Data processing system and cache invalidation in shared cache

Abstract

The present disclosure relates to cache invalidation in data processing systems and shared caches. A data processing system includes a shared memory, a plurality of execution environments (EEs) that access the shared memory, and a cache that caches information stored in the shared memory. A first encryption engine is coupled between the plurality of EEs and the cache, and a second encryption engine is coupled between the cache and the shared memory. Encryption control circuitry is configured to store a unique key corresponding to each EE of the plurality of EEs, and to provide a current EE key corresponding uniquely to a currently executing EE of the plurality of EEs to the first encryption engine and the second encryption engine. Any data loaded into the cache during execution of the currently executing EE is encrypted using the current EE key and stored in the cache as encrypted data, and any data returned from the cache to the currently executing EE is decrypted using the current EE key.

Description

Technical Field

[0001] This disclosure generally relates to data processing systems, and more specifically, to cache invalidation in shared caches. Background Technology

[0002] Many modern data processing systems, such as System-on-a-Chip (SoC), provide the ability for more than one execution environment to share common hardware resources. In many cases, strict isolation between execution environments is crucial for security reasons, where an execution environment should not access the instructions or datasets of another environment. One resource shared among execution environments is the cache. Unrestricted access to a shared cache could allow an incoming execution environment to access the memory of a previous execution environment via the shared cache, access that would otherwise be impossible. Therefore, there is a need to improve the protection of information stored in the shared cache from access by subsequent execution environments. Summary of the Invention

[0003] The following are various embodiments of the present invention. It should be noted that any of the following aspects may be used in any combination with each other and in conjunction with any disclosed embodiments.

[0004] In one embodiment, a data processing system includes: shared memory; a plurality of execution environments (EEs) configured to access the shared memory; a cache configured to cache information stored in the shared memory; a first encryption engine coupled between the plurality of EEs and the cache; a second encryption engine coupled between the cache and the shared memory; and encryption control circuitry configured to store a unique key corresponding to each of the plurality of EEs, and to provide a current EE key uniquely corresponding to the currently executing EE among the plurality of EEs to the first and second encryption engines, wherein any data loaded into the cache during the execution of the currently executing EE is encrypted using the current EE key and stored as encrypted data in the cache, and any data returned from the cache to the currently executing EE is decrypted using the current EE key. In one aspect of the above embodiments, the data loaded into the cache during the execution of the currently executing EE includes write data provided for write access, the write data being stored as encrypted data using the current EE key. In another aspect, the write data is encrypted by the first encryption engine. On the other hand, data loaded into the cache during the execution of the currently executing EE includes data retrieved from shared memory in response to a cache miss, which is stored as encrypted data using the current EE key. In another aspect, the retrieved data is encrypted by a second encryption engine. In yet another aspect of the above embodiments, data returned from the cache to the currently executing EE includes data returned in response to a read access that hits in the cache. In yet another aspect, the data returned from the cache is decrypted by a first encryption engine using the current EE key. Furthermore, the encryption control circuitry is configured to generate a unique key for each EE. Additionally, each of the first and second encryption engines performs single-cycle encryption and single-cycle decryption. In yet another aspect, data loaded into the cache is stored as encrypted data in cache entries of the cache, wherein the address tag portion and status portion of the cache entry are not encrypted. Furthermore, when selecting a subsequent EE to execute from among multiple EEs, the encryption control circuitry is configured to update the current EE key uniquely corresponding to the currently executing EE among the multiple EEs to a unique EE key corresponding to the subsequent EE.

[0005] In another embodiment, a method in a data processing system configured to execute multiple execution environments (EEs) and having shared memory and a cache corresponding to the shared memory includes: selecting a first EE from the plurality of EEs as the currently executing EE; when the first EE is the currently executing EE: selecting a first unique key corresponding to the first EE, and having the cache accessed by a requester of the first EE, wherein any data loaded into the cache is encrypted with the first unique key and stored as encrypted data in the cache, and any data returned from the cache to the first EE is decrypted with the first unique key; and selecting a second EE from the plurality of EEs as the currently executing EE, and selecting a second unique key corresponding to the second EE, wherein any data returned from the cache to the second EE is decrypted with the second unique key to invalidate any data previously stored in the cache encrypted with the first unique key. In one aspect of another embodiment, when data returned from the cache to the second EE is provided from a cache entry updated when the first EE was the currently executing EE, the decrypted data is not correctly decrypted, thereby invalidating the data in the cache entry. On the other hand, the data loaded into the cache during the execution of the first EE includes write data provided for write access, which is stored as encrypted data using a first unique key. On the other hand, the data loaded into the cache during the execution of the first EE includes data retrieved from shared memory in response to a cache miss, which is stored as encrypted data using the first unique key. On the other hand, the data returned from the cache to the currently executing EE includes data returned in response to a read access that hits in the cache. In yet another aspect, the method further includes generating each of a first unique key and a second unique key. On yet another aspect, the method further includes storing a unique key for each of a plurality of EEs within an encryption control circuit. In another aspect of a further embodiment, encryption is performed using single-cycle encryption, and decryption is performed using single-cycle decryption. On yet another aspect, no refresh or invalidation operation is performed in the cache in response to switching the currently executing EE from the first EE to the second EE. Attached Figure Description

[0006] The invention is illustrated by way of example and is not limited to the accompanying drawings, in which similar reference numerals indicate similar elements. Elements in the drawings are shown for simplicity and clarity, and are not necessarily drawn to scale.

[0007] Figure 1 A data processing system with shared memory and shared cache, encryption engine and encryption control circuitry according to an embodiment of the present invention is illustrated in block diagram form, wherein the data processing system includes multiple execution environments.

[0008] Figure 2An embodiment of the present invention is illustrated in block diagram form. Figure 1 A more detailed view of the encryption control circuitry.

[0009] Figure 3 An embodiment of the present invention is illustrated in diagram form. Figure 1 Example cache entries within the shared cache.

[0010] Figure 4 The operation according to an embodiment of the present invention is illustrated in flowchart form. Figure 1 The methods of data processing systems. Detailed Implementation

[0011] On the one hand, to protect cached data of the execution environment within the shared cache from access by subsequent execution environments, a cache invalidation method is provided by encrypting the data to be stored in the shared cache and decrypting the data read from the shared cache. Encryption and decryption are performed using a specific key corresponding to the currently executing execution environment (EE). In this way, any data read from the shared cache cannot be correctly decrypted without the correct key. In one embodiment, each execution environment causes the selection or generation of a corresponding key specific to that execution environment. In this way, when an execution environment is currently executing, it can use its corresponding key to access the shared cache, while it cannot successfully access any data stored in the shared cache by the currently executing execution environment using the corresponding key of any other execution environment.

[0012] Figure 1 A data processing system 10 according to an embodiment of the present invention is shown. The data processing system 10 includes processors 28 and 32, a Level 1 (L1) cache 30 coupled to processor 28, an interconnect 12, a Level 2 (L2) cache 20, encryption engines 22 and 24, encryption control circuitry 26, and shared memory 18 (where both L1 cache 30 and L2 cache 20 correspond to shared memory 18). Processors 28, 32, and cache 20 (via encryption engine 22) are bidirectionally coupled via interconnect 12. Shared memory 18 is coupled to cache 20 (via encryption engine 24). Shared memory 18 can be any type of cacheable memory, such as static random access memory (SRAM), dynamic random access memory (DRAM), flash memory, etc., and is a backup storage area for caches 20 and 30. That is, each of caches 20 and 30 is configured to cache information stored in shared memory 18.

[0013] The data processing system 10 can be implemented as a SoC and is therefore referred to as SoC 10. SoC 10 includes multiple execution environments, including: execution environment 1 (EE 1) 14, which includes L1 cache 20, processor 28, and access manager 34; and execution environment 2 (EE 2) 16, which includes processor 32. Although only two execution environments (EEs) are shown, SoC 10 can include any number of EEs. Each EE, including EE 1 and EE 2, can include any number of elements in addition to or in place of a processor. For example, each EE can include any number of processors, cores, central processing unit (CPU) local buses, peripheral input / output (I / O) ports, memory, etc. Furthermore, in alternative embodiments, a single core with a single cache can include any number of EEs. Each EE can include EE-specific resources (e.g., processor 28 and L1 cache 30 are dedicated to EE 1), and SoC 10 can include resources shared between EEs (e.g., shared memory 18 and L2 cache 20 are shared between EE 1 and EE 2). Note that in an alternative embodiment, the EE's processor may include a local L1 cache as a lower-level cache to store recently accessed information of shared memory 18, wherein the local L1 cache has a faster access time compared to the L2 cache. In one embodiment, L1 cache 30 is absent, wherein only L2 cache 20 is used to store recently accessed information of shared memory 18. Therefore, SoC 10 may include any number and level of caches as needed. For example, SoC 10 may include other local or shared memory with one or more corresponding caches. As used herein, note that L2 cache 20 may be referred to as shared cache 20 or simply cache 20. Interconnect 12 and any local interconnects within the execution environment may be implemented using any type of interconnect known in the art, such as a bus, cross-bar switch, etc.

[0014] Any element or device in SoC 10 capable of generating access requests to shared memory 18 can be referred to as the requester (i.e., the controller). For example, each of processor 28 of EE 1 and processor 32 of EE 2 is a requester that generates read and write access requests to shared memory 18. Each of these read and write requests is first provided to cache 20 to determine if cache 20 can complete the request more quickly. For example, for each access request, a portion of the access address of the access request is compared with the tag address of cache 20 to determine whether a cache hit or miss occurs, as is known in the art. In the case of a cache hit, the read or write can be performed directly through cache 20. For example, for a read, this includes returning read data from a hit entry in cache 20 instead of having to access memory 18, and for a write, this includes writing write data to cache 20, which is written to memory 18 when a cache hit occurs (e.g., for a write-through cache) or written back to memory 18 at a later time (e.g., for a write-back cache). However, in the event of a miss, the read or write is performed through memory 18.

[0015] Cache 20 can be updated as needed with new cached data from memory 18. For example, cache 20 can be updated in response to a read or write access request that misses in the cache or when data is prefetched from memory 18 into the cache. Updating cache 20 may include allocating new cache lines according to a cache allocation strategy, as known in the art. Note that cache 20 can be any type of cache (e.g., instruction or data cache, direct-mapped cache, fully associative cache, set-associative cache, etc.) and can be implemented using any type of caching strategy. Therefore, cache 20 between cryptographic engines 22 and 24 can itself operate as known in the art and includes known control circuitry to manage cache access (e.g., determining hits / misses, updating the cache, performing cache operations such as refresh and invalidation, etc.). However, before any new data is stored in cache 20, it is first encrypted with the corresponding key, and before the data is returned from cache 20 to the requester, it is first decrypted with the corresponding key, as will be described in more detail below.

[0016] In one embodiment, each EE can have a corresponding identifier, called an EE ID. Figure 1In this example, each EE includes a requester, and the current EE ID can refer to the ID of the requester making the request (e.g., processor 28 or 30). The current EE ID can be provided to the cryptographic control circuitry 26 as a hardware signal available within the SoC 10. The current EE ID is also updated when the currently executing EE changes from one EE to another. In one embodiment, one of the EEs in the SoC 10 (such as a trusted EE) can control which EE is currently executing and when control is transferred to a different EE. Figure 1 In the illustrated embodiment, EE 1 includes an access manager 34 (which may be implemented as a hardware block) controlled by software executing on processor 28 to control which EE has control over SoC 10 (i.e., which EE has access rights to any shared resources), wherein access manager 34 provides the current EE ID to SoC 10. In one embodiment, access manager 34 also controls or restricts each EE's access to interconnect 12 to, for example, prevent EEs from freely spying on interconnect 12 after decryption.

[0017] Encryption engine 22 is coupled between cache 20 and each of EE 1 and EE 2, and encryption engine 24 is coupled between cache 20 and shared memory 18. Encryption control circuitry 26 is coupled to encryption engines 22 and 24, wherein encryption control circuitry 26 receives the current EE ID and provides the corresponding current EE key to each of encryption engines 22 and 24. Each of encryption engines 22 and 24 is capable of encrypting and decrypting data using the received current EE key. In one embodiment, any data written from shared memory 18 to cache 20 is first encrypted by encryption engine 24 and stored in cache 20 as encrypted cache data, and any data provided from cache 20 back to interconnect 12 is first decrypted by decryption engine 22 and returned as normal (decrypted) data. In one embodiment, encryption engines 22 and 24 are implemented as symmetric single-cycle encryption / decryption engines, wherein these engines are located between the requesting party (e.g., processor 28 or 30) and cache 20, and between cache 20 and higher-level memory (e.g., shared memory 18). In this way, as will be described below, data stored in and read from cache 20 can be protected and invalidated as needed.

[0018] In one embodiment, it is assumed that there are N EEs that can be executed within the SoC 10 (although in Figure 1(Only two EEs are shown in the diagram), then a set of N unique keys is pre-generated, where a unique key is assigned to each EE. Note that N can be any integer value greater than or equal to two, and the encryption engine 22 is coupled between the cache 20 and the N EEs, so that any access to the cache 20 by any EE can be completed through the encryption engine 22. Figure 2 An example of encryption control circuitry 26 is shown, which may include a storage circuitry system 38 configured to store N keys (key 1 to key N). Selection circuitry 36 (which may be implemented as, for example, a multiplexer (MUX)) receives the current EE ID at a control input and receives the N keys from the storage circuitry system 38 at a data input, and provides at its output a unique key corresponding to the currently executing EE as the current EE key. The current EE key is provided to encryption engines 22 and 24 for encryption and decryption while the current EE is executing. In the illustrated embodiment, only one EE is executed within the SoC 10 at a time. That is, at any given time, only one of the N EEs has control over the SoC 10. However, in alternative embodiments, more than one EE may have control over the SoC 10 at different times.

[0019] For example, the initial EE executing on SoC 10 has control over SoC 10 and therefore access to shared memory 18 and cache 20. The initial EE can be any EE of SoC 10 and refers to the currently executing EE. Therefore, any information cached by this initial EE (where cached information can correspond to instructions or data, and is generally referred to as data) is encrypted using its corresponding encryption key, which is received from encryption control 26 as the current EE key. For example, any data stored from shared memory 18 into cache 20 is first encrypted by encryption engine 24 using the current EE key before being stored in cache 20, and any data written from the requester of the initial EE into cache 20 is first encrypted by encryption engine 22 using the EE key before being stored in cache 20. In this way, all cached data of the initial EE is stored in cache 20 in encrypted form. Note that the currently executing EE is considered the owner of the cached information, which encrypts the data with its corresponding key for storage in cache 20. If the initial EE attempts to access a cache address (such as in response to a read hit in cache 20), the cached data from the cache hit entry will first be decrypted by the cryptographic engine 22 using the current EE key, so that the correct information is returned to the requesting party of the initial EE with the appropriate access rights.

[0020] Figure 3An L2 cache entry 40 according to an embodiment of the present invention is illustrated in schematic form, representing a cache entry that has been updated or created by an EE. Cache entry 40 includes a tag address (addr) bit portion, an encrypted data portion 42, and corresponding status bits. The tag address bit corresponds to an address location in shared memory 18, and the status bits may include one or more bits indicating the status of the cache entry (e.g., whether the entry contains valid data, whether the cached data of the entry is dirty, or whether it is consistent with memory 18, etc.). In the example of the initial EE described above, if cache entry 40 is being updated, the cached data is encrypted with the EE key corresponding to the initial EE, and this encrypted cached data is stored in the encrypted data portion 42 of the cache entry. Note that in the illustrated embodiment, only the cached data portion (e.g., cached instructions or data from memory 18) is encrypted, while the tag address bit and status bits are not encrypted.

[0021] When control of SoC 10 is transferred from the initial EE to a subsequent EE (another EE of SoC 10), the cryptographic control 26 provides the corresponding key of the subsequent EE as the key of the current EE to the cryptographic engines 22 and 24. Any access by the subsequent EE to any address cached by a previous (e.g., the initial) EE will be decrypted using a different key than the key used to encrypt the data. In this example, cached data that was already encrypted with the key of the previous EE will be decrypted with the key of the subsequent (now the current) EE. In this way, any information cached during the previous EE period will be invalidated for the currently executing EE, thus protecting the security of information previously cached by the initial EE. Note that by invalidating the cached data of the initial EE (or any previous EE) in this way, it is not necessary to refresh or invalidate cache entries every time control is transferred to a new EE. That is, by changing the current EE key used for encrypting / decrypting cached data at each EE switch, the existing cached data is effectively invalid for all EEs (including the new EE) except for the EE that owns the cached information.

[0022] Note that any memory encryption engine described herein (e.g., 22 and 24) can be implemented using any known memory encryption engine. Additionally, any cache within the SoC 10, such as any cache used for any shared memory, can be protected in this manner. Furthermore, in one embodiment, in addition to storing a key for each of the N EEs, the encryption control circuitry 26 can also generate and store N keys.

[0023] The cache invalidation method, which updates cache 20 using a key specific to each EE, can allow for improved speed of the invalidation processor. For example, there is no need to spend time flushing or invalidating the cache, thus eliminating additional software overhead. Furthermore, in one embodiment, the current EE key transfer and encryption / decryption process can be implemented using an encryption / decryption algorithm that takes only a single clock cycle (such as by using a running encryption engine), so cache invalidation can be virtually instantaneous and provides immediate isolation of cached data.

[0024] Figure 4 A method 50 for operating a SoC 10 according to an embodiment of the present invention is illustrated in flowchart form. At block 52, a first EE (e.g., EE 1) is selected as the currently executing EE. Next, at block 54, when the first EE is the currently executing EE, a first unique key corresponding to EE 1 is selected based on the currently executing EE (at block 56), and cache 20 can be accessed by the requester of EE 1 (e.g., processor 28) (at block 58). When accessing cache 20, any data loaded into cache 20 is encrypted with the first unique key, and any data returned from cache to EE 1 is decrypted with the first unique key. For example, data loaded into cache 20 may correspond to write data stored in cache 20 for write access from processor 28 to memory 18, data fetched from memory 18 in response to a read access from processor 28 that misses in cache 20, prefetching from memory 18 to cache 20, etc. Furthermore, for example, data returned from cache 20 to processor 28 may correspond to data returned in response to a read access that hits in cache 20. Regardless of the reason for data being loaded into an entry in cache 20, it is first encrypted with a unique key corresponding to the currently executing EE. Similarly, regardless of the reason for data being returned from an entry in cache 20, it is first decrypted with a unique key corresponding to the currently executing EE.

[0025] Still referencing Figure 4Following box 54, method 50 proceeds to box 60, where a second EE (e.g., EE 2) is selected as the currently executing EE, and therefore, a second unique key corresponding to EE 2 is selected based on the currently executing EE and used to encrypt any data loaded into cache 20 or decrypt any data returned from cache 20. This effectively invalidates any data previously stored in cache 20 encrypted with the unique key corresponding to EE 1 (or any data previously stored in cache 20 encrypted with the unique key of any other EE). Note that this invalidation is done without requiring an explicit refresh or invalidation operation on cache 20 in response to a transfer of control to a new EE.

[0026] Therefore, it can be understood so far how using a specific key for each EE allows for the protection of cached data in a shared cache by effectively invalidating the cached data of all EEs except the one that owns the cached data. That is, without accessing the appropriate key used to decrypt data accessed from a hit entry in the shared cache, the currently executing EE cannot access any cached data encrypted and cached by another EE. In this way, cached data is effectively invalidated without the overhead of flushing or invalidating the shared cache each time control is switched to a subsequent EE. Therefore, the protection of data stored in the shared cache can be improved.

[0027] As used herein, the term "bus" refers to a plurality of signals or conductors that can be used to transmit one or more information of various types, such as data, address, control, or status. The conductors discussed herein may be shown or described with reference to a single conductor, multiple conductors, unidirectional conductors, or bidirectional conductors. However, different embodiments may vary the implementation of the conductors. For example, a single unidirectional conductor may be used instead of a bidirectional conductor, and vice versa. Additionally, a single conductor carrying multiple signals may be used instead of multiple conductors, either continuously or in a time-division multiplexing manner. Similarly, a single conductor carrying multiple signals may be divided into various different conductors carrying subsets of these signals. Therefore, there are many options for transmitting signals.

[0028] Since the devices implementing this invention are mostly composed of electronic components and circuits known to those skilled in the art, the circuit details will not be described to any greater extent than those deemed necessary above in order to understand and comprehend the basic concepts of this invention and to avoid obscuring or departing from its teachings.

[0029] Where appropriate, some of the above embodiments can be implemented using various different information processing systems. For example, although Figure 1The accompanying discussion describes an exemplary information processing architecture, but this exemplary architecture is presented merely to provide useful reference in discussing various aspects of the invention. Of course, the description of the architecture has been simplified for illustrative purposes, and the architecture is only one of many different types of suitable architectures that can be used according to the invention. Those skilled in the art will recognize that the boundaries between logic blocks are merely illustrative, and alternative embodiments may combine logic blocks or circuit elements, or impose alternative decompositions on various logic blocks or circuit elements to achieve functionality. Therefore, it should be understood that the architecture depicted herein is merely exemplary, and in practice, many other architectures can be implemented to achieve the same functionality.

[0030] Furthermore, for example, in one embodiment, the illustrated elements of the data processing system 10 are circuit systems located on a single integrated circuit or within the same device. Alternatively, system 10 may additionally include any number of separate integrated circuits or separate devices interconnected with each other. For example, memory, peripheral devices, etc., may be located on the same integrated circuit as processors 28 and 32, or on separate integrated circuits or devices.

[0031] Furthermore, those skilled in the art should recognize that the boundaries between the functions of the above operations are merely illustrative. The functions of multiple operations may be combined into a single operation, and / or the functions of a single operation may be distributed across other operations. Additionally, alternative embodiments may include multiple instances of a particular operation, and the order of the operations may be changed in various other embodiments.

[0032] While the invention has been described herein with reference to specific embodiments, various modifications and alterations may be made without departing from the scope of the invention as set forth in the appended claims. For example, any type of core may be used instead of processors 28 and 32. Therefore, the specification and figures should be viewed in an illustrative rather than restrictive sense, and all such modifications are contemplated to be included within the scope of the invention. It is not intended that any benefit, advantage, or solution to a problem described herein with reference to specific embodiments be construed as a key, necessary, or essential feature or element of any or all claims.

[0033] As used in this article, the term “coupling” is not intended to be limited to direct coupling or mechanical coupling.

[0034] Furthermore, as used herein, the term "a (or an)" is defined as one or more. And the use of introductory phrases such as "at least one" and "one or more" in the claims should not be construed as implying that the introduction of another claim element by the indefinite article "a" would limit any particular claim containing that introduced claim element to an invention containing only one such element, even when the same claim includes the introductory phrase "one or more" or "at least one" and an indefinite article such as "a". The same applies to the use of definite articles.

[0035] Unless otherwise stated, terms such as “first” and “second” are used to arbitrarily distinguish the elements described by such terms. Therefore, these terms are not necessarily intended to indicate the temporal or other priorities of these elements.

Claims

1. A data processing system, characterized in that, include: Shared memory; Multiple execution environments (EEs) are configured to access the shared memory; A cache, configured to cache information stored in the shared memory; The first encryption engine is coupled between the plurality of EEs and the cache; A second encryption engine is coupled between the cache and the shared memory; as well as An encryption control circuit is configured to store a unique key corresponding to each of the plurality of EEs, and to provide a current EE key uniquely corresponding to the currently executing EE among the plurality of EEs to the first encryption engine and the second encryption engine, wherein the current EE key is used to encrypt any data loaded into the cache during the execution of the currently executing EE and store it as encrypted data in the cache, and the current EE key is used to decrypt any data returned from the cache to the currently executing EE.

2. The data processing system according to claim 1, characterized in that, The data loaded into the cache during the execution of the currently executing EE includes write data provided for write access, which is stored as encrypted data using the current EE key.

3. The data processing system according to claim 1, characterized in that, The data loaded into the cache during the execution of the currently executing EE includes data retrieved from the shared memory in response to a cache miss, and the data is stored as encrypted data using the current EE key.

4. The data processing system according to claim 1, characterized in that, The data returned from the cache to the currently executing EE includes data returned in response to a read access that hits the cache.

5. The data processing system according to claim 1, characterized in that, Data loaded into the cache is stored as encrypted data in cache entries, wherein the address label portion and the status portion of the cache entry are not encrypted.

6. The data processing system according to claim 1, characterized in that, When selecting a subsequent EE to be executed from the plurality of EEs, the cryptographic control circuit is configured to update the current EE key, which uniquely corresponds to the currently executed EE among the plurality of EEs, to a unique EE key corresponding to the subsequent EE.

7. A method in a data processing system configured to execute multiple execution environments (EEs) and having shared memory and a cache corresponding to said shared memory, characterized in that, The method includes: Select the first EE among the plurality of EEs as the currently executing EE; When the first EE is the currently executing EE: Select the first unique key corresponding to the first EE, and The requester of the first EE accesses the cache, wherein any data loaded into the cache is encrypted using the first unique key and stored as encrypted data in the cache, and any data returned from the cache to the first EE is decrypted using the first unique key; and The second EE among the plurality of EEs is selected as the currently executing EE, and a second unique key corresponding to the second EE is selected, wherein any data returned from the cache to the second EE is decrypted using the second unique key, thereby invalidating any data previously stored in the cache that was encrypted by the first unique key.

8. The method according to claim 7, characterized in that, When data returned from the cache to the second EE is provided from a cache entry updated when the first EE was the currently executing EE, the decrypted data is not decrypted correctly, thus invalidating the data in the cache entry.

9. The method according to claim 7, characterized in that, The data loaded into the cache during the execution of the first EE includes write data provided for write access, which is stored as encrypted data using the first unique key.

10. The method according to claim 7, characterized in that, The data loaded into the cache during the execution of the first EE includes data retrieved from the shared memory in response to a cache miss, and the data is stored as encrypted data using the first unique key.

Images