Device, method of operating device, and non-transitory computer-readable medium for storing computer-readable code for manufacturing device

Abstract

There is provided an apparatus provided with counter control circuitry for maintaining counters associated with data items, the counters including: a secondary counter, an intermediate counter and a primary counter. The apparatus is also provided with a memory protection unit configured to modify a secondary counter associated with the data item in response to a transfer of the data item from the secure storage to the off-chip storage, and to encrypt the data item based on the counter associated with the data item. The memory protection unit also performs an intermediate re-encryption process in response to overflowing the secondary counter, the intermediate re-encryption process including modifying an intermediate counter associated with the data item, and re-encrypting the data item associated with the intermediate counter. The memory protection unit also performs a primary re-encryption process in response to overflowing the intermediate counter, the primary re-encryption process including modifying the primary counter and re-encrypting each of the data items.

Description

[0001] The present technology relates to an apparatus, a method of operating the apparatus, and a non-transitory computer-readable medium for storing a computer-readable code for manufacturing the apparatus.

[0002] Some devices are provided with memory protection circuitry arranged to, in response to a transfer of a data item from secure storage to off-chip storage, perform an encryption process to encrypt the data item.

[0003] According to some configurations, there is provided an apparatus comprising:

[0004] A counter control circuit for maintaining information associated with a plurality of data items

[0005] A plurality of counters connected in series, the plurality of counters comprising:

[0006] a plurality of secondary counters, each secondary counter being associated with a data item of the plurality of data items;

[0007] a plurality of intermediate counters, each intermediate counter being associated with a subset of the plurality of data items and a corresponding subset of the plurality of secondary counters; and

[0008] a primary counter associated with the plurality of data items; and

[0009] A memory protection unit, the memory protection unit being configured to:

[0010] In response to a transfer of a data item of the plurality of data items from secure storage to off-chip storage, modifying a corresponding secondary counter associated with the data item, and subsequently encrypting the data item using an encryption process based on each of the plurality of counters associated with the data item;

[0011] In response to an overflowing secondary counter of the plurality of secondary counters, performing an intermediate re-encryption process, the intermediate re-encryption process comprising modifying an intermediate counter associated with the overflowing secondary counter and re-encrypting each data item of the subset of the plurality of data items associated with the intermediate counter using the encryption process; and

[0012] In response to an overflowing intermediate counter of the plurality of intermediate counters, a primary re-encryption process is performed, the primary re-encryption process comprising modifying the primary counter to indicate the occurrence of the overflowing intermediate counter, and subsequently re-encrypting each of the plurality of data items using the encryption process.

[0013] According to some configurations, there is provided a method of operating an apparatus, the method comprising:

[0014] A plurality of counters associated with the plurality of data items is maintained, the plurality of counters comprising:

[0015] a plurality of secondary counters, each secondary counter being associated with a data item of the plurality of data items;

[0016] a plurality of intermediate counters, each intermediate counter being associated with a subset of the plurality of data items and a corresponding subset of the plurality of secondary counters; and

[0017] a primary counter associated with the plurality of data items;

[0018] In response to a transfer of a data item of the plurality of data items from secure storage to off-chip storage, modifying a corresponding secondary counter associated with the data item, and subsequently encrypting the data item using an encryption process based on each of the plurality of counters associated with the data item;

[0019] In response to an overflowing secondary counter of the plurality of secondary counters, performing an intermediate re-encryption process, the intermediate re-encryption process comprising modifying an intermediate counter associated with the overflowing secondary counter and re-encrypting each data item of the subset of the plurality of data items associated with the intermediate counter using the encryption process; and

[0020] In response to an overflowing intermediate counter of the plurality of intermediate counters, a primary re-encryption process is performed, the primary re-encryption process comprising modifying the primary counter to indicate the occurrence of the overflowing intermediate counter, and subsequently re-encrypting each of the plurality of data items using the encryption process.

[0021] According to some configurations, there is provided a non-transitory computer readable medium for storing a computer readable code for manufacturing an apparatus, the apparatus comprising:

[0022] A counter control circuit for maintaining information associated with a plurality of data items

[0023] A plurality of counters connected in series, the plurality of counters comprising:

[0024] a plurality of secondary counters, each secondary counter being associated with a data item of the plurality of data items;

[0025] a plurality of intermediate counters, each intermediate counter being associated with a subset of the plurality of data items and a corresponding subset of the plurality of secondary counters; and

[0026] a primary counter associated with the plurality of data items; and

[0027] A memory protection unit, the memory protection unit being configured to:

[0028] In response to a transfer of a data item of the plurality of data items from secure storage to off-chip storage, modifying a corresponding secondary counter associated with the data item, and subsequently encrypting the data item using an encryption process based on each of the plurality of counters associated with the data item;

[0029] In response to an overflowing secondary counter of the plurality of secondary counters, performing an intermediate re-encryption process, the intermediate re-encryption process comprising modifying an intermediate counter associated with the overflowing secondary counter and re-encrypting each data item of the subset of the plurality of data items associated with the intermediate counter using the encryption process; and

[0030] In response to an overflowing intermediate counter of the plurality of intermediate counters, a primary re-encryption process is performed, the primary re-encryption process comprising modifying the primary counter to indicate the occurrence of the overflowing intermediate counter, and subsequently re-encrypting each of the plurality of data items using the encryption process.

[0031] The present technology will be further described, by way of example only, with reference to the configuration of the invention as shown in the accompanying drawings, in which:

[0032] Figure 1 Schematically illustrates a data processing device according to various configurations of the present technology;

[0033] Figure 2 Schematically illustrates a data processing device according to various configurations of the present technology;

[0034] Figure 3 Schematically illustrates data integrity trees according to various configurations of the present technology;

[0035] Figure 4 Schematically illustrates data integrity trees according to various configurations of the present technology;

[0036] Figure 5 Schematically illustrates data integrity trees according to various configurations of the present technology;

[0037] Figure 6 Schematically illustrates a data processing device according to various configurations of the present technology;

[0038] Figure 7 Schematically illustrates details of a data integrity tree according to various configurations of the present technology;

[0039] Figure 8 Schematically illustrates details of a data integrity tree according to various configurations of the present technology;

[0040] Fig. 9 Schematically illustrates details of a data integrity tree according to various configurations of the present technology;

[0041] Fig.10 Schematically illustrates details of a data integrity tree according to various configurations of the present technology;

[0042] Fig.11 schematically illustrates a sequence of steps taken by an apparatus according to various configurations of the present technology; and

[0043] Fig.12 The data processing apparatuses according to various configurations of the present technology are schematically illustrated.

[0044] At least some configurations provide an apparatus comprising a counter control circuit for maintaining a plurality of counters associated with a plurality of data items. The plurality of counters comprises: a plurality of secondary counters, each of which is associated with one of the plurality of data items; a plurality of intermediate counters, each of which is associated with a subset of the plurality of data items and a corresponding subset of the plurality of secondary counters; and a primary counter, the primary counter being associated with the plurality of data items. A memory protection unit is arranged to, in response to a transfer of one of the plurality of data items from secure storage to off-chip storage, modify the corresponding secondary counter associated with the data item, and subsequently encrypt the data item using an encryption process based on each of the plurality of counters associated with the data item. The memory protection unit is arranged to, in response to an overflowing secondary counter of the plurality of secondary counters, perform an intermediate re-encryption process, the intermediate re-encryption process comprising modifying the intermediate counter associated with the overflowing secondary counter, and re-encrypting each of the plurality of data items in the subset associated with the intermediate counter using the encryption process. Furthermore, the memory protection unit is arranged to, in response to an overflowing intermediate counter of the plurality of intermediate counters, perform a primary re-encryption process comprising modifying the primary counter to indicate the occurrence of the overflowing intermediate counter and subsequently re-encrypting each of the plurality of data items using the encryption process.

[0045] In order to maintain the integrity and security of data items stored in off-chip storage, some devices perform cryptographic processes to protect the data items from being read by external entities, or to provide assurance of the integrity of the data items, i.e., to allow the device to verify that the data items have not been modified by external entities. In particular, the data items can be prevented from being read by encrypting the data items themselves based on the on-chip values. Alternatively or additionally, by creating a cryptographic hash of the data item (i.e., for example, stored with the data item) as a cryptographic process, the integrity of the data item can be determined by transferring the data item from the off-chip storage to the secure storage, recalculating the cryptographic hash of the data item, and comparing it to the previously stored cryptographic value when the data item is read. If the data item has been modified, the recalculated cryptographic hash value will not match the stored hash value. This approach may be vulnerable to replay attacks, in which an attacker attempts to circumvent such a system by resending previously observed data in order to trick the system into believing that the forged data is authentic.

[0046] In order to protect the data items, the device is provided with a counter control circuit to maintain multiple counters. The multiple counters are used as inputs to the encryption process and are updated in response to the transmission of the data items transmitted to the off-chip storage. In this way, replay attacks can be mitigated because the counter values ​​used will be different each time the data is written to the off-chip storage. The result of this approach is that a large number of counter values ​​need to be stored and maintained. One way to reduce the storage overhead associated with the counter values ​​is to associate a single counter value with multiple data items. The disadvantage of this method is that each time the counter value is updated, each of the multiple data items must be decrypted using the previous counter value and re-encrypted using the new counter value. The inventors have recognized that by providing multiple counters as different levels of counters (including secondary counters, each of which is associated with one of the multiple data items (a single data item); intermediate counters, each of which is associated with multiple secondary counters and corresponding multiple data items; and primary counters, each of which is associated with multiple intermediate counters and corresponding multiple data items), the storage required for each data item can be reduced while avoiding the requirement to re-encrypt multiple data items each time they are accessed. Data items may be encrypted to generate a message authentication code (MAC) that is used to verify the integrity of the data item.

[0047] Providing counters in this manner means that for each of the data items protected by the mechanism, at least one secondary counter, one intermediate counter and one primary counter are provided. When a secondary counter is incremented, only the (single) data item associated with the secondary counter must be re-encrypted. Once a secondary counter overflows (due to a particular data item being transferred from secure storage to off-chip storage), the intermediate counter associated with the data item is incremented. Because the encryption process for each data item is based on all counters associated with the data item, it is necessary to re-encrypt all data items associated with the intermediate counters. Similarly, once an intermediate counter overflows (due to a particular data item being transferred from secure storage to off-chip storage, causing the associated secondary counter to also overflow), the primary counter associated with the data item is incremented. Because the encryption process for each data item is based on all counters associated with the data item, it is necessary to re-encrypt all data items associated with the primary counter. Providing three layers of counters (secondary, intermediate and primary) provides a highly flexible approach that allows maintaining a sufficient number of counter values ​​without requiring all data items associated with the primary counter to be re-encrypted each time any such data item is accessed.

[0048] In addition to improved flexibility, the use of three layers of counters allows for a reduction in the overhead associated with the counters. Considering the alternative of two layers of counters (secondary and primary), when a set number of bits is used, there are two options: either a small number of secondary counters can be used, or a small number of bits must be provided for each secondary counter. In the former case, the number of data items that can be associated with the set number of bits is small (equal to the number of secondary counters), and in the latter case, the primary counter will be incremented frequently, resulting in a memory-intensive rewrite of all data items associated with the primary counter. In the present invention, the provision of intermediate counters enables the provision of a large number of secondary counters. Because a large number of secondary counters are provided, each of the secondary counters will have only a small number of bits for the set number of bits and may overflow frequently. The overflow of a secondary counter causes the intermediate counter to be incremented, which triggers the rewrite of the data items associated with the intermediate counter. Although this takes up more memory than rewriting a single data item, it takes up less memory than rewriting all data items associated with the primary counter. By choosing the combined size of the intermediate and minor counters to be large enough, the frequency of incrementing the primary counter (the primary counter increments every time the minor counter increments) can be kept at a manageable level.

[0049] In some configurations, before re-encrypting each data item in the subset of the plurality of data items associated with the intermediate counter, the intermediate re-encryption process includes resetting each minor counter in the corresponding subset of the plurality of minor counters associated with the intermediate counter. Thus, a minimum number of accesses required to cause a subsequent overflow of the minor counter associated with the intermediate counter is increased. In some alternative configurations, the intermediate re-encryption process includes retaining a current value of each minor counter in the corresponding subset of the plurality of minor counters associated with the intermediate counter.

[0050] In some configurations, prior to re-encrypting each of the plurality of data items, the primary re-encryption process includes resetting each of the plurality of intermediate counters. Thus, a minimum number of accesses required to cause a subsequent overflow of one of the plurality of intermediate counters is increased. In some alternative configurations, the primary re-encryption process includes retaining a current value of each of the plurality of intermediate counters.

[0051] In some configurations, prior to re-encrypting each of the plurality of data items, the primary re-encryption process includes resetting each of the plurality of secondary counters. Thus, a minimum number of accesses required to cause a subsequent overflow of one of the plurality of secondary counters is increased, thereby increasing the number of accesses required to cause an increment of one of the plurality of intermediate counters. In some alternative configurations, the primary re-encryption process includes retaining a current value of each of the plurality of secondary counters.

[0052] The size of the data item may be fixed or variable. However, in some configurations, the size of each of the plurality of data items corresponds to the size of a single cache line. A cache line is typically the smallest unit of data transferred between the device and off-chip storage. Therefore, providing a counter control circuit to maintain the secondary counter at a cache line granularity reduces implementation overhead.

[0053] In some configurations, the total number of bits used to store the multiple counters is less than or equal to the number of bits of a single cache line. Storing the multiple counters in a single cache line means that all secondary counters and intermediate counters associated with a primary counter are retrieved from off-chip storage in a single access, and counters required to perform encryption and decryption processes on data items associated with the multiple counters can be executed without having to retrieve any additional counters from off-chip storage.

[0054] The secondary counters, intermediate counters, and primary counters may be provided to have any size. However, in some configurations, each of the plurality of secondary counters is a 5-bit counter; and the plurality of intermediate counters includes 8 intermediate counters, and each of the 8 intermediate counters is an 8-bit counter. In such a configuration, a total of 2 secondary counters are required for the same data item. 5 A total of 2 writes are required to the same data item to trigger an overflow of the minor counter associated with that same data item. (5+8) The primary counter is written to trigger an overflow of the intermediate counter associated with the same data item. Thus, the increment of the primary counter is triggered less frequently and fewer memory-intensive operations are required to rewrite all data items associated with the primary counter.

[0055] In some configurations, each of the plurality of secondary counters is a 3-bit counter; and the plurality of intermediate counters includes 8 intermediate counters, and each of the 8 intermediate counters is a 4-bit counter. In this configuration, a total of 2 3 A total of 2 writes are required to the same data item to trigger an overflow of the minor counter associated with that same data item. (3+4) writes to trigger an overflow of an intermediate counter associated with the same data item. For a fixed storage space, such as in a single cache line, using this size selection for the counter allows more data items to be associated with the counter.

[0056] The above techniques can be implemented for cache lines of any size. However, in some configurations, the number of bits of a single cache line is 512 bits. In this configuration, when each secondary counter is a 5-bit counter and the multiple intermediate counters include 8 8-bit counters, the total supported number of data items is 64, corresponding to 64 secondary counters (one secondary counter for each data item), where 8 secondary counters are associated with each intermediate counter. This requires 64×5=320 bits for the secondary counters and 8×8=64 bits for the intermediate counters, for a total of 384 bits. The remaining 128 bits are used for the primary counter and (optionally) for storing any additional metadata associated with the counter. Although it is theoretically possible to support 64 data items using only two layers of counters (secondary counters and primary counters), this counter arrangement will only allow 6 bits for each secondary counter (assuming 128 bits are left for the primary counter and any additional metadata). Therefore, in the absence of intermediate counters, once any secondary counter in the secondary counter is incremented by 2 6 The main counter is incremented every time. Therefore, providing an intermediate counter can be used to reduce memory overhead.

[0057] In a configuration where a single cache line is 512 bits, and when each secondary counter is 3 bits and the multiple intermediate counters include 8 4-bit counters, the multiple counters can be associated with 128 data items, where each intermediate counter is associated with 16 of the secondary counters. This requires 128×3=384 bits for the secondary counters and 8×4=32 bits for the intermediate counters, for a total of 416 bits. The remaining 96 bits are used for the primary counters and (optionally) for storing any additional metadata associated with the counters. Furthermore, while it would be theoretically possible to support 128 data items using only two layers of counters (secondary counters and primary counters), this arrangement would only allow 3 bits per secondary counter and, therefore, once any of the secondary counters in the secondary counters is incremented by 2 3 Each time a secondary counter is provided, the primary counter is incremented, which would result in a large memory overhead that would quickly become prohibitive. Therefore, providing intermediate counters can be used to increase the number of data items that can be associated with a single 512-bit cache line. By providing counters associated with 128 data items in a single cache line, rather than counters associated with 64 data items in a single cache line, the amount of memory used to store the multiple counters is reduced by half. Considering a server storing 1.5Tb of data that provides secondary counters for each cache line, the total memory required to store the counters associated with this amount of data is reduced from 24Gb in the case of a 512-bit cache line associated with 64 cache lines to 12Gb in the case of a 512-bit cache line associated with 128 cache lines.

[0058] In some configurations, the primary counter is a 64-bit counter. Providing a large counter for the primary counter reduces the likelihood that the same set of counter values ​​will be used for encryption. The 64-bit counter provides 2 64 possible values, which, even when combined with relatively small minor and intermediate counters, produces a series of encrypted values ​​that are unlikely to repeat.

[0059] Counters can be implemented in a variety of different ways. In some configurations, each of the multiple counters is implemented as one of the following: a linear feedback shift register, where overflow corresponds to the linear feedback shift register reaching a predetermined state; a nonlinear feedback shift register, where overflow corresponds to the nonlinear feedback shift register reaching a predetermined state; and a binary counter, where overflow corresponds to the binary counter exceeding a predetermined value. A linear / nonlinear feedback shift register is a shift register whose input is a linear / nonlinear function of its previous state. Such a shift register has a finite number of possible states and eventually repeats. When the linear / nonlinear feedback shift registers reach a specific state, they are considered to have overflowed, in which case the next counter in the multiple counters increments. In the case of using binary counters, they are considered to overflow when a specific value is exceeded. In some configurations, the specific value is a maximum value, in which case the binary counter is reset to a minimum value, and the next counter in the multiple counters increments. In other configurations, the specific value is a value other than the maximum value set in the counter control circuit. In some configurations, different counter levels are implemented using different counters. For example, in some configurations, the secondary counter can be a linear feedback shift register, and the intermediate counter and the primary counter can both be binary counters. In some alternative configurations, all counters may be implemented as the same type of counter.

[0060] In some configurations, the encryption process is performed using a combination of each of the plurality of counters associated with the data item as an encryption key. For each data item, there is an associated secondary counter, an associated intermediate counter, and an associated primary counter. In some configurations, the encryption key is a hash of the combination of each of the plurality of counters associated with the data item. The encryption process may also use a security key stored in a secure storage.

[0061] In some configurations, the combination is a concatenation of each of the plurality of counters associated with the value. The secondary counters, intermediate counters, and primary counters associated with the data item may be concatenated in any order and may be concatenated before or after the hash is applied to the counter.

[0062] In some configurations, the combining is an addition of the values ​​stored in each of the plurality of counters associated with the data item. In some configurations, each of the plurality of counters is hashed and the hashed counter values ​​are added together. In some configurations, the counters are combined using a combination of concatenation and addition to generate the encryption key. In some configurations, the secondary counters and the intermediate counters associated with the data item are concatenated and the result is added to the primary counter.

[0063] The plurality of counters are not limited to three levels. In some configurations, the plurality of intermediate counters include multiple layers of intermediate counters arranged as part of a hierarchical tree structure, the hierarchical tree structure including a primary counter, multiple layers of intermediate counters, and multiple secondary counters; each intermediate counter of one of the multiple layers is associated with multiple lower-level counters, the multiple lower-level counters being associated with sequentially lower levels of the hierarchical structure; and the memory protection unit, in response to an overflowing lower-level counter of a corresponding subset of the plurality of lower-level counters, performs a next-level re-encryption process, the next-level re-encryption process including modifying the next-level counter associated with the overflowing lower-level counter, and re-encrypting each data item in a subset of the plurality of data items associated with the next-level counter. Dividing the intermediate counters into multiple layers of intermediate counters provides another level of flexibility. In this configuration, each data item will be associated with a secondary counter, a primary counter, and one intermediate counter from each layer of intermediate counters in the multiple layers of intermediate counters.

[0064] In some configurations, the memory protection engine and secure storage are integrated on the same chip. The memory protection engine and secure storage may be implemented as discrete logic blocks that are integrated as different units within the same chip. Alternatively, a single logic block may be provided that provides the functionality of both secure storage and the memory protection engine. In some configurations, the counter control circuit is also integrated onto the same chip and may be provided as a different circuit or as a combinational logic block that serves as one or more of the secure storage and the memory protection engine. By integrating the memory protection engine and secure storage onto the same chip, additional security is provided because it is difficult to forge information to perform attacks within the chip.

[0065] In some configurations, the multiple counters are stored in secure storage. Storing the multiple counters in secure storage avoids the need to encrypt or otherwise protect the multiple counters. In some alternative configurations, the multiple counters are stored off-chip and encrypted using a master key stored in secure storage. This approach avoids the need to provide a large area of ​​secure storage for the multiple counters.

[0066] In some configurations, each data item is associated with a single secondary counter, at least one intermediate counter and the primary counter. Where multiple layers of intermediate counters are provided, each data item is associated with one intermediate counter from each layer of intermediate counters.

[0067] In some configurations, the memory protection unit is configured to decrypt the encrypted data item using a decryption process based on each of a plurality of counters associated with the encrypted data item transferred from the off-chip storage to the secure storage. In this manner, the memory protection unit ensures that unencrypted data is stored in the secure storage and only encrypted versions of the data are stored in the off-chip storage.

[0068] In some configurations, the plurality of counters correspond to a single node in a data integrity tree, the data integrity tree comprising a plurality of nodes, each node storing a corresponding plurality of counters, and at least one of the plurality of nodes being an intermediate node associated with a corresponding set of data items, each data item including another node of the plurality of nodes. The data integrity tree comprises a plurality of nodes arranged in a tree structure, the tree structure having a single root node, (optionally) one or more intermediate level nodes, and leaf nodes. Each of the plurality of nodes comprises a plurality of counters. The data items associated with the counters of the root node and (optionally) the intermediate level nodes are lower level nodes of the data integrity tree. The data items associated with the counters of the leaf nodes are data items to be protected. In this manner, each data item is protected by a counter included in a leaf node of the plurality of nodes, and each of the nodes of the data integrity tree is protected by a counter included in a node layer closer to the root node. The counter of the root node is stored in a secure storage. Thus, each of the plurality of nodes is protected by a node of a layer closer to the root node. Arranging a plurality of counters within a node of the data integrity tree provides a means of increasing the number of protected data items while retaining only a set of counters in a secure storage.

[0069] The concepts described herein may be embodied in computer readable code for making devices embodying the described concepts. For example, the computer readable code may be used at one or more stages of the semiconductor design and fabrication process, including the electronic design automation (EDA) stage, to fabricate integrated circuits including devices embodying the concepts. The computer readable code may additionally or alternatively enable the definition, modeling, simulation, verification, and / or testing of devices embodying the concepts described herein.

[0070] For example, computer readable code for making an apparatus embodying the concepts described herein may be embodied in code defining a hardware description language (HDL) representation of the concepts. For example, the code may define a register transfer level (RTL) abstraction of one or more logic circuits for defining an apparatus embodying the concepts. The code may define an HDL representation of one or more logic circuits embodying the apparatus in Verilog, SystemVerilog, Chisel, or VHDL (Very High Speed ​​Integrated Circuit Hardware Description Language), as well as intermediate representations such as FIRRTL. The computer readable code may provide definitions of concepts embodying the concepts using system-level modeling languages ​​such as SystemC and SystemVerilog, or other behavioral representations of the concepts that may be interpreted by a computer to enable simulation, functional and / or formal verification, and testing of the concepts.

[0071] Additionally or alternatively, the computer readable code may define a low-level description of an integrated circuit component embodying the concepts described herein, such as one or more netlists or integrated circuit layout definitions, including representations such as GDSII. One or more netlists or other computer readable representations of integrated circuit components may be generated by applying one or more logic synthesis processes to the RTL representation to generate definitions for making devices embodying the present invention. Alternatively or additionally, one or more logic synthesis processes may generate a bitstream from the computer readable code to be loaded into a field programmable gate array (FPGA) to configure the FPGA to embody the described concepts. The FPGA may be deployed for the purpose of verifying and testing concepts before making integrated circuits, or the FPGA may be deployed directly in a product.

[0072] The computer readable code may include a mixture of code representations for making a device, such as a mixture including one or more of an RTL representation, a netlist representation, or another computer readable definition used in a semiconductor design and fabrication process to make a device embodying the invention. Alternatively or additionally, concepts may be defined in a combination of a computer readable definition used in a semiconductor design and fabrication process to make a device and computer readable code defining instructions to be executed by the defined device once fabricated.

[0073] Such computer readable code may be provided in any known transient computer readable medium (such as wired or wireless transmission of code over a network) or non-transitory computer readable medium such as a semiconductor, magnetic disk, or optical disk. An integrated circuit fabricated using the computer readable code may include components such as one or more of the following: a central processing unit, a graphics processing unit, a neural processing unit, a digital signal processor, or other components that embody the concept individually or collectively.

[0074] Specific configurations of the present technology will now be described with reference to the drawings.

[0075] Figure 1 The apparatus 10 according to some configurations of the present technology is schematically illustrated. The apparatus 10 includes a counter control circuit 12 and a memory protection unit 16. The counter control circuit 12 is configured to maintain and update a plurality of counters. The counters include a secondary counter, an intermediate counter, and a primary counter. The memory protection unit 16 is arranged to control the encryption of data transferred from the secure memory 14 to the off-chip memory 18. Each data item is associated with a secondary counter, at least one intermediate counter, and a primary counter. The encryption of the data by the memory protection unit 16 is performed based on the counter associated with the data item. In addition, when the data item is transferred from the secure memory 14 to the off-chip memory 18, the memory protection unit 14 is arranged to modify the counter associated with the data item, and perform encryption of the data item using an encryption process based on a plurality of counters associated with the data item.

[0076] Figure 2 Schematically illustrates further details of the device according to some configurations of the present technology. The data processing device is provided with a secure area 20 surrounded by a secure perimeter. The circuits included in the secure area 20 are considered to be trusted, and the circuits outside the secure area 20 are considered to be vulnerable and therefore untrustworthy. For example, DRAM 22 is an off-chip storage outside the secure area 20 and may be tampered with without knowing the components in the secure area. The secure area includes a dynamic memory controller 30 (DMC), a memory protection unit 28 (MPU) including an integrated counter control circuit, caches 26, 28 (which are secure storage located in the secure area 20), an interconnect 34, and a master device including a CPU 24, a GPU 32, and an AI accelerator 36. Data items are transmitted between DRAM 22 and cache 26 via a memory controller 30 and a memory protection unit 28. Data items are transmitted when requested by one of the master devices and may be cached in one or more higher-level caches associated with the CPU 24, the GPU 32, or the AI ​​accelerator 36. As described above, data stored in the secure area 20 does not need to be protected via an encryption process. On the other hand, data stored outside the secure area 20, such as data stored in the DRAM 22, should be protected using an encryption process.

[0077] Figure 3The concept of a data integrity tree for protecting data items in a sequence of memory blocks (Mem block 0-0 to Mem block 3-3) is schematically illustrated. Each memory block of the memory block is stored in off-chip storage. In order to verify that the data stored in the memory block has not been tampered with, a hash is generated for each memory block in the memory block when it is stored (hash 0-0 to hash 3-3). When the data is read, the corresponding hash can also be read and compared with a newly generated hash version based on the read data. In this way, it can be determined whether the hash or memory block has been modified during storage. For example, if Mem block 1-2 is modified during storage, the hash generated from the data in Mem block 1-2 will not match the hash 1-2 generated before the storage of Mem block 1-2. Using this method can ensure to a certain extent that the data in the memory block has not been modified. However, it is not possible to ensure that the data in the memory block and the corresponding hash have not been modified from the data alone. Therefore, as the next level of the data integrity tree, multiple higher-level hashes are formed based on the combination of hashes generated from data blocks. For example, hash 0 is generated as the hash of hash 0-0, hash 0-1, hash 0-2, and hash 0-3; hash 1 is generated as the hash of hash 1-0, hash 1-1, hash 1-2, and hash 1-3; hash 2 is generated as the hash of hash 2-0, hash 2-1, hash 2-2, and hash 2-3; and hash 3 is generated as the hash of hash 3-0, hash 3-1, hash 3-2, and hash 3-3. Thus, if the upper hashes (hash 0, hash 1, hash 2, and hash 3) are stored concurrently with the hashes (hash 0-0 to hash 3-3) and the corresponding memory blocks, when reading the data in the memory blocks, the integrity of the data read from the memory blocks (e.g., memory blocks 1-2) can be achieved by recalculating the hash and comparing it with the previously stored hash (hash 1-2 in the above example), and similarly, the integrity of the stored hash value can be determined by recalculating the upper hash and comparing it with the upper hash value (hash 1 in this case) stored concurrently with hashes 1-0 to hash 1-3 and the corresponding memory blocks. In the above example, the stored value of hash 1 is compared with the hashes generated from hash 1-0, hash 1-1, hash 1-2, and hash 1-3. As with hashes (hash 0-0 to hash 3-3), the process cannot verify that each of the data blocks, the corresponding hash values, and the upper hash values ​​have not been modified. Thus, a top level hash is generated based on the upper level hashes (Hash 0, Hash 1, Hash 2, and Hash 3). The top hash can be recalculated when reading data and can be compared to the stored value of the top hash to verify the integrity of the upper level hashes. To ensure that the top level hash is not modified either, the top hash is stored in secure storage. In this way, the integrity of the data items stored in the memory block can be verified.

[0078] Figure 4Schematically illustrates an alternative integrity tree for verifying the integrity of stored data. Instead of storing a tree of hash values ​​generated from data items whose hash values ​​are stored away from the root of the integrity tree, the integrity tree stores multiple sets of counters. The counters at each level (denoted as c in the figure) are associated with the MAC (in Figure 4 The MAC is generated by the associated counter and the higher level counter. Starting from the top of the tree, a single top level counter C is stored in secure storage. The top level node of the counter tree region of the integrity tree includes multiple counters c0…c k , each counter is associated with the next level counter tree region. The top node of the counter tree also stores the counters c0…c k , the top-level counter C and the hash of the key K. In this way, the top-level node counters c0…c k This can be verified by regenerating MAC T and comparing it with the stored T. If the counters c0…c k If any counter in has changed, or if MAC T has changed, the comparison will fail. At the next level counter tree area of ​​the integrity tree, each node includes multiple next level counters c 00 …c kk , where the counter c i0 …c ik The counter c of the top node of the integrity tree i Each node (i) at the next level counter tree region of the data integrity tree also includes the MAC T of i in the range 0...k i , which is from the counter c i0 …c ik with the counter c from the top node i The hash of the combination of and key K is generated. In this way, the counter c of node i i0 …c ik By regenerating MAC T i and compare it with the stored T i Compare to confirm. If the top node counter c i0 …c ik 、MACT i or counter c i If any of has changed, the comparison will fail. Each counter in the next level counter tree area is associated with data D of i in the range 0...k and j in the range 0...k ij And the corresponding MAC T ij Each MAC T ij From data D ij With counter c ij In this way, data Dij By regenerating MAC T ij and compare it with the stored T ij By incrementing (or modifying) the counter before the data item is written, the integrity tree including the counter tree region can be made resilient to replay attacks. 10 ) will require MAC T 10 Modifying the counter of the upper node, such as c0, will require recalculating MAC T and T0.

[0079] Figure 5 The use of multiple levels of counters within a single node of a counter tree according to various configurations of the present technology is schematically illustrated. In the illustrated configuration, a node of the counter tree 54 includes multiple counters, including a single primary counter C and 64 secondary counters c in the range 0 to 63. j Each of the 64 secondary counters is associated with the corresponding data D j and as data D j With the minor counter c j , the corresponding MAC T generated by the hash of the combination of the main counter C and the key K j As discussed, providing the counters as a set of secondary counters combined with a single primary counter enables more counters to be provided for the same number of bits within a node of the integrity tree. Data D j The integrity of the j and compare it with the stored MAC T j Compare to determine. Counter C and c j Associated with MAC T', which is based on counters C and c j with the key K and the major and minor counters C' and c' from the next level node closer to the root of the integrity tree i The hash of the combination of is calculated. Figure 4 In the case of data D j When written to off-chip memory, the associated minor counter c j is modified to indicate mitigation of replay attacks. j When modified, MAC T j must be recalculated to match the minor counter c j In addition, MAC T' must be recalculated to be consistent with the secondary counter c j Keep consistent. In the minor counter c j In case of overflow, the main counter C is incremented. When C is incremented, the MAC T0…T 63Each MAC in the counter tree is recalculated to be consistent with the modified primary counter. In addition, the MAC T' must be recalculated to be consistent with the primary counter C. Therefore, in this way, more data items can be associated with a single node of the counter tree. However, when a data item is modified enough times that the secondary counter associated with the data item is modified, then the counter overflows and, therefore, the MAC associated with each data item associated with the secondary counter must be recalculated.

[0080] Figure 6 The layout of the counter 66 and data value 68 in the off-chip memory is schematically illustrated. The data value 68 and the counter 66 are stored as a 512-bit cache line and are transferred to and from the secure memory by the memory protection unit 64. During the transfer, the counter 66 is maintained by the counter control circuit 60. The data value 68 may include the data value and the calculated MAC, or alternatively, the data value and the corresponding MAC may be stored in different parts of the off-chip memory. The counter 66 associated with the data value 68 may be stored in a specific area of ​​the off-chip memory, or alternatively, the counter associated with the memory page may be stored at a location aligned with the page boundary.

[0081] Figure 7 Schematically illustrated are multiple counters within a single node of an integrity tree according to some configurations of the present technology. The multiple counters include a primary counter 72, multiple intermediate counters 74, and multiple secondary counters 76. Each of the secondary counters 76 is associated with a data item (not shown). Each of the data items is associated with a single secondary counter 76, a single intermediate counter 74, and the primary counter 72. In the illustrated configuration, encryption of a single data item is based on a combination of the primary counter 72, the intermediate counter 74, and the secondary counter 76 associated with the data item. In particular, count Cnt0 87(1) is associated with a first data item and is generated from a combination of the primary counter 72, the intermediate counter 74(1), and the secondary counter 76(1); count Cnt1 87(2) is associated with a first data item and is generated from a combination of the primary counter 72, the intermediate counter 74(1), and the secondary counter 76(2); and count Cnt N 87(N) is associated with the first data item and is generated from the combination of the primary counter 72, the intermediate counter 74(K) and the secondary counter 76(N). The combination operation is the concatenation of the data items. In an alternative configuration, the combination may be achieved by addition or any other arithmetic operation.

[0082] Figure 8The layout of counters associated with some configurations of the present technology is schematically illustrated. The counters include a primary counter 84, 8 intermediate counters 86 (where each intermediate counter is an 8-bit counter) and 64 secondary counters (which are arranged into multiple groups, each group including 8 secondary counters 88), each of which is a 5-bit counter. In addition to additional metadata 82, multiple counters are stored in a single 512-bit cache line 80. The counters are used to generate MACs for a group of data item cache lines. Each cache line in the cache line is a 512-bit cache line. Each data item cache line in the data item cache line is associated with a single secondary counter 88, a single intermediate counter 86 and a primary counter 84. Each intermediate counter 86 is associated with a group of 8 secondary counters 88. In this way, multiple counters stored in a single cache line can cover a total of 64 cache lines. The counters are used to perform encryption processes for data items, for example, to generate MACs for verifying that data items stored in off-chip storage have not been modified. Whenever a cache line (e.g., cache line 89) is written, the memory protection unit responds to cache line 89 being written and increments the corresponding secondary counter 87. The memory protection unit is arranged to, in response to the modification of the secondary counter 87, perform an encryption process to generate a MAC based on the secondary counter 87, the intermediate counter 86(2) associated with cache line 89, and the primary counter 84. The memory protection unit, in response to the modification of the secondary counter 87 causing the secondary counter 87 to overflow, modifies the intermediate counter 86(2) and performs an intermediate encryption process to encrypt each of the cache lines associated with the intermediate counter 86(2) and the secondary counter 88(2) based on the modified intermediate counter 86(2). Similarly, the memory protection unit, in response to the modification of the intermediate counter 86(2) causing the intermediate counter 86(2) to overflow, modifies the primary counter 84 and performs a primary encryption process to encrypt each of the cache lines associated with the primary counter based on the modified primary counter.

[0083] Fig. 9The layout of counters associated with some configurations of the present technology is schematically illustrated. The counters include a primary counter 94, 8 intermediate counters 96 (where each intermediate counter is a 5-bit counter) and 128 secondary counters (which are arranged in multiple groups, each group including 16 secondary counters 98), each of which is a 3-bit counter. In addition to additional metadata 92, multiple counters are stored in a single 512-bit cache line 90. The counters are used to generate MACs for a group of data item cache lines. Each cache line in the cache line is a 512-bit cache line. Each data item cache line in the data item cache line is associated with a single secondary counter 98, a single intermediate counter 96 and a primary counter 94. Each intermediate counter 96 is associated with a group of 16 secondary counters 98. In this way, multiple counters stored in a single cache line can cover a total of 128 cache lines. The counters are used to perform encryption processes for data items, for example, to generate MACs for verifying that data items stored in off-chip storage have not been modified. Whenever a cache line (e.g., cache line 99) is written, the memory protection unit responds to cache line 99 being written and increments the corresponding secondary counter 97. The memory protection unit is arranged to, in response to the modification of the secondary counter 97, perform an encryption process to generate a MAC based on the secondary counter 97, the intermediate counter 96(2) associated with the cache line 99, and the primary counter 94. The memory protection unit, in response to the modification of the secondary counter 97 causing the secondary counter 97 to overflow, modifies the intermediate counter 96(2) and performs an intermediate encryption process to encrypt each of the cache lines associated with the intermediate counter 96(2) and the secondary counter 98(2) based on the modified intermediate counter 96(2). Similarly, the memory protection unit, in response to the modification of the intermediate counter 96(2) causing the intermediate counter 96(2) to overflow, modifies the primary counter 94 and performs a primary encryption process to encrypt each of the cache lines associated with the primary counter based on the modified primary counter.

[0084] Fig.10The layout of counters associated with some configurations of the present technology is schematically illustrated. The counters include a main counter 104, two upper intermediate counters 106 (each of which is an 8-bit counter), 16 lower intermediate counters 108 (which are arranged into two groups of intermediate counters) and 64 secondary counters (which are arranged into multiple groups, each group including 4 secondary counters 110, 112). The first group of secondary counters 110 is associated with the lower intermediate counter 108 (1) and the first upper intermediate counter in the upper intermediate counter 106, and the second group of secondary counters 112 is associated with the lower intermediate counter 108 (2) and the second upper intermediate counter in the upper intermediate counter 106. Each of the secondary counters is a 4-bit counter. In addition to the additional metadata 102, multiple counters are stored in a single 512-bit cache line 100. The counters are used to generate MACs for a group of data item cache lines. Each cache line in the cache line is a 512-bit cache line. Each of the data item cache lines is associated with a single secondary counter in one of the plurality of sets of secondary counters 110, 112, a single lower intermediate counter 108, a single upper intermediate counter in the set including the upper intermediate counter 106, and the primary counter 104. In this way, the plurality of counters stored in a single cache line may cover a total of 64 cache lines. The counters are used to perform a cryptographic process of the data item, for example, to generate a MAC for verifying that the data item stored in the off-chip storage has not been modified. Whenever a cache line (e.g., cache line 109) is written, the memory protection unit responds to the cache line 109 being written and increments the corresponding secondary counter 107. The memory protection unit is arranged to perform a cryptographic process in response to a modification of the secondary counter 107 to generate a MAC based on the secondary counter 107, the lower intermediate counter 105 associated with the cache line 109, the upper intermediate counter 103 associated with the cache line 109, and the primary counter 104. In response to the modification of the secondary counter 107 causing the secondary counter 107 to overflow, the memory protection unit modifies the lower intermediate counter 105 and performs a lower intermediate encryption process to encrypt each of the cache lines associated with the lower intermediate counter 105 and the secondary counter 110 (8) based on the modified intermediate counter 105. In response to the modification of the lower intermediate counter 105 causing the lower intermediate counter 105 to overflow, the memory protection unit modifies the upper intermediate counter 103 and performs an upper intermediate encryption process to encrypt each of the cache lines associated with the upper intermediate counter 103, including all cache lines associated with the lower intermediate counter 108 (1) and the secondary counter 110.Similarly, the memory protection unit, in response to the modification of the upper intermediate counter 103 causing the upper intermediate counter 103 to overflow, modifies the primary counter 104 and performs a primary encryption process to encrypt each of the cache lines associated with the primary counter based on the modified primary counter.

[0085] Fig.11 A sequence of steps performed by a memory protection unit is schematically illustrated. The process begins at step S110, in which it is determined whether data is being transferred from secure storage to off-chip storage. If not, the process returns to step S110. If it is determined at step S110 that data is being transferred from secure storage to off-chip storage, the process proceeds to step S112, in which the memory protection unit modifies a secondary counter associated with the data item. The process then proceeds to step S114, in which it is determined whether the secondary counter has overflowed due to the modification of step S112. If it is determined at step S114 that the secondary counter has not overflowed, the process proceeds to step S116, in which the data item is encrypted using an encryption process. The encryption process generates a MAC based on the data item and the counter associated with the data item (including the modified secondary counter). The process then returns to step S110. If it is determined at step S114 that the secondary counter has overflowed, the process proceeds to step S118. At step S118, the memory protection unit modifies the intermediate counter associated with the data item, and the process proceeds to step S120. At step S120, it is determined whether the intermediate counter has overflowed. If it is determined at step S120 that the intermediate counter has not overflowed, the process proceeds to step S112, in which all secondary counters associated with the intermediate counter that has overflowed are (optionally) reset. The process then proceeds to step S124, in which the memory protection unit re-encrypts all data values ​​associated with the modified intermediate counter to generate a new MAC for each of the data items associated with the intermediate counter. The process then returns to step S110. If it is determined at step S120 that the intermediate counter has overflowed, the process proceeds to step S126, in which the primary counter is modified. The process then proceeds to step S128, in which all intermediate counters and all secondary counters are (optionally) reset. Then, the process proceeds to step S130, in which all data values ​​associated with the primary counter are re-encrypted based on the modified primary counter, secondary counter and intermediate counter to generate a new MAC consistent with the modified counter value. Then the process returns to step S110.

[0086] Fig.12A non-transitory computer-readable medium including computer-readable code for manufacturing a data processing device in accordance with various configurations of the present technology is schematically illustrated. Manufacturing is performed based on computer-readable code 1002 stored on the non-transitory computer-readable medium 1000. The computer-readable code can be used at one or more stages of the semiconductor design and manufacturing process, including an electronic design automation (EDA) stage, to manufacture integrated circuits including devices embodying these concepts. The manufacturing process involves applying the computer-readable code 1002 directly to one or more programmable hardware units such as a field programmable gate array (FPGA) to configure the FPGA to embody the configuration described above, or applying the computer-readable code to facilitate the manufacture of devices implemented as one or more integrated circuits or other means of embodying the configuration described above. The manufactured design 1004 includes a counter control circuit 12 and a memory protection unit 16, which is arranged to perform encryption and decryption associated with the transfer of data items between a secure memory 14 and an off-chip storage 18, as described in reference. Figure 1 described.

[0087] Briefly, there is provided an apparatus provided with a counter control circuit for maintaining counters associated with data items, the counters including: secondary counters, intermediate counters, and primary counters. The apparatus is also provided with a memory protection unit, the memory protection unit being configured to modify the secondary counters associated with the data items in response to the transfer of the data items from secure storage to off-chip storage, and to encrypt the data items based on the counters associated with the data items. The memory protection unit is also responsive to overflowing the secondary counters, performing an intermediate re-encryption process including modifying the intermediate counters associated with the data items, and re-encrypting the data items associated with the intermediate counters. The memory protection unit is also responsive to overflowing the intermediate counters, performing a primary re-encryption process including modifying the primary counters, and re-encrypting each of the data items.

[0088] In this application, the words "configured to..." are used to mean that elements of a device have a configuration that enables the performance of a defined operation. In this context, "configuration" means the arrangement or manner of interconnection of hardware or software. For example, the device may have dedicated hardware that provides the defined operation, or a processor or other processing device may be programmed to perform the function. "Configured to" does not mean that the device elements need to be changed in any way in order to provide the defined operation.

[0089] Although exemplary configurations have been described in detail herein in conjunction with the accompanying drawings, it should be understood that the present invention is not limited to those precise configurations, and that various changes, additions and modifications may be implemented therein by those skilled in the art without departing from the scope of the present invention as defined in the appended claims. For example, the features of the dependent claims may be combined in various ways with the features of the independent claims without departing from the scope of the present invention.

Claims

1. A device comprising: A counter control circuit, the counter control circuit is used to maintain a plurality of counters associated with a plurality of data items, the plurality of counters comprising: a plurality of secondary counters, each secondary counter being associated with a data item of the plurality of data items; a plurality of intermediate counters, each intermediate counter being associated with a subset of the plurality of data items and a corresponding subset of the plurality of secondary counters; and a primary counter associated with the plurality of data items; and A memory protection unit, wherein the memory protection unit is configured to: In response to a transfer of a data item of the plurality of data items from secure storage to off-chip storage, modifying a corresponding secondary counter associated with the data item, and subsequently encrypting the data item using an encryption process based on each of the plurality of counters associated with the data item; in response to an overflowing minor counter of the plurality of minor counters, performing an intermediate re-encryption process, the intermediate re-encryption process comprising modifying an intermediate counter associated with the overflowing minor counter and re-encrypting each data item of the subset of the plurality of data items associated with the intermediate counter using the encryption process; and In response to an overflowing intermediate counter of the plurality of intermediate counters, a primary re-encryption process is performed, the primary re-encryption process comprising modifying the primary counter to indicate the occurrence of the overflowing intermediate counter, and then re-encrypting each of the plurality of data items using the encryption process.

2. The apparatus of claim 1 , wherein, prior to re-encrypting each data item in the subset of the plurality of data items associated with the intermediate counter, the intermediate re-encryption process comprises resetting each secondary counter in the corresponding subset of the plurality of secondary counters associated with the intermediate counter.

3. An apparatus according to any preceding claim, wherein prior to re-encrypting each of the plurality of data items, the main re-encryption process comprises resetting each of the plurality of intermediate counters.

4. An apparatus according to any preceding claim, wherein prior to re-encrypting each of the plurality of data items, the primary re-encryption process comprises resetting each of the plurality of secondary counters.

5. Apparatus according to any preceding claim, wherein the size of each data item of the plurality of data items corresponds to the size of a single cache line.

6. An apparatus as claimed in any preceding claim, wherein the total number of bits used to store the plurality of counters is less than or equal to the number of bits of a single cache line.

7. The device according to claim 6, wherein: Each of the plurality of secondary counters is a 5-bit counter; and The plurality of intermediate counters include 8 intermediate counters, and each of the 8 intermediate counters is an 8-bit counter.

8. The device according to claim 6, wherein: Each of the plurality of secondary counters is a 3-bit counter; and The plurality of intermediate counters include 8 intermediate counters, and each of the 8 intermediate counters is a 4-bit counter.

9. The apparatus according to any one of claims 6 to 8, wherein the number of bits of the single cache line is 512 bits.

10. An apparatus as claimed in any preceding claim, wherein the primary counter is a 64-bit counter.

11. An apparatus according to any preceding claim, wherein each counter of the plurality of counters is implemented as one of: a linear feedback shift register, wherein overflow corresponds to said linear feedback shift register reaching a predetermined state; a non-linear feedback shift register, wherein overflow corresponds to the non-linear feedback shift register reaching a predetermined state; and A binary counter, wherein an overflow corresponds to said binary counter exceeding a predetermined value.

12. An apparatus as claimed in any preceding claim, wherein the encryption process is performed using a combination of each of the plurality of counters associated with the data item as an encryption key.

13. The apparatus of claim 12, wherein the combination is a concatenation of each of the plurality of counters associated with the value.

14. The apparatus of claim 12, wherein the combination is an addition of the values ​​stored in each of the plurality of counters associated with the data item.

15. An apparatus according to any preceding claim, wherein: the plurality of intermediate counters comprising multiple layers of intermediate counters arranged as part of a hierarchical tree structure, the hierarchical tree structure comprising the primary counter, the multiple layers of intermediate counters, and the plurality of secondary counters; Each intermediate counter of one of the multiple layers is associated with a plurality of lower level counters associated with sequentially lower layers of the hierarchy; and The memory protection unit performs a next level re-encryption process in response to an overflowing lower level counter of the corresponding subset of the multiple lower level counters, the next level re-encryption process including modifying the next level counter associated with the overflowing lower level counter and re-encrypting each data item in the subset of the multiple data items associated with the next level counter.

16. The apparatus of any preceding claim, wherein the memory protection engine and the secure storage are integrated on the same chip.

17. An apparatus as claimed in any preceding claim, wherein the plurality of counters are stored in the secure storage.

18. The apparatus of any one of claims 1 to 16, wherein the plurality of counters are stored off-chip and encrypted using a master key stored in the secure storage.

19. An apparatus as claimed in any preceding claim, wherein each data item is associated with a single secondary counter, at least one intermediate counter and the primary counter.

20. An apparatus according to any preceding claim, wherein the memory protection unit is configured to decrypt the encrypted data item using a decryption process based on each of the plurality of counters associated with the encrypted data item transferred from the off-chip storage to the secure storage.

21. An apparatus according to any preceding claim, wherein the plurality of counters corresponds to a single node in a data integrity tree, the data integrity tree comprising a plurality of nodes, each node storing a corresponding plurality of counters, and at least one of the plurality of nodes is an intermediate node associated with a corresponding set of data items, each data item comprising another node of the plurality of nodes.

22. A method of operating a device, the method comprising: A plurality of counters associated with a plurality of data items is maintained, the plurality of counters comprising: a plurality of secondary counters, each secondary counter being associated with a data item of the plurality of data items; a plurality of intermediate counters, each intermediate counter being associated with a subset of the plurality of data items and a corresponding subset of the plurality of secondary counters; and a primary counter associated with the plurality of data items; In response to a transfer of a data item of the plurality of data items from secure storage to off-chip storage, modifying a corresponding secondary counter associated with the data item, and subsequently encrypting the data item using an encryption process based on each of the plurality of counters associated with the data item; in response to an overflowing minor counter of the plurality of minor counters, performing an intermediate re-encryption process, the intermediate re-encryption process comprising modifying an intermediate counter associated with the overflowing minor counter and re-encrypting each data item of the subset of the plurality of data items associated with the intermediate counter using the encryption process; and In response to an overflowing intermediate counter of the plurality of intermediate counters, a primary re-encryption process is performed, the primary re-encryption process comprising modifying the primary counter to indicate the occurrence of the overflowing intermediate counter, and then re-encrypting each of the plurality of data items using the encryption process.

23. A non-transitory computer readable medium storing a computer readable code for manufacturing an apparatus comprising: A counter control circuit, the counter control circuit is used to maintain a plurality of counters associated with a plurality of data items, the plurality of counters comprising: a plurality of secondary counters, each secondary counter being associated with a data item of the plurality of data items; a plurality of intermediate counters, each intermediate counter being associated with a subset of the plurality of data items and a corresponding subset of the plurality of secondary counters; and a primary counter associated with the plurality of data items; and A memory protection unit, wherein the memory protection unit is configured to: In response to a transfer of a data item of the plurality of data items from secure storage to off-chip storage, modifying a corresponding secondary counter associated with the data item, and subsequently encrypting the data item using an encryption process based on each of the plurality of counters associated with the data item; in response to an overflowing minor counter of the plurality of minor counters, performing an intermediate re-encryption process, the intermediate re-encryption process comprising modifying an intermediate counter associated with the overflowing minor counter and re-encrypting each data item of the subset of the plurality of data items associated with the intermediate counter using the encryption process; and In response to an overflowing intermediate counter of the plurality of intermediate counters, a primary re-encryption process is performed, the primary re-encryption process comprising modifying the primary counter to indicate the occurrence of the overflowing intermediate counter, and then re-encrypting each of the plurality of data items using the encryption process.

Images