figure 4 This is a diagram showing the number of bits flipped during each write operation of W-ERED when the period size varies from 8 to 32.

[0034] Figure 5 This is a comparison chart of the number of flipped bits per write operation for three write optimization schemes: DUECE, SECRET, and W-ERED.

[0035] Figure 6 This is a comparison chart of write latency for three encryption optimization schemes: DEUCE, SECRET, and W-ERED.

[0036] Figure 7 This is a comparison chart of the write power consumption of three encryption optimization schemes: DEUCE, SECRET, and W-ERED.

[0037] Figure 8 This is a comparison chart of the average number of re-encrypted lines for three different line counter overflow schemes: BASE, RSR, and L-ERED. Detailed Implementation

[0038] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0039] The Epoch-Based Re-Encryption Delay of this invention includes Word-Level Epoch-Based Re-Encryption Delay (W-ERED) and Line-Level Epoch-Based Re-Encryption Delay (L-ERED).

[0040] Word-level re-encryption delay (W-ERED) tracks and identifies local counter overflows, ensuring that only words whose local counters have overflowed are encrypted with the new row counter within the same cycle, while words whose local counters have not overflowed are still encrypted with the old row counter. This avoids re-encrypting words that have not overflowed, thus significantly reducing the bit flip number, write power consumption, and write latency of secure NVM (Non-Volatile Memory) systems.

[0041] Row-level re-encryption delay (L-ERED) tracks and identifies row counter overflows, ensuring that only rows whose row counters have overflowed are encrypted using the new master counter within the same period, while rows whose row counters have not overflowed are still encrypted using the old master counter. This reduces the granularity of data blocks that need to be re-encrypted every time a row counter overflows.

[0042] like Figure 1 As shown, the present invention provides a periodic re-encryption delay ERED write optimization method or technique for secure NVM systems, based on... Figure 1 The device structure shown is based on the existing SECRET encryption scheme, but adds a local counter overflow detection unit and a row counter overflow detection unit to track and identify the overflow of the local counter and the row counter. It includes four additional AES parallel encryption engines, one row counter overflow detection unit, one local counter overflow detection unit, one zero-word detection unit, one energy mask unit, and one energy mask decryption unit. The outputs of the AES parallel encryption engines are connected to the corresponding inputs of the 4:1 MUX. The outputs of the row counter overflow detection unit and the local counter overflow detection unit are each connected to the corresponding inputs of the 4:1 MUX. Each of the row counter overflow detection unit and the local counter overflow detection unit performs counter overflow detection on the row counter and overflow flag, and on the local counter and overflow flag, respectively, and inputs the detection results to the 4:1 MUX. The 4:1 MUX outputs an OTP based on the input counter overflow detection results and the data input from the AES parallel encryption engines.

[0043] The zero-word detection unit and the energy masking unit are connected to the 1:2DEMUX. The output of the 1:2DEMUX is added to the output OTP of the 4:1MUX and then input to the energy masking unit. After receiving the plaintext, the zero-word detection unit outputs a zero-word marker to the 1:2DEMUX. After the 1:2DEMUX discards the zero-word, the output data is added to the output OTP of the 4:1MUX and then input to the energy masking unit. After the energy masking unit reads the data from the NVM, its output ciphertext is added to the output OTP of the 4:1MUX and then input to the next 2:1MUX. The 2:1MUX then outputs the plaintext based on the input zero-word marker and the zero-word.

[0044] In this embodiment of the invention, the data path for the periodic re-encryption delay ERED write NVM operation is as follows (see the left side of the figure):

[0045] After plaintext data is evicted from the LLC, the first step involves the local counter overflow detection unit identifying which words' local counters are marked as overflowing and calculating the old line counters based on the mask bits. Similarly, the line counter overflow detection unit identifies which lines' line counters are marked as overflowing and calculates the old master counter based on the mask bits. Then, the AES parallel encryption engine calculates the OTP (One Time Pad) for all words based on the line address, local counter, line counter, master counter, and overflow flag for each word. The second step involves the zero word detection unit identifying which words in the plaintext are zero words; zero words are not written back to the NVM. The third step involves all newly modified non-zero words being processed with their corresponding OTPs to generate new ciphertext. This new ciphertext is then converted from a high-energy state to a low-energy state by the energy masking unit and written back to the NVM.

[0046] The right side of the diagram shows the data path for reading NVM operations as follows:

[0047] This path is the reverse of the NVM data writing operation path described above. When the ciphertext data arrives at the chip from the NVM, the first step is to decrypt the metadata (including the zero flag, energy flag, ECC, etc.), and then the energy masking module restores the low-energy ciphertext to the real ciphertext. The second step involves the local counter overflow detection unit detecting which words' local counters are marked as overflowing and calculating the old line counter based on the mask bits. Similarly, the line counter overflow detection unit detects which lines' line counters are marked as overflowing and calculates the old master counter based on the mask bits. Then, the AES parallel encryption engine calculates the OTP corresponding to all words based on the line address, local counter, line counter, master counter, and overflow flag for each word. The third step involves decrypting the ciphertext of all non-zero-marked words with their corresponding OTPs to generate the corresponding plaintext. Words marked as zero do not require decryption; the zero is simply appended to the plaintext.

[0048] The following explains W-ERED, a periodic-based word-level re-encryption delay scheme:

[0049] Figure 2 The operating principle of W-ERED is described. This structure, while retaining SECRET's word-level re-encryption and zero-write operation elimination, further reduces the number of bits flipped during write operations by tracking the overflow of the local counter. For ease of description, without loss of generality, the diagram assumes that each cache line is 24 bits, and each line is divided into 3 words with a granularity of 8 bits per word, allocating a 2-bit local counter and a 1-bit zero-word flag to each word.

[0050] Local counters and zero-word markers are existing features of the SECRET scheme. ERED's advancement over SECRET lies in its addition of a 1-bit overflow flag for each word to indicate whether its local counter has overflowed within a period. The old row counter remains fixed within the same period, while the new row counter continuously increments. The old row counter can be obtained by performing a simple masking operation on the new row counter. The period is not fixed; its size can be adjusted based on the set mask size. For example, by masking the two least significant bits of the row counter, the time interval between every four updates of the row counter is called the epoch period. Note that both the old and new row counters are logical counters; their values ​​are calculated from the row counter and do not require actual storage.

[0051] The diagram depicts three consecutive write operations to NVM in chronological order, showing the plaintext and ciphertext for each operation. These three write operations demonstrate the working principle of ERED. In the initial state, the local counters for words 1-3 (from left to right) are 2, 3, and 1, respectively. The zero flag for all words is 0, the overflow flag for all words is also 0, and the line counter is 0.

[0052] In the first write operation, the second word has the same data as before, the third word is written with all zeros, and only the first word has a non-zero modification compared to its initial state. Therefore, the local counter of the first word is updated, the local counter of the second word remains unchanged, while the local counter of the third word is updated and its zero flag is set to 1. Accordingly, only the first word will be encrypted using the new counter to generate new ciphertext and written back to the NVM, while the second and third words will each retain their previous ciphertext states in the NVM and will not be changed.

[0053] In the second write operation, the second and third words remain unchanged, and their corresponding local counters also remain the same. Only the first word is modified to a new non-zero word, so its corresponding local counter needs to be updated. However, during the first write operation, the local counter of the first word had already reached its maximum value represented by its number of bits. Therefore, in the second write operation, this local counter overflows. At this point, the line counter needs to be updated, and the local counter of the first word is cleared to zero, with the overflow flag set to 1. The overflow flags of the other two words remain at 0. Finally, the first word is encrypted using the new line counter 1 to generate new ciphertext, while the second and third words are still encrypted using the old line counter 0, thus maintaining their previous ciphertext state and remaining unchanged.

[0054] In the third operation, the first and third words remain unchanged, while the second word undergoes a non-zero modification. Therefore, the local counter for the second word is updated; however, the local counter for the second word has reached its maximum value represented by its number of bits, resulting in an overflow. At this point, the line counter needs to be updated, and the local counter for the second word is cleared to zero, with the overflow flag set to 1. Finally, the first and second words are encrypted using the new line counter 2 to generate new ciphertext, while the third word is still encrypted using the old line counter 0, so its ciphertext remains unchanged.

[0055] In the traditional SECRET scheme, if the local counter of a word overflows, the entire line of data must be re-encrypted using the new line counter. However, in the W-ERED scheme, words with overflowing local counters only need to be marked as overflowing and encrypted using the new line counter. Words whose local counters have not overflowed can still be encrypted using the old line counters, thus preserving the ciphertext in the NVM. Therefore, W-ERED successfully avoids the situation where an entire line of data needs to be re-encrypted due to certain frequently updated specific words.

[0056] The following section describes the periodic row-level re-encryption delay scheme L-ERED;

[0057] Figure 3 The working principle of L-ERED is described in [reference]. Figure 3 As shown, L-ERED assigns an overflow flag to each row counter, indicating whether it has overflowed within the current period. The period is not fixed; its size can be adjusted. The old master counter within the same period remains constant and can be obtained through a simple masking operation on the master counter. The figure illustrates three consecutive write operations to page 0 with updated row counters. Note that the row counter only increments when a local counter overflows; for simplicity, write operations where the row counter is not updated are omitted in the figure. As shown, page 0 has 64 data rows, D0, D1, D2...D63, with corresponding row counters C0, C1, C2...C63. ​​Initially, the master counter of page 0 is 0, and the row counters C0 and C1 corresponding to data blocks D0 and D1 (64B) have values ​​of 126 and 127 respectively. The initial state of the row counters for the remaining data blocks is 0.

[0058] During the first write operation to D0, the corresponding row counter C0 is incremented by 1, becoming 127. When D0 is written a second time, C0 needs to be incremented to 128, but this exceeds the maximum value that its bit width can represent, thus causing an overflow.

[0059] In traditional schemes, when a row counter overflows, the master counter of the page containing it needs to be incremented, and then all data rows in that page need to be re-encrypted using the new master counter, while all row counters on that page are reset to zero. However, L-ERED only needs to set the overflow flag corresponding to C0 to 1 and reset it to zero. Then, only the D0 row needs to be encrypted using the new master counter, while the remaining rows whose row counters have not overflowed can still be encrypted and decrypted using the old master counter.

[0060] The old line counter can be obtained by masking a few least significant bits of the main counter. When D1 is written for the third time, C1 overflows. At this time, the overflow flag corresponding to C1 needs to be set to 1, the main counter is incremented, and C1 and C0 are cleared. Then, D0 and D1 are re-encrypted using the new counter, and the data rows with the overflow flag of 0 are encrypted using the old counter. L-ERED can significantly avoid the situation where the line counter overflows in only a few rows of a page, causing all rows of the entire page to be re-encrypted.

[0061] Experimental verification

[0062] Experimental environment and configuration information:

[0063] First, a load-driven system simulator was implemented, with configuration information shown in Table 1. The simulator simulates two-level caches (L1 and L2), a memory controller, an AES encryption engine, PCM memory, and a counter cache related to memory safety. All cache lines are fixed at 64 bytes in size, and dirty data blocks are only written to PCM memory when they are evicted from the L2 cache or the counter cache using an LRU policy. Read and write requests are processed at the granularity of a single cache line. This invention assumes that, in the initial state, the relevant pages have already been loaded into memory and have been initialized and encrypted using the AES encryption engine in the memory controller.

[0064]

[0065] Table 1

[0066] Load information

[0067] Eleven suitable benchmark programs were selected from the SPEC CPU2006 application as test loads for the relevant experiments, as shown in Table 2. These benchmark programs were first run on gem5 to collect memory access information, which was then used as input to the system simulator. To ensure test accuracy, the simulator was first run with 100 million instructions for warm-up, and then continued to run with 5 billion instructions for related tests. This chapter first evaluates the impact of parameters on ERED, then evaluates the number of bit flips, write latency, write power consumption, and storage overhead in ERED and its comparison schemes, and finally evaluates the average number of re-encrypted rows when the row counter overflows in L-ERED and its comparison schemes.

[0068]

[0069] Table 2

[0070] Comparative experimental design

[0071] Several sets of comparative experiments were designed, and the descriptions of each scheme are as follows:

[0072] (1) BASE:

[0073] Traditional combined counter encryption technology does not employ any optimization schemes for bit flipping. It allocates a 7-bit row counter to every 64-byte data block and a 64-bit master counter to every 4-byte data page. The master counter is shared by all data rows within the same data page.

[0074] (2) DEUCE Dual-Counter Encryption Technology. The underlying layer uses the same combined counter encryption technology as the BASE scheme, but additionally sets two logical counters for the row counter: a new row counter and an old row counter. Within the same period, only modified words are encrypted using the new row counter; unmodified words are encrypted using the old row counter. The period size is set to 32, and the word size is set to 2 bytes.

[0075] (3) SECRET uses the same combination counter encryption technique as the BASE scheme, but additionally allocates a 2-bit local counter for each word in the data line, and marks the energy mask and zero words. Only the modified non-zero words are written back to NVM and undergo energy mask transformation to change the ciphertext of the modified words from a high-energy state to a low-energy state.

[0076] (4) W-ERED, based on the SECRET scheme, further tracks the overflow status of the local counter of each word. Only words whose local counters have overflowed within the period will be encrypted using the new line counter. Words whose local counters have not overflowed will still be encrypted using the old line counter.

[0077] (5) L-ERED: Based on the ERED scheme, it tracks the overflow of the row counter. Only rows whose row counters have overflowed within a cycle are encrypted using the new master counter. Rows whose row counters have not overflowed are still encrypted using the old master counter. The cycle value is set to 32.

[0078] Analysis of Experimental Results

[0079] (1) Parameter Influence Analysis

[0080] Figure 4This illustrates the number of bit flips per write operation in W-ERED as the period size varies from 8 to 32. A larger period results in a lower frequency of re-encryption of the entire data row. As shown in the figure, with a period of 8, the number of bit flips per write operation is 13.3%; with a period of 16, it is 12.3%; and with a period of 32, it is 12.1%. However, in general, further increasing the period has a relatively small impact on the number of bit flips (not exceeding 1%). Therefore, this invention defaults to a period value of 32 in this study.

[0081] (2) Analysis of the number of bit flips

[0082] Figure 5 The graph illustrates the number of bit flips per write operation for three write optimization schemes: DEUCE, SECRET, and W-ERED. On average, DEUCE reduces the number of bit flips per write operation to 23.2%. SECRET reduces the number of bit flips to 17% by eliminating write-backs of unmodified words and write-backs of zero words. However, closer observation of the data reveals that for programs like bzip2, frequent modifications to specific words in a line of data cause frequent overflows of the local counter allocated to those words, ultimately leading to frequent re-encryption of the entire line of data. W-ERED technology effectively avoids the shortcomings of SECRET by identifying and tracking overflowing local counters, encrypting only the words corresponding to the overflowing local counters with the new line counter, while the remaining words are still encrypted with the old counter. As shown in the figure, W-ERED reduces the number of bit flips per write operation to an average of 12.1%, a 5% reduction compared to SECRET.

[0083] (3) Write delay analysis

[0084] Figure 6 The data illustrates the write latency of three encryption optimization schemes: DEUCE, SECRET, and W-ERED. DEUCE reduces write latency by eliminating write-backs of unmodified words using word-level DCW technology, achieving an average write latency reduction of 19% compared to traditional counter encryption. SECRET reduces NVM write latency through word-level DCW, elimination of writes to zero words, and the use of energy masks. Energy masks can convert high-energy, high-latency non-zero modified words into low-energy, low-latency states. Compared to traditional counter encryption, SECRET reduces write latency by an average of 39%. However, the data shows that for programs like bzip, the latency difference compared to DEUCE is not significant.

[0085] The reason is that programs like bzip modify a specific word in a data line with each write operation, causing the local counter allocated to that word to frequently overflow. This ultimately leads to frequent re-encryption of the entire data line, increasing write latency. W-ERED technology identifies and tracks overflow words in a data line, encrypting only the word corresponding to the overflowed local counter using the new line counter, while the remaining words are encrypted using the old counter, effectively avoiding the shortcomings of SECRET. As shown in the figure, on average, W-ERED reduces write latency by 50% compared to traditional counter-based encryption techniques.

[0086] (4) Write the energy consumption analysis

[0087] Figure 7 This section showcases the write energy consumption of three encryption optimization schemes: DEUCE, SECRET, and W-ERED. DEUCE reduces write energy consumption by eliminating write-backs of unmodified words using word-level DCW technology, achieving an average write energy reduction of 42% compared to traditional counter encryption. SECRET reduces NVM write energy consumption through word-level DCW, elimination of write-backs of zero words, and energy masking. Compared to traditional counter encryption, SECRET reduces write energy consumption by an average of 81%. W-ERED reduces write energy consumption by 87% compared to traditional counter encryption, 6% less than the SECRET scheme.

[0088] L-ERED is an extension of the W-ERED scheme, designed to reduce the number of lines that need to be re-encrypted when the line counter overflows. Figure 8 This paper demonstrates the average number of re-encrypted rows for three different row counter overflow schemes. All three schemes use ERED at their underlying layer. In the BASE scheme, when the row counter overflows, the program "pauses" to wait for all data rows on the page containing the overflowing row counter to be re-encrypted. In the RSR scheme, when the row counter overflows, the RSR register records the re-encryption status of the data rows on the page to be re-encrypted; data rows already in the cache do not need to be re-encrypted immediately, but only need to be marked as dirty. The L-ERED scheme tracks the row counter overflow status, only encrypting rows corresponding to row counters that have overflowed within a cycle using the new master counter; rows that have not overflowed are still encrypted using the old master counter. The default cycle value for L-ERED is 32. The experimental results in the figure show that the average number of re-encrypted rows for the BASE, RSR, and L-ERED schemes during each row counter overflow is 64, 35.8, and 17.1 rows, respectively. The average number of re-encrypted rows for the L-ERED scheme is 26.7% of that for the BASE scheme and 47.7% of that for the RSR scheme, significantly reducing the average number of re-encrypted rows during row counter overflow.

[0089] (7) Storage overhead analysis

[0090] W-ERED tracks the overflow of local counters in data rows based on the SECRET scheme. Therefore, it requires allocating a 1-bit overflow flag for each word (8B) in the data row, resulting in a storage overhead of 8 / 512. L-ERED tracks the overflow of row counters based on ERED. Therefore, it requires allocating a 1-bit overflow flag for each row of data, resulting in a storage overhead of 1 / 512.

[0091] Because of the non-volatile nature of NVM, sensitive data stored within it is vulnerable to passive (eavesdropping) or active (tampering) attacks. Therefore, secure NVM systems are often combined with encryption techniques to ensure the confidentiality of stored data, and with integrity verification techniques to ensure the integrity of stored data. NVM write operations have higher latency, consume more power, and have lower device durability (10). 7 ~10 8 Therefore, the system needs to minimize write traffic as much as possible. However, directly applying traditional encryption techniques to NVM can lead to "write amplification," which not only results in higher write latency and higher write energy consumption but also accelerates the depletion of NVM device lifespan.

[0092] The periodic re-encryption delay scheme ERED proposed in this invention can efficiently provide data confidentiality for NVM systems. Compared with traditional counter encryption techniques and write optimization schemes such as DEUCE, BLE and SECRET, it can further reduce the number of bit flips in write operations, reduce write latency and write power consumption, and extend device life.

[0093] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. It will be apparent to those skilled in the art that the present invention is not limited to the details of the above exemplary embodiments, and that the present invention can be implemented in other specific forms without departing from the spirit or basic features of the present invention.

[0094] Therefore, the embodiments should be regarded as exemplary and non-limiting in all respects, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, it is intended that all variations falling within the meaning and scope of the equivalents of the claims be included within the invention.

[0095] Furthermore, it should be understood that although this specification describes embodiments, not every embodiment contains only one independent technical solution. This narrative style is merely for clarity. Those skilled in the art should consider the specification as a whole, and the technical solutions in each embodiment can also be appropriately combined to form other embodiments that can be understood by those skilled in the art.

Claims

1. A periodic re-encryption delayed write optimization method for secure NVM systems, characterized in that, By utilizing the periodic re-encryption delay (ERED) technology, plaintext is encrypted by performing write operations on the NVM based on the SECRE encryption scheme. The periodic re-encryption delay (ERED) technology includes word-level re-encryption delay (W-ERED) and line-level re-encryption delay (L-ERED). Among them, word-level re-encryption delay W-ERED tracks the overflow of local counters by allocating flag bits; within the same period, only words whose local counters have overflowed are encrypted with the new row counter, while words whose local counters have not overflowed are encrypted with the old row counter, in order to avoid re-encrypting the entire data row due to frequent overflow of a specific local counter, thereby reducing the number of bit flips in write operations. Among them, the row-level re-encryption delay (L-ERED) tracks and identifies the overflow of the row counter, so that in the same period, only rows whose row counters have overflowed are encrypted with the new master counter, while rows that have not overflowed are encrypted with the old master counter, thereby reducing the number of data rows that need to be re-encrypted when the row counter overflows.

2. The periodic re-encryption delayed write optimization method for secure NVM systems according to claim 1, characterized in that, The steps for encrypting plaintext by performing a write operation on an NVM using the aforementioned periodic re-encryption delay (ERED) technique are as follows: After plaintext data is evicted from LLC, the local counter overflow detection unit detects which words' local counters are marked as overflowing and calculates the old line counter based on the mask bits. The row counter overflow detection unit detects which rows' row counters are marked as overflowing and calculates the old master counter based on the mask bits; The AES parallel encryption engine calculates the OTP for all words based on the line address, local counter, line counter, main counter, and overflow flag for each word. The zero-word detection unit detects which words in the plaintext are zero words; zero words will not be written back to the NVM. All newly modified non-zero words are processed with the corresponding OTP to generate new ciphertext. After converting the high-energy state to a low-energy state using the energy masking unit, it is written back to the NVM.

3. The periodic re-encryption delayed write optimization method for secure NVM systems according to claim 1, characterized in that, The steps for decrypting ciphertext during NVM read operations using the aforementioned periodic re-encryption delay (ERED) technique are as follows: When the ciphertext data arrives on the chip from the NVM, the metadata is decrypted first, and then the low-energy ciphertext is restored to the real ciphertext through the de-energy masking unit. The local counter overflow detection unit detects which words' local counters are marked as overflowing and calculates the old line counter based on the mask bits; The row counter overflow detection unit detects which rows' row counters are marked as overflowing and calculates the old master counter based on the mask bits; The AES parallel encryption engine calculates the OTP corresponding to all words based on the line address, local counter, line counter, main counter, and overflow flag of each word. The ciphertext of all words marked with zero is decrypted by performing operations with their corresponding OTPs to generate the corresponding plaintext. Words marked with zero do not need to be decrypted; the zero word is directly appended to the plaintext.

4. The periodic re-encryption delayed write optimization method for secure NVM systems according to claim 3, characterized in that, The metadata includes zero flag, energy flag, and ECC.

Images