Information processing device, method for controlling information processing device, and control program

Abstract

To provide an information processing device capable of improving confidentiality, a method for controlling the information processing device, and a control program.SOLUTION: An information processing device comprises an authenticated memory encryption engine which performs encryption processing and authentication processing using an authentication tree for data transferred between a data cache and a memory, and also performs authentication processing for each tag of the nodes located on the path from the leaf node to which the data is assigned and a root node. When it deletes any node in the authentication tree, the authenticated memory encryption engine updates the counter value assigned to the parent node of the node to be deleted on the basis of the counter value assigned to the node to be deleted. In addition, when it adds a new node to the same position in the authentication tree as the deleted node, the authenticated memory encryption engine sets the counter value assigned to the added node on the basis of the counter value assigned to the parent node of the added node.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present disclosure relates to an information processing device, a control method for an information processing device, and a control program. [Background technology]

[0002] In an information processing device mounted on a computer or the like, a hierarchical structure of storage areas is implemented, such as a register, a cache, a memory, and a storage. Here, when data is transferred between the cache and the memory, data authentication and data encryption processing (encryption and / or decryption) are implemented. This makes it possible to prevent leakage of data stored in the information processing device due to a physical attack on the information processing device from the outside. Hereinafter, the data authentication and data encryption processing implemented when data is transferred between the cache and the memory is also referred to as authentication-encryption processing.

[0003] Furthermore, in recent years, development of data authentication using an authentication tree consisting of multiple nodes linked in a tree shape, each of which is assigned a pair of a counter and an identifier, has been underway. In data authentication using an authentication tree, not only data but also authenticators (tags) are authenticated, further reducing the risk of data leakage. Technology related to data authentication using an authentication tree is disclosed in, for example, Patent Document 1. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Application Publication No. 09-022381 Summary of the Invention [Problem to be solved by the invention]

[0005] In data authentication using the authentication tree disclosed in Patent Document 1, after any of the nodes constituting the authentication tree that is no longer necessary is deleted, the deleted node may be added back to the same position in the authentication tree without authentication processing. In other words, Patent Document 1 has a problem in that confidentiality cannot be improved because data may be tampered with.

[0006] An object of the present disclosure is to provide an information processing device, a control method for an information processing device, and a control program that solve the above-mentioned problems. [Means for solving the problem]

[0007] an authentication tree cache in which a portion of the counters and the identifiers included in an authentication tree consisting of a plurality of nodes linked in a tree shape, each of which is assigned a pair of a counter and an identifier, and a tag generated using the counters and the identifiers included in the authentication tree, are temporarily stored; a data cache in which a portion of data assigned to each of a plurality of leaf nodes that are nodes in a lowest layer among the plurality of nodes constituting the authentication tree, is temporarily stored; and an authenticated memory cryptographic engine that performs cryptographic processing and authentication processing using the authentication tree on data transferred between the data cache and the memory, and performs authentication processing on tags generated in each of one or more nodes present on a path from the leaf node to which the data is assigned to a root node, wherein when deleting any of a plurality of nodes constituting the authentication tree, the authenticated memory cryptographic engine updates a counter value assigned to a parent node of the node to be deleted based on a counter value assigned to the node to be deleted, and when adding a new node to the authentication tree at the same position as the deleted node, sets a counter value assigned to an added node based on a counter value assigned to a parent node of the added node.

[0008] A control method for an information processing device according to one aspect of the present disclosure is a control method for an information processing device including: a memory; an authentication tree cache in which a portion of the counters and identifiers included in an authentication tree consisting of a plurality of nodes linked in a tree shape, each of which is assigned a pair of a counter and an identifier, and a tag generated using the counters and the identifiers included in the authentication tree, a data cache in which a portion of data assigned to each of a plurality of leaf nodes that are nodes in the lowest layer among the plurality of nodes constituting the authentication tree, is temporarily stored; and an authenticated memory encryption engine that performs encryption processing and authentication processing using the authentication tree on data transferred between the data cache and the memory, and performs authentication processing on tags generated in each of one or more nodes present on a path from the leaf node to which the data is assigned to a root node, wherein, when any of a plurality of nodes constituting the authentication tree is deleted, a counter value assigned to a parent node of the node to be deleted is updated based on a counter value assigned to the node to be deleted, and when a new node is added to the authentication tree at the same position as the deleted node, a counter value assigned to an added node is set based on a counter value assigned to a parent node of the added node.

[0009] A control program according to one aspect of the present disclosure includes a memory, an authentication tree cache in which a counter and an identifier included in an authentication tree formed of a plurality of nodes linked in a tree shape, each of which is assigned a pair of a counter and an identifier, and a part of a tag generated using the counter and the identifier included in the authentication tree, and a data cache in which a part of data assigned to each of a plurality of leaf nodes which are nodes in the lowest layer among the plurality of nodes constituting the authentication tree is temporarily stored, and an encryption process and an authentication process using the authentication tree are performed on data transferred between the data cache and the memory, and the data is routed from the leaf node to which the data is assigned. and an authenticated memory cryptographic engine that performs authentication processing on tags generated at one or more nodes on a path leading to a root node, the control program causing a computer to execute control processing in an information processing device having the authenticated memory cryptographic engine, which performs authentication processing on tags generated at each of one or more nodes on a path leading to a root node, the control program causing the computer to execute the following processing: when deleting any of a plurality of nodes constituting the authentication tree, updating a counter value assigned to a parent node of the node to be deleted based on the counter value assigned to the node to be deleted; and when adding a new node to the authentication tree at the same position as the deleted node, setting a counter value assigned to an added node based on the counter value assigned to the parent node of the added node. Effect of the Invention

[0010] The present disclosure can provide an information processing device, a control method for an information processing device, and a control program capable of improving confidentiality. [Brief description of the drawings]

[0011] [Figure 1] 1 is a block diagram showing a configuration example of an information processing device according to the present disclosure. [Diagram 2] FIG. 1 is a conceptual diagram of an authentication tree. [Diagram 3]1 is a diagram showing the relationship between each node constituting an authentication tree and its corresponding cache line. FIG. [Figure 4] FIG. 11 is a diagram for explaining a first example of the flow of deleting and adding a node in an authentication tree. [Diagram 5] FIG. 11 is a diagram for explaining a second example of the flow of deleting and adding a node in an authentication tree. [Figure 6] FIG. 11 is a diagram illustrating a third example of the flow of deleting and adding a node in an authentication tree. [Figure 7] FIG. 11 is a diagram illustrating a fourth example of the flow of deleting and adding a node in an authentication tree. [Figure 8] 13 is a flowchart showing the flow of a process for adding a node to an authentication tree. [Figure 9] 13 is a flowchart showing the flow of a process for deleting a node from an authentication tree. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] <Embodiment 1> Fig. 1 is a block diagram showing an example configuration of an information processing device 1 according to the present disclosure. As shown in Fig. 1, the information processing device 1 includes a cache 100, a memory 103, and an authenticated memory encryption engine (AMEE) 104. The cache 100 includes a data cache 101 and an authentication tree cache 102. Hereinafter, the authenticated memory encryption engine 104 will be referred to as the AMEE 104.

[0013] The AMEE 104 performs cryptographic processing (encryption and / or decryption) on data exchanged between the cache 100 and the memory 103, and performs authentication processing using an authentication tree consisting of multiple nodes linked in a tree shape, each of which is assigned a pair of a counter and an identifier. Here, in the authentication processing using the authentication tree, not only is verification performed on data assigned to a leaf node, which is the node in the lowest layer among the multiple nodes constituting the authentication tree, but also verification is performed on the authenticators (tags) assigned to each of all nodes existing on the path from the leaf node to the root node. This reduces the risk of data leakage. The tag assigned to each node is generated using the counter and identifier assigned to the node.

[0014] The data cache 101 temporarily stores data to be written from outside to the memory 103 and data to be read from the memory 103 to outside. The authentication tree cache 102 temporarily stores counters and identifiers assigned to each node of the authentication tree and a part of tags generated using them.

[0015] Fig. 2 is a conceptual diagram of an authentication tree. The address space covered by this authentication tree is the target of authentication processing. In other words, the address space assigned to each of the leaf nodes, which are the nodes in the lowest layer among the multiple nodes constituting this authentication tree, is the target of authentication processing.

[0016] FIG. 3 is a diagram showing the relationship between each node constituting an authentication tree and the corresponding cache line.

[0017] Data blocks are assigned to each node. The unit of data blocks assigned to each node is called a cache line. Each cache line is provided with at least a bit indicating either dirty or clean. Clean indicates that the cache line stored in cache 100 is the same as the corresponding cache line stored in memory 103. Dirty indicates that the cache line stored in cache 100 has been updated and is different from the corresponding cache line stored in memory 103.

[0018] Each node is also assigned a counter and an identifier. The identifier of each leaf node (node ​​at the bottom layer) is the address of the corresponding cache line. The identifier of each intermediate node is derivable from its position in the authentication tree. For example, the identifier assigned to the parent node of a leaf node identified by an address is derivable from the address of the leaf node.

[0019] Furthermore, each leaf node is assigned data corresponding to an address (identifier), which, when written to data cache 101, corresponds to a cache line written to data cache 101. The cache line written to data cache 101 contains only data.

[0020] In any leaf node 301, encrypted data (hereinafter also simply referred to as ciphertext) 303 is generated using plaintext data 302 of the corresponding cache line and a key 330, and a tag (authenticator, MAC) 306 is generated using the ciphertext 303, an address 304 of the leaf node 301, a value of a counter 305 of the leaf node 301, and the key 330. The tag 306 generated in the leaf node 301 is stored in a cache line 307 separate from the cache line of the plaintext data 302, together with tags generated in other nodes (sibling nodes) that have a common parent node with the leaf node 301.

[0021] When a cache line allocated to a leaf node 301 is written out from the data cache 101 to the memory 103, ciphertext 303 generated by encrypting plaintext data 302 is written out to the memory 103 instead of the plaintext data 302.

[0022] On the other hand, when a cache line assigned to a leaf node 301 is read from the memory 103 to the data cache 101, a tag is first generated by the address 304 of the leaf node 301, the value of the counter 305 of the leaf node 301, the ciphertext 303 read from the memory 103, and the key 330. Then, only when the generated tag matches the tag 306 stored in the cache line 307, the ciphertext 303 read from the memory 103 is decrypted to the plaintext data 302 by the key 330 and then read into the data cache 101 as the cache line of the leaf node 301. At this time, the value of the counter 305 of the leaf node 301 needs to be included in the cache line of its parent node (intermediate node 311) and to exist in the authentication tree cache 102.

[0023] In any intermediate node 311, a tag 315 is generated by the values ​​of the counters 314 of all child nodes of the intermediate node 311, the value of the counter 313 of the intermediate node 311, the identifier 312 of the intermediate node 311, and the key 330. A cache line allocated to the intermediate node 311 is composed of the values ​​of the counters 314 of all child nodes of the intermediate node 311 and the tag 315 generated in the intermediate node 311.

[0024] When a cache line allocated to an intermediate node 311 is written from the authentication tree cache 102 to the memory 103, the tag included in the cache line must be generated using the counter values ​​of all child nodes included in the cache line. In other words, after the tag included in the cache line is generated, the counter values ​​of any child nodes included in the cache line must not be updated.

[0025] On the other hand, when a cache line allocated to the intermediate node 311 is read from the memory 103 into the authentication tree cache 102, a tag is first generated from the values ​​of the counters 314 of all child nodes of the intermediate node 311 included in the cache line read from the memory 103, the value of the counter 313 of the intermediate node 311, the identifier 312 of the intermediate node 311, and the key 330. Then, only when the generated tag matches the tag included in the cache line allocated to the intermediate node 311, the cache line read from the memory 103 is read into the authentication tree cache 102. At this time, the value of the counter 313 of the intermediate node 311 needs to be included in the cache line of its parent node and to exist in the authentication tree cache 102.

[0026] In the root node (the node in the top layer) 321, a tag 325 is generated based on the values ​​of the counters 324 of all the child nodes of the root node 321, the value of the counter (root counter) 323 of the root node 321, the identifier 322 of the root node 321, and the key 330. The cache line allocated to the root node 321 is composed of the values ​​of the counters 324 of all the child nodes of the root node 321 and the tag 325 generated in the root node 321.

[0027] The value of the counter assigned to a given node is updated in the following cases: When a cache line assigned to a given node is written out from cache 100 to memory 103, if the cache line has been updated since it was read from memory 103 into cache 100, the value of the counter assigned to the node is updated, and then the tag included in the cache line assigned to the node is updated. The updated cache line is then written out from cache 100 to memory 103.

[0028] When data (cache line) assigned to any leaf node is updated, the counter values ​​of all nodes on the path from the leaf node to the root node are basically counted up. Here, the counter assigned to the root node is specially protected so that it cannot be directly manipulated by an attacker. Then, the tag of the corresponding node is updated by the counter of the root node, the counter of each intermediate node, or the counter and data of each leaf node. This allows the tag of each node to track the latest status.

[0029] The counter assigned to each node of the authentication tree may be composed of a major counter whose value is represented by the upper bits of the multiple bits representing the value of the counter, and a minor counter whose value is represented by the lower bits. In this case, the major counter assigned to a node is shared by other nodes (i.e., sibling nodes) having a common parent node. This suppresses the increase in scale due to the counter. In addition, the cache line of a certain intermediate node stores, as counter values, the values ​​of multiple minor counters assigned to all child nodes of the intermediate node, and the value of one major counter shared by all child nodes of the intermediate node. Hereinafter, a counter composed of a major counter and a minor counter is also called a split counter.

[0030] If the counter assigned to each node is a split counter, the minor counter value is updated, or the minor counter value is initialized and then the major counter value is updated. If the major counter is updated, the minor counter values ​​assigned to all nodes sharing the major counter are initialized.

[0031] Here, it is preferable to optimize the size of the authentication tree by deleting unnecessary nodes from among the multiple nodes constituting the authentication tree and adding necessary nodes. This, for example, deletes tags (authenticators) related to unused address spaces, thereby reducing the pressure on the memory storage area caused by the authentication tree. In particular, when memory addresses are virtual, the address space to be authenticated may be significantly larger than the actual memory size, so optimizing the size of the authentication tree is effective.

[0032] Therefore, when AMEE104 deletes any of the multiple nodes constituting the authentication tree, it updates the counter value assigned to the parent node of the node to be deleted based on the counter value assigned to the node to be deleted. When AMEE104 adds a new node to the multiple nodes constituting the authentication tree at the same position as the deleted node, it sets the counter value assigned to the added node based on the counter value assigned to the parent node of the added node.

[0033] Specifically, when AMEE104 deletes any of the multiple nodes constituting the authentication tree, it updates the counter value assigned to the parent node of the node to be deleted to a value greater than the greater of the counter value assigned to the parent node of the node to be deleted and the counter value assigned to the node to be deleted. When AMEE104 adds a new node to the authentication tree at the same position as the deleted node, it sets the counter value assigned to the added node to be equal to or greater than the counter value assigned to the parent node of the added node.

[0034] FIG. 4 is a diagram for explaining a first example of the flow of deleting and adding a node of an authentication tree. For example, if the counter value assigned to the node to be deleted indicates "10" and the counter value assigned to the parent node of the node to be deleted indicates "11", AMEE104 updates the counter value "11" assigned to the parent node of the node to be deleted to, for example, "12" or more. After that, when AMEE104 adds a new node to the authentication tree at the same position as the deleted node, it sets the counter value assigned to the node to be added to the counter value of the parent node or more, i.e., "12" or more. As a result, the counter value of the node to be deleted indicates "10" and the counter value of the added node indicates "12" or more. In other words, the counter of the node to be deleted and the counter of the added node indicate different values.

[0035] FIG. 5 is a diagram for explaining a second example of the flow of deleting and adding a node of an authentication tree. For example, if the counter value assigned to the node to be deleted indicates "10" and the counter value assigned to the parent node of the node to be deleted indicates "10", AMEE104 updates the counter value "10" assigned to the parent node of the node to be deleted to, for example, "11" or more. After that, when AMEE104 adds a new node to the authentication tree at the same position as the deleted node, it sets the counter value assigned to the node to be added to the counter value of the parent node or more, i.e., "11" or more. As a result, the counter value of the node to be deleted indicates "10" and the counter value of the added node indicates "11" or more. In other words, the counter of the node to be deleted and the counter of the added node indicate different values.

[0036] FIG. 6 is a diagram for explaining a third example of the flow of deleting and adding a node of an authentication tree. For example, if the counter value assigned to the node to be deleted indicates "11" and the counter value assigned to the parent node of the node to be deleted indicates "10", AMEE104 updates the counter value "10" assigned to the parent node of the node to be deleted to, for example, "12" or more. After that, when AMEE104 adds a new node to the authentication tree at the same position as the deleted node, it sets the counter value assigned to the node to be added to the counter value of the parent node or more, i.e., "12" or more. As a result, the counter value of the node to be deleted indicates "11" and the counter value of the added node indicates "12" or more. In other words, the counter of the node to be deleted and the counter of the added node indicate different values.

[0037] As a result, the counter value of the node to be added is always greater than the counter value of the node to be deleted (in other words, the counter of the node to be deleted and the counter of the node to be added show different values), so new authentication is required to add a node. In other words, in the information processing device 1, a node that was previously deleted is not added again to the authentication tree without being authenticated. As a result, the information processing device 1 can improve confidentiality.

[0038] The method of updating and setting the counter by the AMEE 104 is not limited to the above-mentioned method. For example, when the AMEE 104 deletes any one of the multiple nodes constituting the authentication tree, the AMEE 104 may update the counter value assigned to the parent node of the node to be deleted to the larger of the counter value assigned to the parent node of the node to be deleted and the counter value assigned to the node to be deleted. After that, when the AMEE 104 adds a new node to the authentication tree at the same position as the deleted node, the AMEE 104 sets the counter value assigned to the added node to a value larger than the counter value assigned to the parent node of the added node.

[0039] 7 is a diagram for explaining a fourth example of the flow of deleting and adding a node in an authentication tree. For example, if the counter value assigned to the node to be deleted indicates "10" and the counter value assigned to the parent node of the node to be deleted indicates "11", AMEE104 updates the counter value "11" assigned to the parent node of the node to be deleted to, for example, "11" or more. After that, when AMEE104 adds a new node to the authentication tree at the same position as the deleted node, it sets the counter value assigned to the node to be added to a value larger than the counter value of the parent node, i.e., "12" or more. As a result, the counter value of the node to be deleted indicates "10" and the counter value of the added node indicates "12" or more.

[0040] Here, when the counter assigned to each node of the authentication tree is a split counter, AMEE104 performs the following process. For example, when AMEE104 deletes any of the multiple nodes constituting the authentication tree, it updates the value of the major counter assigned to the parent node of the node to be deleted to a value larger than the larger of the value of the major counter assigned to the parent node of the node to be deleted and the value of the major counter assigned to the node to be deleted. When AMEE104 adds a new node to the authentication tree at the same position as the deleted node, it sets the value of the major counter assigned to the added node to be equal to or larger than the value of the major counter assigned to the parent node of the added node. Note that when the value of the major counter shared by multiple nodes having a common parent node is updated, it is preferable that the value of each minor counter of multiple nodes having a common parent node is initialized.

[0041] In this way, in the information processing device 1, when the AMEE 104 deletes any one of the multiple nodes constituting the authentication tree, the AMEE 104 updates the counter value assigned to the parent node of the node to be deleted based on the counter value assigned to the node to be deleted. Then, when the AMEE 104 adds a new node to the multiple nodes constituting the authentication tree at the same position as the deleted node, the AMEE 104 sets the counter value assigned to the added node based on the counter value assigned to the parent node of the added node. As a result, the counter value of the node to be deleted and the counter value of the added node become different, so that a new authentication is required to add a node. That is, in the information processing device 1, a node that was deleted in the past is not added to the authentication tree again without authentication. As a result, the information processing device 1 can improve confidentiality.

[0042] For example, in a cloud service, a virtual machine is provided to a customer. The virtual machine is provided with a virtual memory. This virtual memory is assigned an address space that exceeds the real memory. When the information processing device 1 according to the present disclosure is applied to such a service, it is possible to optimize the size of the authentication tree, reduce the usage area of ​​the memory storage area, and improve confidentiality.

[0043] Furthermore, high confidentiality is required for the management of computers that handle financial information, computer security information, military information, health information, insurance information, safety information, etc. When the information processing device 1 according to the present disclosure is applied to the management of such computers, it is possible to optimize the size of the authentication tree, reduce the usage of memory storage area, and improve confidentiality.

[0044] Furthermore, the information processing device 1 according to the present disclosure can be applied to a chipset including a CPU by including instructions for deleting and adding nodes in an instruction set.

[0045] <Embodiment 2> The flow of processing by the information processing device 1 will be described in more detail below.

[0046] In the following description, in a parallelizable authentication tree (PAT), ρ is a node, ccl(ρ) is a cache line assigned to node ρ, par(ρ) is a parent node of node ρ, and Cρ is a set of registered child nodes of node ρ. Node ρ is either an internal node or a leaf node. If node ρ is an internal node, node ρ is assigned a cache line including the counter values ​​of all child nodes of node ρ and tags generated at node ρ. If node ρ is a leaf node, node ρ is assigned a cache line including memory data. If node ρ is a leaf node, node ρ is further assigned a cache line including the tag of node ρ and the tags of other nodes that have a common parent node with node ρ.

[0047] Any internal node ρ is assigned a counter ctr(ρ). The counter and identifier are used as nonce in the cryptographic function that generates the tag (authenticator), and therefore need to be updated with every update of the authentication tree (including updates that return to the same memory state) to counter replay attacks.

[0048] In this disclosure, a case where the counter ctr(ρ) is a split counter consisting of a major counter ctr_maj(ρ) and a minor counter ctr_min(ρ) will be described as an example. The major counter ctr_maj(ρ) is shared with sibling nodes of the node ρ, whereas the minor counter ctr_min(ρ) is uniquely assigned to the node ρ. The cache line of the internal node ρ stores the major counter ctr_maj(τ) shared by all child nodes τ of the node ρ (where τ∈Cρ), the minor counters ctr_min(τ) assigned to each of all child nodes τ of the node ρ, and the tag tag(ρ) generated in the node ρ.

[0049] The minor counter cycles more frequently than the major counter. Therefore, some bits in the minor counter define some special meanings. Specifically, some bits in the minor counter define the non-registration (non-existence) of a node, the minimum value of the minor counter, and the maximum value of the minor counter. In the following, the non-registration of a node is represented as "end", the minimum value of the minor counter is represented as "bot", and the maximum value of the minor counter is represented as "top".

[0050] If node ρ is not registered, the minor counter ctr_min(ρ) of node ρ indicates “end”. Thereafter, when the counter ctr(ρ) of node ρ is assigned to the authentication tree cache 102, that is, when node ρ is added, the minor counter ctr_min(ρ) of node ρ is set to “bot”. Thereafter, every time the cache line ccl(ρ) is updated, the minor counter ctr_min(ρ) is incremented by 1, and before reaching “top”, the minor counter ctr_min(ρ) returns to “bot” by executing a carry-over process of the counter, CaryyUp(ρ). At this time, the value of the major counter ctr_maj(ρ) is incremented by 1.

[0051] If node ρ has no descendants, it can be deleted (prune). The minor counter ctr_min(ρ) is set to “end” when the process Prune(ρ), which is the deletion process of node ρ, is executed. The size of the authentication tree changes dynamically due to the addition and deletion of nodes. The root counter never leaves the authentication tree cache 102.

[0052] If node ρ is an internal node, cache line ccl(ρ) contains tag tag(ρ) generated at node ρ, but as long as the parent node par(ρ) of node ρ is cached, all operations do not require ancestor nodes above the parent node par(ρ).

[0053] <Hardware setup> The information processing apparatus 1 includes, as hardware, a cache 100, a memory 103, and an AMEE 104. The cache 100 is composed of a data cache 101 and an authentication tree cache 102. Only the cache line of data among data, counter, and tag is cached in the data cache 101. Therefore, the processor can access only the data cache 101 among the data cache 101 and the authentication tree cache 102. In contrast, the AMEE 104 can access any of the data cache 101, the authentication tree cache 102, and the memory 103.

[0054] <Definition of processing by AMEE104> First, the generation process Tag of the tag tag(ρ) assigned to the internal node ρ by the AMEE 104 will be described. Let sk be the secret key (key 330), ρ be the identifier of the internal node ρ, ccl’(ρ) be the part other than the tag in the cache line ccl(ρ) of the internal node ρ, ctr(ρ) be the value of the counter of the internal node ρ, and tag(ρ) be the tag generated at the internal node ρ. Then, the generation process Tag of the tag tag(ρ) assigned to the internal node ρ by the AMEE 104 is expressed as follows.

[0055] Tag(sk,ρ,ccl’(ρ),ctr(ρ))→tag(ρ)

[0056] This represents that the tag tag(ρ) assigned to the internal node ρ is generated by the secret key sk, the identifier ρ of the internal node, the cache line ccl’(ρ), and the counter ctr(ρ).

[0057] Next, a description will be given of the AuthEnc process of generating the tag tag(ρ) and the cache line cpt(ρ) of the ciphertext assigned to the leaf node ρ by the AMEE 104. If sk is a secret key, ρ is an identifier (address) of the leaf node ρ, ccl(ρ) is a cache line of plaintext data, ctr(ρ) is a counter value of the leaf node ρ, tag(ρ) is a tag generated in the leaf node ρ, and cpt(ρ) is a cache line of the ciphertext, the AuthEnc process of generating the tag tag(ρ) and the cache line cpt(ρ) of the ciphertext assigned to the leaf node ρ by the AMEE 104 is expressed as follows:

[0058] AuthEnc(sk,ρ,ccl(ρ),ctr(ρ)) →{tag(ρ),cpt(ρ)}

[0059] This means that the tag tag(ρ) assigned to the leaf node ρ and the ciphertext cache line cpt(ρ) are generated using the secret key sk, the identifier of the leaf node ρ, the cache line of plaintext data ccl(ρ), and the counter ctr(ρ).

[0060] Next, we will explain the authentication process VeriDec of the cache line cpt(ρ) of the ciphertext assigned to the leaf node ρ by the AMEE 104. If sk is a secret key, ρ is an identifier (address) of the leaf node ρ, cpt(ρ) is a cache line of the ciphertext, ctr(ρ) is a counter value of the leaf node ρ, tag(ρ) is a tag assigned to the leaf node ρ, and ccl(ρ) is a cache line of the plaintext data, the authentication process VeriDec of the cache line cpt(ρ) of the ciphertext assigned to the leaf node ρ by the AMEE 104 is expressed as follows.

[0061] VeriDec(sk,ρ,cpt(ρ),ctr(ρ),tag(ρ)) →ccl(ρ) / “bot”

[0062] This represents that the verification of the ciphertext cache line cpt(ρ) is performed using the private key sk, the identifier of the leaf node ρ, the counter ctr(ρ), and the tag tag(ρ). If the authentication is successful, the plaintext data cache line ccl(ρ) is generated, and if the authentication fails, the counter ctr(ρ) is set to "bot".

[0063] <Initialization of the authentication tree> First, the initialization of the authentication tree will be described. First, AMEE104 sets the private key sk. Then, AMEE104 sets the major counter ctr_maj(root) of the root node to "0" and the minor counter ctr_min(root) of the root node to "end".

[0064] <Add(ρ) process; process of adding node ρ to the authentication tree> Subsequently, the Add(ρ) process by AMEE104 will be described. The Add(ρ) process is the process of adding node ρ to the authentication tree. This process can be executed when the cache line ccl(par(ρ)) of the parent node par(ρ) of node ρ exists in the authentication tree cache 102 and the minor counter ctr_min(ρ) of node ρ is set to "end" (YES in step S101), and is not executed in other cases (NO in step S101) (step S106).

[0065] When the process of adding node ρ to the authentication tree is executed (YES in step S101), first, AMEE104 updates the minor counter ctr_min(ρ) of node ρ from "end" to "bot", and then stores the cache line ccl(ρ) of node ρ in the authentication tree cache 102 (step S102).

[0066] For example, when node ρ is an internal node (YES in step S103), AMEE104 sets the major counter of the child nodes stored in the cache line ccl(ρ) of node ρ to the same value as counter ctr_maj(ρ), and sets the minor counters of all child nodes stored in the cache line ccl(ρ) of node ρ to "end" (step S104).

[0067] On the other hand, when node ρ is a leaf node (NO in step S103), AMEE104 sets the cache line ccl(ρ) of node ρ to "0" and sets the cache line ccl(ρ) to the dirty state (step S105). Further, if node τ is a sibling node of leaf node ρ and the minor counters ctr_min(τ) of all sibling nodes τ are set to "end", AMEE104 stores the cache line including the tag tag(ρ) of node ρ in the authentication tree cache 102 (step S105).

[0068] <Prune(ρ) process; deletion process of node ρ in the authentication tree> Subsequently, the Prune(ρ) process by AMEE104 will be described. The Prune(ρ) process is the deletion process of node ρ in the authentication tree. This process can be executed when the cache line ccl(ρ) of node ρ and the cache line ccl(par(ρ)) of the parent node par(ρ) of node ρ exist in the authentication tree cache 102 (YES in step S201), and is not executed in other cases (NO in step S201) (step S210).

[0069] When node ρ is an internal node (YES in step S201 → YES in step S202), it is determined whether the minor counters of all child nodes stored in the cache line ccl(ρ) of node ρ are set to "end" (step S203).

[0070] For example, if any of the minor counters of multiple child nodes stored in the cache line ccl(ρ) of node ρ is not set to “end” (NO in step S203), the deletion process of node ρ is not executed (step S210).

[0071] On the other hand, if the minor counters of all child nodes stored in the cache line ccl(ρ) of node ρ are set to “end” (YES in step S203), AMEE104 updates the value of the major counter ctr_maj(ρ) of node ρ to the larger of ctr_maj(ρ) and the major counters of the child nodes stored in the cache line ccl(ρ) of node ρ (step S204).

[0072] Then, the AMEE 104 sets the minor counter ctr_min(ρ) of the node ρ to “end” (step S205). Then, the AMEE 104 executes the process CarryUp(par(ρ)) which is a carry process of the counter described later (step S206). Specifically, the AMEE 104 increments the value of the major counter ctr_maj(ρ) of the node ρ by one, and sets the minor counters ctr_min(τ) of all the sibling nodes of the node ρ whose minor counters are not set to “end” to “bot” (step S206). Then, the AMEE 104 executes the process Invalidata(ρ) which is an invalidation process of the node ρ described later (step S207). Specifically, the AMEE 104 deletes the cache line ccl(ρ) of the node ρ from the authentication tree cache 102 (step S207). Then, the process ends (YES in step S208).

[0073] When node ρ is a leaf node (YES in step S201 → NO in step S202), AMEE104 sets the minor counter ctr_min(ρ) of node ρ to "end" (step S205). Then, AMEE104 executes the process of CarryUp(par(ρ)) (step S206). Specifically, AMEE104 increments the value of the major counter ctr_maj(ρ) of node ρ by one, and sets the minor counter ctr_min(τ) of all nodes τ among the sibling nodes of node ρ whose minor counter is not set to "end" to "bot" (step S206). Then, AMEE104 executes the process of Invalidata(ρ) (step S207). Specifically, AMEE104 deletes the cache line ccl(ρ) of node ρ from the data cache 101 (step S207).

[0074] Also, when node ρ is a leaf node (NO in step S208), if the minor counters ctr_min(τ) of all sibling nodes τ are set to "end", AMEE104 deletes the cache line ccl(tag(ρ)) including the tag tag(ρ) of node ρ from the authentication tree cache 102 (step S209). Then, the process ends (YES in step S208).

[0075] <Read(ρ) process; Cache line reading process from memory to cache> Next, the Read(ρ) process by AMEE104 will be described. The Read(ρ) process is the process of reading the cache line of node ρ from the memory 103 to the cache 100. This process can be executed when the cache line ccl(ρ) of node ρ does not exist in either the data cache 101 or the authentication tree cache 102, and the cache line ccl(par(ρ)) of the parent node par(ρ) of node ρ exists in the authentication tree cache 102.

[0076] When node ρ is an internal node, first, AMEE104 reads the cache line ccl(ρ) of node ρ from the memory 103 and performs an authentication process on the cache line ccl(ρ). Specifically, AMEE104 verifies whether tag(ρ)=Tag(sk,ρ,ccl’(ρ),ctr(ρ)) holds.

[0077] If tag(ρ)=Tag(sk,ρ,ccl’(ρ),ctr(ρ)) holds, AMEE104 stores the cache line ccl(ρ) read from the memory 103 in the authentication tree cache 102. On the contrary, if tag(ρ)=Tag(sk,ρ,ccl’(ρ),ctr(ρ)) does not hold, AMEE104 returns information indicating authentication failure to the cache 100.

[0078] When node ρ is a leaf node, first, AMEE104 reads the ciphertext cache line cpt(ρ) of node ρ from the memory 103 and reads the tag tag(ρ) assigned to node ρ from the memory 103 or the authentication tree cache 102. Then, AMEE104 performs a decryption process and an authentication process on the ciphertext cache line cpt(ρ) by the process of VeriDec(sk,ρ,cpt(ρ),ctr(ρ),tag(ρ)).

[0079] If the authentication is successful, AMEE104 generates a cache line ccl(ρ) of the plaintext data and stores it in the data cache 101. If the authentication fails, after setting the counter ctr(ρ) to “bot”, AMEE104 returns information indicating authentication failure to the cache 100.

[0080] <WriteBack(ρ) process; cache line write-back process from cache to memory> Next, the WriteBack(ρ) process by the AMEE 104 will be described. The WriteBack(ρ) process is a process of writing back a cache line from the cache 100 to the memory 103. If the node ρ is an internal node, this process can be executed when the cache line ccl(ρ) of the internal node ρ indicating a dirty state exists in the authentication tree cache 102. If the node ρ is a leaf node, this process can be executed when the cache line ccl(ρ) of the leaf node ρ indicating a dirty state exists in the data cache 101, and the cache line ccl(tag(ρ)) in which the tag tag(ρ) of the leaf node ρ is stored exists in the authentication tree cache 102. However, it is necessary that the minor counter ctr_min(ρ) of the node ρ is not set to "top".

[0081] First, the AMEE 104 increments the value of the minor counter ctr_min(ρ) of the node ρ by 1. Then, the AMEE 104 sets the cache line ccl(par(ρ)) of the node par(ρ) stored in the authentication tree cache 102 to the dirty state.

[0082] If node ρ is an internal node, AMEE 104 generates a tag tag(ρ) for node ρ by processing Tag(sk, ρ, ccl'(ρ), ctr(ρ)). Then, AMEE 104 replaces the tag included in cache line ccl(ρ) of node ρ with a new tag, and writes the updated cache line ccl(ρ) back to memory 103. Then, AMEE 104 sets the cache line ccl(ρ) of node ρ stored in the authentication tree cache 102 to a clean state.

[0083] When node ρ is a leaf node, if the cache line ccl(tag(ρ)) storing the tag tag(ρ) of node ρ does not exist in the authentication tree cache 102, AMEE104 reads it from the memory 103. Then, AMEE104 performs an encryption process on the cache line ccl(ρ) of the plaintext data through the process of AuthEnc(sk,ρ,ccl(ρ),ctr(ρ)). Specifically, AMEE104 encrypts the cache line ccl(ρ) of the plaintext data to generate a ciphertext cache line cpt(ρ) and a tag tag(ρ). Then, AMEE104 writes back the generated ciphertext cache line cpt(ρ) to the memory 103. After that, AMEE104 sets the cache line ccl(ρ) of the plaintext data of node ρ stored in the data cache 101 to the clean state. Then, AMEE104 replaces the tag of the cache line ccl(tag(ρ)) in the authentication tree cache 102 with a new tag.

[0084] <Invalidate(ρ) process; Invalidation process of node ρ> Subsequently, the Invalidate(ρ) process by AMEE104 will be described. The Invalidate(ρ) process is the invalidation process of node ρ. This process can be executed when the cache line ccl(ρ) of node ρ indicating the clean state exists in the data cache 101 or the authentication tree cache 102. In this case, AMEE104 invalidates it by deleting the cache line ccl(ρ) stored in the data cache 101 or the authentication tree cache 102.

[0085] <CarryUp(ρ) process; Carry - up process of the counter included in ccl(ρ)> Subsequently, the CarryUp(ρ) process by AMEE104 will be described. The CarryUp(ρ) process is the carry - up process of the counter included in the cache line ccl(ρ) of node ρ. This process can be executed when the cache line ccl(ρ) of node ρ exists in the authentication tree cache 102.

[0086] First, let us assume that a child node ω is a child node among all child nodes of node ρ whose minor counter is not set to “end”. If the child node ω is a leaf node or if the child node ω does not exist in the authentication tree cache 102, the AMEE 104 executes a Read(ω) process on the child node ω.

[0087] Then, the AMEE 104 increments the value of the major counter (the major counter assigned to the node ω) stored in the cache line ccl(ρ) of the node ρ by 1. Then, the AMEE 104 sets the minor counter ctr_min(ω) assigned to the node ω to “bot”.

[0088] Thereafter, if the node ω is a leaf node, the AMEE 104 executes a WriteBack(ω) process on the node ω, and otherwise sets the cache line ccl(ω) to a dirty state.

[0089] As described above, in the information processing device 1 according to the present disclosure, when the AMEE 104 deletes any one of the multiple nodes constituting the authentication tree, the AMEE 104 updates the counter value assigned to the parent node of the node to be deleted based on the counter value assigned to the node to be deleted. Then, when the AMEE 104 adds a new node to the multiple nodes constituting the authentication tree at the same position as the deleted node, the AMEE 104 sets the counter value assigned to the added node based on the counter value assigned to the parent node of the added node. As a result, the counter value of the node to be deleted and the counter value of the added node become different, so that a new authentication is required to add the node. That is, in the information processing device 1, a node deleted in the past is not added to the authentication tree again without authentication. As a result, the information processing device 1 can improve confidentiality.

[0090] In the present disclosure, a part or all of the processing of the information processing device 1 can be realized by causing a CPU to execute a computer program.

[0091] Specifically, the above-mentioned program includes a set of instructions (or software code) for making the computer perform one or more functions described in the embodiment when the program is loaded into the computer. The program may be stored in a non-transitory computer-readable medium or a tangible storage medium. By way of example and not limitation, the computer-readable medium or tangible storage medium includes a random-access memory (RAM), a read-only memory (ROM), a flash memory, a solid-state drive (SSD) or other memory technology. Also, by way of example and not limitation, the computer-readable medium or tangible storage medium includes a CD-ROM, a digital versatile disc (DVD), a Blu-ray (registered trademark) disc or other optical disk storage. Also, by way of example and not limitation, the computer-readable medium or tangible storage medium includes a magnetic cassette, a magnetic tape, a magnetic disk storage or other magnetic storage device. The program may be transmitted on a transitory computer-readable medium or a communication medium. By way of example and not limitation, the transitory computer-readable medium or the communication medium includes an electrical, optical, acoustic, or other form of propagating signal.

[0092] Although the present disclosure has been described above with reference to the embodiments, the present disclosure is not limited to the above-mentioned embodiments. Various modifications that can be understood by a person skilled in the art can be made to the configuration and details of the present disclosure within the scope of the present disclosure. Furthermore, each embodiment can be appropriately combined with other embodiments.

[0093] Each drawing is merely an example for describing one or more embodiments. Each drawing may relate not only to one particular embodiment, but to one or more other embodiments. As can be understood by those skilled in the art, various features or steps described with reference to any one drawing may be combined with features or steps shown in one or more other drawings to create an embodiment not explicitly shown or described, for example. Not all features or steps shown in any one drawing are necessary to describe an exemplary embodiment, and some features or steps may be omitted. The order of steps described in any drawing may be changed as appropriate.

[0094] Furthermore, some or all of the above-described embodiments can be described as, but are not limited to, the following supplementary notes.

[0095] (Appendix 1) Memory, an authentication tree cache in which a part of the counters and the identifiers included in an authentication tree consisting of a plurality of nodes connected in a tree shape, each of which is assigned a pair of a counter and an identifier, and a tag generated using the counters and the identifiers included in the authentication tree are temporarily stored; a data cache in which a part of data assigned to each of a plurality of leaf nodes, which are nodes in the lowest layer among the plurality of nodes constituting the authentication tree, is temporarily stored; an authenticated memory encryption engine that performs encryption processing and authentication processing using the authentication tree on data exchanged between the data cache and the memory, and also performs authentication processing on tags generated at one or more nodes on a path from a leaf node to which the data is assigned to a root node; Equipped with The authenticated memory encryption engine includes: When deleting any one of the plurality of nodes constituting the authentication tree, a counter value assigned to a parent node of the node to be deleted is updated based on a counter value assigned to the node to be deleted, and when adding a new node to the authentication tree at the same position as the deleted node, a counter value assigned to the added node is set based on a counter value assigned to a parent node of the added node; Information processing device.

[0096] (Appendix 2) The authenticated memory encryption engine includes: When deleting any one of the multiple nodes constituting the authentication tree, a counter value assigned to a parent node of the node to be deleted is updated to a value larger than the larger of the counter value assigned to the parent node of the node to be deleted and the counter value assigned to the node to be deleted, and When adding a new node to the authentication tree at the same position as the deleted node, the counter value assigned to the added node is set to be equal to or greater than the counter value assigned to the parent node of the added node. 2. An information processing device according to claim 1.

[0097] (Appendix 3) The authenticated memory encryption engine includes: When deleting any one of the multiple nodes constituting the authentication tree, a counter value assigned to a parent node of the node to be deleted is updated to the larger of a counter value assigned to the parent node of the node to be deleted and a counter value assigned to the node to be deleted, and When adding a new node to the authentication tree at the same position as the deleted node, a counter value assigned to the added node is set to a value greater than a counter value assigned to a parent node of the added node. 2. An information processing device according to claim 1.

[0098] (Appendix 4) A counter assigned to each node of the authentication tree is composed of a major counter whose value is represented by higher bits of a plurality of bits representing the value of the counter, and a minor counter whose value is represented by lower bits, and the major counter is shared by a plurality of nodes having a common parent node. 2. An information processing device according to claim 1.

[0099] (Appendix 5) The authenticated memory encryption engine includes: When deleting any one of the plurality of nodes constituting the authentication tree, a major counter value assigned to a parent node of the node to be deleted is updated to a value larger than the larger of the major counter value assigned to the parent node of the node to be deleted and the major counter value assigned to the node to be deleted, and When adding a new node to the authentication tree at the same position as the deleted node, a value of a major counter assigned to the added node is set to be equal to or greater than a value of a major counter assigned to a parent node of the added node. 5. The information processing device according to claim 4.

[0100] (Appendix 6) when updating a value of the major counter shared by a plurality of nodes having a common parent node, the authenticated memory cryptographic engine initializes values ​​of minor counters of each of the plurality of nodes having the common parent node. 6. The information processing device according to claim 5.

[0101] (Appendix 7) Memory, an authentication tree cache in which a part of the counters and the identifiers included in an authentication tree consisting of a plurality of nodes connected in a tree shape, each of which is assigned a pair of a counter and an identifier, and a tag generated using the counters and the identifiers included in the authentication tree are temporarily stored; a data cache in which a part of data assigned to each of a plurality of leaf nodes, which are nodes in the lowest layer among the plurality of nodes constituting the authentication tree, is temporarily stored; an authenticated memory encryption engine that performs encryption processing and authentication processing using the authentication tree on data exchanged between the data cache and the memory, and also performs authentication processing on tags generated at one or more nodes on a path from a leaf node to which the data is assigned to a root node; A method for controlling an information processing device comprising: When deleting any one of the plurality of nodes constituting the authentication tree, a counter value assigned to a parent node of the node to be deleted is updated based on a counter value assigned to the node to be deleted; when adding a new node to the authentication tree at the same position as the deleted node, a counter value assigned to the added node is set based on a counter value assigned to a parent node of the added node; A method for controlling an information processing device.

[0102] (Appendix 8) When deleting any one of the multiple nodes constituting the authentication tree, a counter value assigned to a parent node of the node to be deleted is updated to a value greater than the greater of a counter value assigned to the parent node of the node to be deleted and a counter value assigned to the node to be deleted; When adding a new node to the authentication tree at the same position as the deleted node, the counter value assigned to the added node is set to be equal to or greater than the counter value assigned to the parent node of the added node. A method for controlling an information processing device according to claim 7.

[0103] (Appendix 9) Memory, an authentication tree cache in which a part of the counters and the identifiers included in an authentication tree consisting of a plurality of nodes connected in a tree shape, each of which is assigned a pair of a counter and an identifier, and a tag generated using the counters and the identifiers included in the authentication tree are temporarily stored; a data cache in which a part of data assigned to each of a plurality of leaf nodes, which are nodes in the lowest layer among the plurality of nodes constituting the authentication tree, is temporarily stored; an authenticated memory encryption engine that performs encryption processing and authentication processing using the authentication tree on data exchanged between the data cache and the memory, and also performs authentication processing on tags generated at one or more nodes on a path from a leaf node to which the data is assigned to a root node; A control program for causing a computer to execute a control process in an information processing device comprising: When deleting any one of a plurality of nodes constituting the authentication tree, a process of updating a counter value assigned to a parent node of the node to be deleted based on the counter value assigned to the node to be deleted; When adding a new node to the authentication tree at the same position as the deleted node, a process of setting a counter value assigned to the added node based on a counter value assigned to a parent node of the added node; A control program that causes a computer to execute the above.

[0104] (Appendix 10) when deleting any one of a plurality of nodes constituting the authentication tree, causing a computer to execute a process of updating a counter value assigned to a parent node of the node to be deleted to a value greater than the greater of a counter value assigned to the parent node of the node to be deleted and a counter value assigned to the node to be deleted; when adding a new node to the authentication tree at the same position as the deleted node, causing the computer to execute a process of setting a counter value assigned to the added node to be equal to or greater than a counter value assigned to a parent node of the added node; 10. The control program according to claim 9.

[0105] Some or all of the elements (e.g., configurations and functions) described in Supplementary Notes 2 to 6 that are dependent on Supplementary Note 1 may also be dependent on Supplementary Notes 7 and 9 in the same dependent relationship as Supplementary Notes 2 to 6. Some or all of the elements described in any Supplementary Note may be applied to various hardware, software, recording means for recording software, systems, and methods. [Explanation of symbols]

[0106] 1. Information processing device 100 Cash 101 Data Cache 102 Authentication Tree Cache 103 Memory 104 Authenticated Memory Encryption Engine (AMEE) 301 Leaf Nodes 302 Plaintext Data 303 Ciphertext 304 Address 305 Counter 306 Tags 307 Cache Lines 311 Intermediate Nodes 312 Identifier 313 Counter 314 Counter 315 Tags 321 Root Node 322 Identifier 323 Route Counter 324 Counter 325 Tags 330 keys

Claims

1. Memory, an authentication tree cache in which a part of the counters and the identifiers included in an authentication tree consisting of a plurality of nodes connected in a tree shape, each of which is assigned a pair of a counter and an identifier, and a tag generated using the counters and the identifiers included in the authentication tree are temporarily stored; a data cache in which a part of data assigned to each of a plurality of leaf nodes, which are nodes in the lowest layer among the plurality of nodes constituting the authentication tree, is temporarily stored; an authenticated memory encryption engine that performs encryption processing and authentication processing using the authentication tree on data exchanged between the data cache and the memory, and also performs authentication processing on tags generated at one or more nodes on a path from a leaf node to which the data is assigned to a root node; Equipped with The authenticated memory encryption engine includes: When deleting any one of the plurality of nodes constituting the authentication tree, a counter value assigned to a parent node of the node to be deleted is updated based on a counter value assigned to the node to be deleted, and when adding a new node to the authentication tree at the same position as the deleted node, a counter value assigned to the added node is set based on a counter value assigned to a parent node of the added node; Information processing device.

2. The authenticated memory encryption engine includes: When deleting any one of the multiple nodes constituting the authentication tree, a counter value assigned to a parent node of the node to be deleted is updated to a value larger than the larger of the counter value assigned to the parent node of the node to be deleted and the counter value assigned to the node to be deleted, and When adding a new node to the authentication tree at the same position as the deleted node, the counter value assigned to the added node is set to be equal to or greater than the counter value assigned to the parent node of the added node. The information processing device according to claim 1 .

3. The authenticated memory encryption engine includes: When deleting any one of the multiple nodes constituting the authentication tree, a counter value assigned to a parent node of the node to be deleted is updated to the larger of a counter value assigned to the parent node of the node to be deleted and a counter value assigned to the node to be deleted, and When adding a new node to the authentication tree at the same position as the deleted node, a counter value assigned to the added node is set to a value greater than a counter value assigned to a parent node of the added node. The information processing device according to claim 1 .

4. A counter assigned to each node of the authentication tree is composed of a major counter whose value is represented by higher bits of a plurality of bits representing the value of the counter, and a minor counter whose value is represented by lower bits, and the major counter is shared by a plurality of nodes having a common parent node. The information processing device according to claim 1 .

5. The authenticated memory encryption engine includes: When deleting any one of the plurality of nodes constituting the authentication tree, a major counter value assigned to a parent node of the node to be deleted is updated to a value larger than the larger of the major counter value assigned to the parent node of the node to be deleted and the major counter value assigned to the node to be deleted, and When adding a new node to the authentication tree at the same position as the deleted node, a value of a major counter assigned to the added node is set to be equal to or greater than a value of a major counter assigned to a parent node of the added node. The information processing device according to claim 4.

6. when updating a value of the major counter shared by a plurality of nodes having a common parent node, the authenticated memory cryptographic engine initializes values ​​of minor counters of each of the plurality of nodes having the common parent node. The information processing device according to claim 5 .

7. Memory, an authentication tree cache in which a part of the counters and the identifiers included in an authentication tree consisting of a plurality of nodes connected in a tree shape, each of which is assigned a pair of a counter and an identifier, and a tag generated using the counters and the identifiers included in the authentication tree are temporarily stored; a data cache in which a part of data assigned to each of a plurality of leaf nodes, which are nodes in the lowest layer among the plurality of nodes constituting the authentication tree, is temporarily stored; an authenticated memory encryption engine that performs encryption processing and authentication processing using the authentication tree on data exchanged between the data cache and the memory, and also performs authentication processing on tags generated at one or more nodes on a path from a leaf node to which the data is assigned to a root node; A method for controlling an information processing device comprising: When deleting any one of the plurality of nodes constituting the authentication tree, a counter value assigned to a parent node of the node to be deleted is updated based on a counter value assigned to the node to be deleted; when adding a new node to the authentication tree at the same position as the deleted node, a counter value assigned to the added node is set based on a counter value assigned to a parent node of the added node; A method for controlling an information processing device.

8. When deleting any one of the multiple nodes constituting the authentication tree, a counter value assigned to a parent node of the node to be deleted is updated to a value larger than the larger of a counter value assigned to the parent node of the node to be deleted and a counter value assigned to the node to be deleted; When adding a new node to the authentication tree at the same position as the deleted node, the counter value assigned to the added node is set to be equal to or greater than the counter value assigned to the parent node of the added node. The method for controlling an information processing apparatus according to claim 7.

9. Memory, an authentication tree cache in which a part of the counters and the identifiers included in an authentication tree consisting of a plurality of nodes connected in a tree shape, each of which is assigned a pair of a counter and an identifier, and a tag generated using the counters and the identifiers included in the authentication tree are temporarily stored; a data cache in which a part of data assigned to each of a plurality of leaf nodes, which are nodes in the lowest layer among the plurality of nodes constituting the authentication tree, is temporarily stored; an authenticated memory encryption engine that performs encryption processing and authentication processing using the authentication tree on data exchanged between the data cache and the memory, and also performs authentication processing on tags generated at one or more nodes on a path from a leaf node to which the data is assigned to a root node; A control program for causing a computer to execute a control process in an information processing device comprising: When deleting any one of a plurality of nodes constituting the authentication tree, a process of updating a counter value assigned to a parent node of the node to be deleted based on the counter value assigned to the node to be deleted; When adding a new node to the authentication tree at the same position as the deleted node, a process of setting a counter value assigned to the added node based on a counter value assigned to a parent node of the added node; A control program that causes a computer to execute the above.

10. when deleting any one of a plurality of nodes constituting the authentication tree, causing a computer to execute a process of updating a counter value assigned to a parent node of the node to be deleted to a value greater than the greater of a counter value assigned to the parent node of the node to be deleted and a counter value assigned to the node to be deleted; when adding a new node to the authentication tree at the same position as the deleted node, causing the computer to execute a process of setting a counter value assigned to the added node to be equal to or greater than a counter value assigned to a parent node of the added node; The control program according to claim 9.

Images