DETERMINATION OF AN ACTIVITY OF AN ENCRYPTION OF A STORAGE

Description

BACKGROUND OF THE INVENTION Field of invention

[0001] The present invention relates to a method for determining the activity of an encryption of a memory of a processor or a virtual machine, an associated device comprising a processor, a computer program product and a computer-readable medium. Description of the state of the art

[0002] Some modern processors and systems-on-chips (SoCs) support transparent memory encryption, meaning it is invisible to the user. This encryption protects both main memory (RAM) and program code memory (Flash). Transparent memory encryption is supported by processors from various manufacturers. Examples include NXP LPC55Sxx PRINCE Real-time Data Encryption, the i.MX6 UltraLite Bus Encryption Engine (which enables on-the-fly DRAM encryption), AMD Secure Memory Encryption (SME), AMD Transparent Secure Memory Encryption (TSME), AMD Secure Encrypted Virtualization (SEV), AMD Secure Encrypted Virtualization-Encrypted State (SEV-ES), AMD Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP), Intel Total Memory Encryption, and Intel Multi-Key Total Memory Encryption. Another example is Intel SGX, a set of CPU instructions that allows applications to create enclaves whose memory areas are, among other things, encrypted.This involves encryption. Such storage encryption can also be referred to as confidential computing.

[0003] Transparent memory encryption in processors allows for the encryption of all memory, specific memory areas, or specifically the memory used by a particular (virtual) machine or individual processes. This requires the processor to be configured accordingly, for example, via BIOS settings or program instructions / register configurations typically executed by a boot loader, hypervisor, and / or operating system. Memory can be implemented as a separate memory chip or module connected to the processor chip via a bus. However, it is also possible for memory and a processor to be integrated into a single chip, such as a multi-chip module where multiple semiconductor dies are connected directly (die stacking) or via an interposer.

[0004] However, an unexpected effect can occur: the desired memory encryption may not be active. While the transparency that memory encryption offers from an application perspective allows it to be used without application modifications, it also means that security problems can easily go undetected. Specifically, the configuration or a configuration tool used could be faulty, a processor might not support memory encryption, or the memory encryption implementation on the processor might have a bug or vulnerability.

[0005] This is particularly relevant because different software components (e.g., BIOS, boot loader, operating system kernel, hypervisor, virtual machine monitor) can configure memory encryption, and a single processor can support different variations. Therefore, incorrect configuration is a distinct possibility. For example, during an update, the configuration might be inadvertently changed in such a way that memory encryption is no longer active. It's also possible that a running virtual machine or container application is migrated from a processor with active memory encryption to another processor without it.

[0006] Some systems allow a program to query whether memory encryption is active. However, the output does not reliably indicate whether memory encryption is actually active and effective. Furthermore, this approach is not universally supported and, in cases of partial memory encryption (e.g., only for specific memory areas, only for certain virtual machines), it is not conclusive as to whether memory encryption is actually active for a specific block of code / data. Document US2013 / 036314 describes a device for tamper protection of encrypted memory based on measured physical quantities.

[0007] The object of the invention is to provide a solution to reliably verify whether transparent memory encryption of a processor is active. SUMMARY OF THE INVENTION

[0008] The invention is defined by the features of the independent claims. Advantageous further developments and embodiments are the subject of the dependent claims. Embodiments, possible applications, and advantages of the invention will become apparent from the following description and the drawings.

[0009] The invention relates to a method for determining the activity of an encryption of memory in a processor or a virtual machine. The method comprises the following steps: at least one access to at least one memory area of ​​the memory, measurement of at least one physical quantity, wherein the physical quantity depends on the at least one access, comparison of the at least one physical quantity with at least one target value and determination of the activity of the encryption of the memory by results of comparing the at least one physical quantity with the at least one target value.

[0010] The fact that the physical quantity depends on at least one access means that the physical quantity is influenced by accessing at least one memory area of ​​the memory.

[0011] One aspect of the invention is to improve the prior art by providing a solution for reliably verifying whether a processor's transparent memory encryption is actually active. The invention solves this problem by measuring a physical quantity that depends on at least one access and validating the value of this physical quantity. The verification can be performed during startup, before loading or processing sensitive data, periodically, or it can be triggered by an event, such as a key press. Preferably, the verification is performed repeatedly during the processor's operation.

[0012] Therefore, test memory accesses are performed on at least one, preferably several, predefined memory areas. Based on the observed effects that influence the physical size, a conclusion is drawn as to whether memory encryption is actually active.

[0013] The effects that influence the physical quantity can be indirect side effects, but they can also be direct effects that occur during memory access. In particular, monitoring the signals on a memory interface or checking the written memory contents can be performed via a verification mechanism independent of the normal memory interface.

[0014] In a further development of the invention, the storage device is described as: Program code memory, configuration memory, flash memory unit, main memory, random-access memory (RAM), dynamic random-access memory (DRAM), static random-access memory (SRAM), magneto-resistive random-access memory (MRRAM), resistive random-access memory (ReRAM) or phase-change memory (PCM) The invention can be applied to all available storage media that employ encryption whose activity and effectiveness are not obvious to the user.

[0015] In a further embodiment of the invention, it comprises at least one physical quantity: a duration of the processing of the access to the at least one memory area of ​​the memory, a latency of the at least one access, a power consumption during the at least one access, a temperature development of a processor during the at least one access, an adjustment of voltage levels of a processor, an adjustment of a frequency of clock signals of a processor and / or an electromagnetic radiation during the at least one access.

[0016] The throughput of memory accesses can be determined from the time it takes to process an access to at least one memory area. Throughput and access latency can be determined using standard performance timers.

[0017] Some CPUs can determine power consumption or temperature development internally, or the information can be queried from a separate power consumption sensor or power management IC.

[0018] The determined physical quantity, also referred to as side effect data, can then be compared and validated. In particular, it can be determined whether the physical quantity is below an expected target value, i.e., whether a process such as access is performed faster than expected, whether there is a lower than expected latency, or whether the power consumption is lower than expected. From the latter aspects of the invention, it can be concluded, in particular, that the encryption is inactive.

[0019] In a further development of the invention, the method includes the following additional step: Determining or retrieving at least one target value.

[0020] The target value is thus determined before comparing the at least one physical quantity, in particular by a further measurement, or retrieved, in particular from a memory in which a value from a previous measurement has been stored.

[0021] In a further embodiment of the invention, the at least one target value is replaced by: at least one access to at least one second memory area of ​​the memory is detected, where the second memory area is unencrypted, and / or a measurement is detected on a second virtual machine.

[0022] Accessing a second memory area or a second memory location allows for a cross-comparison between different memory areas, particularly the initially accessed memory area and a second memory area. If it is known that some memory areas, especially the second memory area or the second memory location, are not encrypted, while other memory areas are supposedly encrypted, the performance difference during memory accesses to these different areas can be explained. Special test functions (memory benchmarks) can be used for this purpose.

[0023] In one variant, the performance of a virtual machine, specifically configured as an app or container instance, is measured. The measurement is performed once when the virtual machine is started with memory encryption and once without.

[0024] Only if the performance between the two variants (supposedly encrypted and unencrypted) differs as expected, especially by more than 1%, more than 3% or more than 5% difference, is the test successful and I can conclude that there is active memory encryption.

[0025] If different types of memory encryption can be activated, in particular different cryptographic algorithms (e.g., AES, PRESENT), key lengths, different operating modes of a cryptographic algorithm, especially integrity protection only with different MAC checksum sizes, integrity protection only without encryption (e.g., AES-CTR), authenticated encryption (e.g., AES-XTS, AES-CCM, or AES-GCM), with or without side-channel hardening, then these variants can also be configured, and it can be verified, based on observable side effects, whether the desired type of memory encryption is actually active.

[0026] In a further embodiment of the invention, the results of the following process steps are also included in determining the activity of the encryption of the memory: Sending first test data to the at least one memory area, storing second test data in the at least one memory area, wherein the second test data represents a variant of the first test data, reading the second test data from the at least one memory area and comparing the first test data and the second test data.

[0027] This has the advantage that it's possible to write initial test data to memory while memory encryption is supposedly enabled. With active memory encryption, the initial test data is encrypted into a second set of test data and stored in that form. Alternatively, if encryption is inactive, the data is stored unencrypted as the second set of test data. If, upon reading the second set of test data, it's discovered that the data was stored unencrypted, and memory encryption was not active.

[0028] The second set of test data can be read again if the configuration has been changed (memory encryption disabled, memory encryption key configuration changed). If, contrary to expectations, the second set of test data is then readable without an error message, or if it is readable in plaintext, i.e., matches the first set of test data, it can be determined that the modification of the first set of test data into the second set of test data—i.e., the cryptographic modification of the first set of test data to determine the second set of test data when accessing memory—did not occur. This means that the originally enabled memory encryption was ineffective, or that a key change for the memory encryption was ineffective.

[0029] In a further development of the invention, the comparison of the first test data and the second test data is carried out by a monitoring component of the memory.

[0030] Furthermore, it is possible that a memory module has a monitoring function. This function detects when a specific value (magic value) is written to a particular memory address. With memory encryption enabled, this expected value is repeatedly written to this address during runtime, and also at startup. If memory encryption is active and effective, the written value is encrypted, and therefore a different value—namely, the encrypted value—is actually written to that memory cell.

[0031] If the memory encryption were ineffective, the actual plaintext value, i.e., the magic value, would be written to memory. Its monitoring function can detect this and provide a corresponding alarm signal. This functionality is preferably integrated into the main memory chip as described; however, it can also be implemented as an additional component, particularly via an FPGA, ASIC, or an additional processor that monitors the memory interface between the processor and memory.

[0032] In a further embodiment of the invention, the method includes at least one of the following additional steps: Output of a warning signal, output of an error message, termination of an application, prevention of the start of an application, interruption of network communication, restriction of network communication, triggering of a system restart, deletion of data in memory, restriction of data access and / or termination of data access.

[0033] At least one of the further steps will be carried out in particular if the first test data matches the second test data or if the measured physical quantity has a certain value, in particular a value that deviates from the target value in an impermissible way.

[0034] Restricting and terminating data access and deleting data in the storage may particularly affect application data or cryptographic keys.

[0035] In a further development of the invention, the memory area has an interface through which the second test data can be read.

[0036] A special memory module can therefore be integrated into the processor's device, which, from the processor's perspective, is identical to a normal memory module. This memory module has a second interface (e.g., I2C, SPI, USB) through which the processor can query its contents. This allows the processor to check whether plaintext data has been unintentionally stored in memory, particularly in external storage.

[0037] In a further embodiment of the invention, the processor is described as: Software-programmable processor (especially Central Processing Unit (CPU), Graphics Processing Unit (GPU), or Application-Specific Instruction Set Processor (ASIP)), processor with reconfigurable digital circuitry, processor with embedded FPGA or AI inference engine that processes data in an external memory trained.

[0038] In a further embodiment of the invention, the processor is provided by a technical device, wherein the technical device is configured as: a control unit, a device in an Internet of Things environment, an IoT edge server, an encryption device and / or a hardware security module.

[0039] In a further development of the invention, the steps of the process become: at a previously defined time, manually selectable times, at the start of the processor or the virtual machine, at the start and / or at runtime of an application before sensitive data is processed, and / or at periodic intervals repeated.

[0040] This has the particular advantage that encryption can be checked even if a device has not been restarted for a long time.

[0041] The invention further comprises a device comprising a processor, wherein the device is configured to execute a method according to the invention for determining an activity of an encryption of a memory of the processor.

[0042] The invention further comprises a computer program product comprising a computer program, wherein the computer program is loadable into a storage device of a computing unit, wherein the steps of a method according to the invention are carried out with the computer program when the computer program is executed on the computing unit.

[0043] The invention further comprises a computer-readable medium on which a computer program is stored, wherein the computer program can be loaded into a storage device of a computing unit, wherein the steps of a method according to the invention are carried out with the computer program when the computer program is executed on the computing unit.

[0044] The invention offers several advantages. Among other things, it can detect when expected memory encryption is not taking place. This prevents sensitive data, especially keys, application data containing critical information, particularly design data or personal data, from being written unprotected into main memory.

[0045] Memory encryption protects not only the confidentiality of data but also its integrity, thus providing protection against manipulation. This allows for the detection of compromised confidentiality and / or integrity of data stored in main memory (RAM). BRIEF DESCRIPTION OF THE DRAWINGS

[0046] The special features and advantages of the invention will become apparent from the following explanations of several exemplary embodiments based on the schematic drawings.

[0047] They show Fig. 1 a flowchart of the method according to the invention and Fig. 2 a schematic representation of a device according to the invention for carrying out a method according to the invention. DETAILED DESCRIPTION OF THE INVENTION

[0048] Fig. 1 shows a flowchart of the inventive method for determining the activity of an encryption of a memory of a processor or a virtual machine.

[0049] In Fig. 1 The following steps are shown: Step S1: At least one access (S1) to at least one memory area of ​​the memory, Step S2: Measurement (S2) of at least one physical quantity, wherein the physical quantity depends on the at least one access, Step S3: Determining at least one setpoint or retrieving the at least one setpoint, Step S4: Comparing the at least one physical quantity with the at least one setpoint, Step S5: Determining the activity of the memory encryption by results of comparing the at least one physical quantity with the at least one setpoint.

[0050] Determining the S5 activity of the storage encryption can be supported by the following steps: Step S6: Sending first test data to the at least one memory area, Step S7: Storing second test data into the at least one memory area, where the second test data represents a variant of the first test data, Step S8: Reading the second test data from the at least one memory area, and Step S9: Comparing the first test data and the second test data.

[0051] If no abnormalities are detected in the aforementioned steps, the procedure ends for the time being.

[0052] The aforementioned steps of the procedure can then be followed as follows: at a previously defined time, manually selectable times, at the start of the processor or virtual machine and / or at periodic intervals This can be repeated. This means that step S5 can be followed again by step S1 and / or that step S9 can be followed again by step S6 (or even step S1).

[0053] If an abnormality is detected, step S10 can be initiated directly, particularly after step S5 or step S9. The response involves: Issuing a warning signal, issuing an error message, terminating an application, preventing an application from starting, interrupting network communication, restricting network communication, triggering a system restart, deleting data in memory, restricting data access and / or terminating data access. especially if the first test data matches the second test data or if the physical quantity does not match at least one target value.

[0054] Fig. 2 Figure 1 shows a schematic representation of a device according to the invention comprising a processor for executing a method according to the invention for determining an activity of an encryption of a memory of the processor.

[0055] The figure shows a device 1, in particular a control unit, IoT device, IoT edge server, encryption device, hardware security module.

[0056] The device 1 has a processor 2, in particular a CPU, as well as flash memory, several RAM memory modules (3, 5) as working memory, an input / output interface IO and a network interface (NW IF).

[0057] Processor 2 contains a CPU core, an embedded FPGA, and an AI accelerator. Memory 3, 5, especially the external RAM, is connected via a RAM Memory Encryption unit of Processor 2.

[0058] It should now be used during the startup or booting of the in Fig. 2 The device shown (1) and / or the device 1 during operation should be checked to see if memory encryption is actually taking place for memory 3, 5.

[0059] This requires a memory encryption monitoring component 4 (called "RAM Memory Encryption Check" in Fig. 2 (designated) provided. The memory encryption monitoring component 4 monitors whether encryption of memory 3, 5 actually takes place.

[0060] The storage encryption monitoring component 4 is in Fig. 2 Designed as a standalone component, it can generally be implemented in hardware, software, firmware, and may be fully or partially integrated into the processor or a system management chip (not shown) or a power management chip.

[0061] The storage encryption monitoring component 4 after Fig. 2 monitors various criteria, in particular: Performance data of processor 2, in particular regarding memory accesses and power consumption monitoring, especially through information from a power management component 7.

[0062] In addition, the memory bus 6, via which the external RAM memory modules 3, 5 are connected to the processor 2, is monitored.

[0063] A special monitoring RAM module 5, also known as a memory with an integrated monitoring component, is provided. The monitoring component of memory 5 can provide an alarm signal via a separate interface if, contrary to expectations, a specific plaintext value (magic value) is written to a monitored memory address. It is also possible (not shown) for a standalone RAM monitoring component to be provided, which queries the values ​​actually stored in a memory 3 (which does not have an integrated monitoring component) via a separate interface and provides an alarm signal if, contrary to expectations, a specific plaintext value (magic value) is read from the monitored memory address of memory 3.

[0064] In the event of a faulty or implausible memory encryption, an alarm signal is provided (NO RAM Encryption Alarm Signal). In one variant, an automatic response can also occur, specifically a device restart, erasure of memory contents in RAM 3, 5 or flash memory, termination of processes running on processor 2 (CPU), or disabling of the processor's hardware accelerator components (eFPGA, AI engine).

[0065] Although the invention has been illustrated and described in detail by the exemplary embodiments, the invention is not limited by the disclosed examples and other variations can be derived from them by a person skilled in the art without leaving the scope of protection of the invention.

Claims

1. Method for determining an activity of transparent encryption of a memory (3) of a processor (2) or a virtual machine, comprising the steps of: - accessing (S1) at least once at least one memory area of the memory (3), - measuring (S2) at least one physical variable, the physical variable being dependent on the at least one access operation, - comparing (S4) the at least one physical variable with at least one target value, and - determining (S5) the activity of the encryption of the memory (3) by means of results from comparing the at least one physical variable with the at least one target value, wherein results of the following method steps are also included in the determination of the activity of the encryption of the memory (3): - sending (S6) first test data to the at least one memory area of the memory (3), - storing (S7) second test data in the at least one memory area, the second test data representing a variant of the first test data, - reading (S8) the second test data from the at least one memory area, and - comparing (S9) the first test data and the second test data.

2. Method according to Claim 1, wherein the memory (3) is in the form of: - a program code memory, - a configuration memory, - a flash memory unit, - a main memory, - a Random Access Memory (RAM), - a Dynamic Random Access Memory (DRAM), - a Static Random Access Memory (SRAM), - a Magneto-resistive Random Access Memory (MRRAM), - a Resistive Random Access Memory (ReRAM), or - a phase-change memory (PCM).

3. Method according to one of the preceding claims, wherein the at least one physical variable comprises: - a duration of accessing (S1) the at least one memory area of the memory (3), - a latency of the at least one access operation (S1), - a power consumption during the at least one access operation, - a temperature development of the processor (2) during the at least one access operation (S1), - an adjustment of voltage levels of the processor (3), - an adjustment of a frequency of clock signals of the processor (2), and / or - electromagnetic radiation during the at least one access operation (S1).

4. Method according to one of the preceding claims, comprising the further step (S3) of: - determining the at least one target value or - retrieving the at least one target value.

5. Method according to one of the preceding claims, wherein the at least one target value: - is determined by accessing at least one second memory area of the memory (3), the second memory area being unencrypted, and / or - is determined by means of a measurement on a second virtual machine.

6. Method according to one of the preceding claims, wherein the first test data and the second test data are compared by means of a monitoring component of the memory (5).

7. Method according to one of the preceding claims, comprising the further steps (S10) of: - outputting a warning signal, - outputting an error message, - scheduling an application, - preventing the start of an application, - interrupting network communication, - restricting network communication, - triggering a system restart, - erasing data in the memory, - restricting data access, and / or - stopping data access, in particular if the first test data match the second test data.

8. Method according to one of the preceding claims, wherein the memory area has an interface via which the second test data can be read.

9. Method according to one of the preceding claims, wherein the processor (2) is in the form of: - a software-programmable processor, - a processor with a reconfigurable digital circuit, - a processor with an embedded FPGA, or - an AI inference engine.

10. Method according to one of the preceding claims, wherein the processor (2) is included in a technical device (1), wherein the technical device (1) is in the form of: - a control device, - a device in an Internet of Things environment, - an IoT edge server, - an encryption device, and / or - a hardware security module.

11. Method according to one of the preceding claims, wherein the steps of the method (S1 to S9 or S10) are repeated: - at a predetermined time, - at manually selectable times, - when the processor (2) or the virtual machine is started, - at the start and / or runtime of an application before sensitive data are processed, and / or - at periodic intervals of time.

12. Device (1) having a processor (2), wherein the device (1) is designed to carry out a method for determining an activity of encryption of a memory (3) of the processor (3) according to one of the preceding claims.

13. Computer program product comprising a computer program, wherein the computer program can be loaded into a memory device of a computing unit, wherein the computer program is used to carry out the steps of a method according to one of Claims 1 to 11 when the computer program is executed on the computing unit.

14. Computer-readable medium on which a computer program is stored, wherein the computer program can be loaded into a memory device of a computing unit, wherein the computer program is used to carry out the steps of a method according to one of Claims 1 to 11 when the computer program is executed on the computing unit.