Information processing device, method for controlling information processing device, and control program

Abstract

To provide an information processing device capable of improving confidentiality while improving processing performance through parallel processing, a method for controlling the information processing device, and a control program.SOLUTION: An information processing device comprises an authenticated memory encryption engine which performs encryption processing and authentication processing using an authentication tree for data transferred between a data cache and a memory, and also performs authentication processing for the tags generated in each of one or more nodes on the path from the leaf node to which the data is assigned to the root node. The counter assigned to each node of the authentication tree comprises a major counter and a minor counter, with the major counter being shared by a plurality of nodes having a common parent node. The authenticated memory encryption engine is configured to be capable of waiting for update processing of the major counter value which occurs in association with the update processing of the minor counter value.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present disclosure relates to an information processing device, a control method for an information processing device, and a control program. [Background technology]

[0002] In an information processing device mounted on a computer or the like, a hierarchical structure of storage areas is implemented, such as a register, a cache, a memory, and a storage. Here, when data is transferred between the cache and the memory, data authentication and data encryption processing (encryption and / or decryption) are implemented. This makes it possible to prevent leakage of data stored in the information processing device due to a physical attack on the information processing device from the outside. Hereinafter, the data authentication and data encryption processing implemented when data is transferred between the cache and the memory is also referred to as authentication-encryption processing.

[0003] Furthermore, in recent years, data authentication using an authentication tree consisting of a plurality of nodes connected in a tree shape, each of which is assigned a pair of a counter and an identifier, has been developed. In authentication processing using an authentication tree, not only is verification performed on data assigned to a leaf node, which is a node in the lowest layer among a plurality of nodes constituting the authentication tree, but also verification is performed on authenticators (tags) assigned to each of all nodes existing on a path from the leaf node to the root node. This further reduces the risk of data leakage and improves confidentiality. Technology related to data authentication using an authentication tree is disclosed in, for example, Patent Document 1. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Special Publication No. 2020-529657 Summary of the Invention [Problem to be solved by the invention]

[0005] In the authentication process using an authentication tree, the address space covered by the authentication tree is the target of the authentication process. In other words, the address space assigned to each of the leaf nodes, which are the nodes in the lowest layer among the nodes constituting the authentication tree, is the target of the authentication process. Therefore, a leaf node and another leaf node may be hanging from a common ancestor node. Therefore, when access to data assigned to a leaf node and access to data assigned to another leaf node are performed in parallel, there is a possibility that the update processes of the common ancestor node due to these accesses may collide.

[0006] To avoid such a situation, in authentication processing using an authentication tree, when an access (first access) is made to data assigned to a leaf node (first node) and then an access (second access) is made to data assigned to another leaf node (second node), the following processing is executed.

[0007] First, in response to the first access, all nodes present on the path from the first node to the first node in which a cache line is cached among the nodes present on the path from the first node to the root node are locked, and then the locked nodes are updated. In addition, in response to the second access, all nodes present on the path from the second node to the first node in which a cache line is cached among the nodes present on the path from the second node to the root node are locked, and then the locked nodes are updated. Here, if a third node (i.e., a common ancestor node) that is already locked in response to the first access is present among the nodes present on the path from the second node to the root node, all nodes present on the path from the second node to the node immediately preceding the third node are locked, and after all nodes locked in response to the first access are unlocked, the remaining nodes present on the path from the third node to the first node in which a cache line is cached among the nodes present on the path from the third node to the root node are locked, and then the locked nodes are updated.

[0008] However, in such authentication processing, for example, when the counter is a split counter, if an update process for a node locked by a first access needs to be performed in conjunction with an update process for another node locked by a second access, the update process for the other node cannot be performed. In other words, the related technology has a problem in that it is not possible to perform parallel processing of authentication processing using an authentication tree with high accuracy.

[0009] An object of the present disclosure is to provide an information processing device, a control method for an information processing device, and a control program that solve the above-mentioned problems. [Means for solving the problem]

[0010] An information processing device according to one aspect of the present disclosure includes a memory, an authentication tree cache in which a counter and an identifier included in an authentication tree formed of a plurality of nodes linked in a tree shape, each of which is assigned a pair of a counter and an identifier, and a part of a tag generated using the counter and the identifier included in the authentication tree, and a data cache in which a part of data assigned to each of a plurality of leaf nodes which are nodes in the lowest layer among the plurality of nodes constituting the authentication tree is temporarily stored, and performs encryption processing and authentication processing using the authentication tree on data transferred between the data cache and the memory, and performs root access processing from the leaf node to which the data is assigned. and an authenticated memory cryptographic engine that performs authentication processing on tags generated in each of one or more nodes on a path leading to a target node, wherein a counter assigned to each node of the authentication tree is composed of a major counter whose value is represented by higher bits and a minor counter whose value is represented by lower bits among a plurality of bits representing the value of the counter, and the major counter is shared by a plurality of nodes having a common parent node, and the authenticated memory cryptographic engine is configured to be able to wait for update processing of the major counter value that occurs in conjunction with update processing of the minor counter value for the major counter and minor counter assigned to each node.

[0011] A control method of an information processing device according to one aspect of the present disclosure includes: a memory; an authentication tree cache in which a counter and an identifier included in an authentication tree consisting of a plurality of nodes linked in a tree shape, each of which is assigned a pair of a counter and an identifier, and a portion of a tag generated using the counter and the identifier included in the authentication tree, and a data cache in which a portion of data assigned to each of a plurality of leaf nodes that are nodes in the lowest layer among the plurality of nodes constituting the authentication tree is temporarily stored; and, for data exchanged between the data cache and the memory, an encryption process and an authentication process using the authentication tree are performed, and a tag generated in each of one or more nodes present on a path from the leaf node to which the data is assigned to the data to a root node is stored. a memory encryption engine with authentication for authenticating a tag created by the authentication tree, wherein a counter assigned to each node of the authentication tree is composed of a major counter whose value is represented by higher bits and a minor counter whose value is represented by lower bits among a plurality of bits representing the value of the counter, and the major counter is shared by a plurality of nodes having a common parent node, the method comprising: for the major counter and minor counter assigned to each node, causing an update process of the major counter value that occurs in conjunction with an update process of the minor counter to wait, and performing an update process of the value of a minor counter assigned to another node having a common parent node with the node to which the minor counter is assigned, and performing an update process of the major counter value.

[0012] A control program according to one aspect of the present disclosure includes a memory, an authentication tree cache in which a counter and an identifier included in an authentication tree consisting of a plurality of nodes linked in a tree shape, each of which is assigned a pair of a counter and an identifier, and a part of a tag generated using the counter and the identifier included in the authentication tree, a data cache in which a part of data assigned to each of a plurality of leaf nodes which are nodes in the lowest layer among the plurality of nodes constituting the authentication tree, is temporarily stored, and an authenticated memory for performing encryption processing and authentication processing using the authentication tree on data transferred between the data cache and the memory, and performing authentication processing on tags generated in each of one or more nodes present on a path from the leaf node to which the data is assigned to the tag to a root node. a cryptographic engine, and a counter assigned to each node of the authentication tree, the counter being composed of a major counter whose value is represented by higher bits and a minor counter whose value is represented by lower bits among a plurality of bits representing the value of the counter, and the major counter being shared by a plurality of nodes having a common parent node, the control program causing a computer to execute control processing in an information processing device, the control program causing the computer to execute, with respect to the major counter and minor counter assigned to each node, a process of waiting for an update process of the major counter value that occurs in conjunction with an update process of the minor counter value, a process of updating the value of a minor counter assigned to another node that has a common parent node with the node to which the minor counter is assigned, and a process of updating the value of the major counter. Effect of the Invention

[0013] The present disclosure can provide an information processing device, a control method for an information processing device, and a control program that can improve confidentiality while improving processing performance through parallel processing. [Brief description of the drawings]

[0014] [Figure 1] 1 is a block diagram showing a configuration example of an information processing device according to the present disclosure. [Diagram 2] FIG. 1 is a conceptual diagram of an authentication tree. [Diagram 3] 1 is a diagram showing the relationship between each node constituting an authentication tree and its corresponding cache line. FIG. [Figure 4] FIG. 11 is a diagram for explaining parallel processing of authentication processing using an authentication tree. [Diagram 5] 11 is a diagram for explaining an example of a flow of deleting and adding a node in an authentication tree. FIG. [Figure 6] 13 is a flowchart showing the flow of a process for adding a node to an authentication tree. [Figure 7] 13 is a flowchart showing the flow of a process for deleting a node from an authentication tree. [Figure 8] 13 is a flowchart showing a flow of a part of parallel processing of authentication processing. [Figure 9] 13 is a flowchart showing a flow of a part of parallel processing of authentication processing. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0015] <Embodiment 1> Fig. 1 is a block diagram showing an example configuration of an information processing device 1 according to the present disclosure. As shown in Fig. 1, the information processing device 1 includes a cache 100, a memory 103, and an authenticated memory encryption engine (AMEE) 104. The cache 100 includes a data cache 101 and an authentication tree cache 102. Hereinafter, the authenticated memory encryption engine 104 will be referred to as the AMEE 104.

[0016] The AMEE 104 performs cryptographic processing (encryption and / or decryption) on data exchanged between the cache 100 and the memory 103, and performs authentication processing using an authentication tree consisting of multiple nodes linked in a tree shape, each of which is assigned a pair of a counter and an identifier. Here, in the authentication processing using the authentication tree, not only is verification performed on data assigned to a leaf node, which is the node in the lowest layer among multiple nodes constituting the authentication tree, but also verification is performed on authenticators (tags) assigned to each of all nodes existing on the path from the leaf node to the root node. This reduces the risk of data leakage, thereby improving confidentiality. The tag assigned to each node is generated using the counter, identifier, etc. assigned to the node.

[0017] The data cache 101 temporarily stores data to be written from outside to the memory 103 and data to be read from the memory 103 to outside. The authentication tree cache 102 temporarily stores counters and identifiers assigned to each node of the authentication tree and a part of tags generated using them.

[0018] Fig. 2 is a conceptual diagram of an authentication tree. The address space covered by this authentication tree is the target of authentication processing. In other words, the address space assigned to each of the leaf nodes, which are the nodes in the lowest layer among the multiple nodes constituting this authentication tree, is the target of authentication processing.

[0019] FIG. 3 is a diagram showing the relationship between each node constituting an authentication tree and the corresponding cache line.

[0020] Data blocks are assigned to each node. The unit of data blocks assigned to each node is called a cache line. Each cache line is provided with at least a bit indicating either dirty or clean. Clean indicates that the cache line stored in cache 100 is the same as the corresponding cache line stored in memory 103. Dirty indicates that the cache line stored in cache 100 has been updated and is different from the corresponding cache line stored in memory 103.

[0021] Each node is also assigned a counter and an identifier. The identifier of each leaf node (node ​​at the bottom layer) is the address of the corresponding cache line. The identifier of each intermediate node is derivable from its position in the authentication tree. For example, the identifier assigned to the parent node of a leaf node identified by an address is derivable from the address of the leaf node.

[0022] Furthermore, each leaf node is assigned data corresponding to an address (identifier), which, when written to data cache 101, corresponds to a cache line written to data cache 101. The cache line written to data cache 101 contains only data.

[0023] In any leaf node 301, encrypted data (hereinafter also simply referred to as ciphertext) 303 is generated using plaintext data 302 of the corresponding cache line and a key 330, and a tag (authenticator, MAC) 306 is generated using the ciphertext 303, an address 304 of the leaf node 301, a value of a counter 305 of the leaf node 301, and the key 330. The tag 306 generated in the leaf node 301 is stored in a cache line 307 separate from the cache line of the plaintext data 302, together with tags generated in other nodes (sibling nodes) that have a common parent node with the leaf node 301.

[0024] When a cache line allocated to a leaf node 301 is written out from the data cache 101 to the memory 103, ciphertext 303 generated by encrypting plaintext data 302 is written out to the memory 103 instead of the plaintext data 302.

[0025] On the other hand, when a cache line assigned to a leaf node 301 is read from the memory 103 to the data cache 101, a tag is first generated by the address 304 of the leaf node 301, the value of the counter 305 of the leaf node 301, the ciphertext 303 read from the memory 103, and the key 330. Then, only when the generated tag matches the tag 306 stored in the cache line 307, the ciphertext 303 read from the memory 103 is decrypted to the plaintext data 302 by the key 330 and then read into the data cache 101 as the cache line of the leaf node 301. At this time, the value of the counter 305 of the leaf node 301 needs to be included in the cache line of its parent node (intermediate node 311) and to exist in the authentication tree cache 102.

[0026] In any intermediate node 311, a tag 315 is generated by the values ​​of the counters 314 of all child nodes of the intermediate node 311, the value of the counter 313 of the intermediate node 311, the identifier 312 of the intermediate node 311, and the key 330. A cache line allocated to the intermediate node 311 is composed of the values ​​of the counters 314 of all child nodes of the intermediate node 311 and the tag 315 generated in the intermediate node 311.

[0027] When a cache line allocated to an intermediate node 311 is written from the authentication tree cache 102 to the memory 103, the tag included in the cache line must be generated using the counter values ​​of all child nodes included in the cache line. In other words, after the tag included in the cache line is generated, the counter values ​​of any child nodes included in the cache line must not be updated.

[0028] On the other hand, when a cache line allocated to the intermediate node 311 is read from the memory 103 into the authentication tree cache 102, a tag is first generated from the values ​​of the counters 314 of all child nodes of the intermediate node 311 included in the cache line read from the memory 103, the value of the counter 313 of the intermediate node 311, the identifier 312 of the intermediate node 311, and the key 330. Then, only when the generated tag matches the tag included in the cache line allocated to the intermediate node 311, the cache line read from the memory 103 is read into the authentication tree cache 102. At this time, the value of the counter 313 of the intermediate node 311 needs to be included in the cache line of its parent node and to exist in the authentication tree cache 102.

[0029] In the root node (the node in the top layer) 321, a tag 325 is generated based on the values ​​of the counters 324 of all the child nodes of the root node 321, the value of the counter (root counter) 323 of the root node 321, the identifier 322 of the root node 321, and the key 330. The cache line allocated to the root node 321 is composed of the values ​​of the counters 324 of all the child nodes of the root node 321 and the tag 325 generated in the root node 321.

[0030] The value of the counter assigned to a given node is updated in the following cases: When a cache line assigned to a given node is written out from cache 100 to memory 103, if the cache line has been updated since it was read from memory 103 into cache 100, the value of the counter assigned to the node is updated, and then the tag included in the cache line assigned to the node is updated. The updated cache line is then written out from cache 100 to memory 103.

[0031] When data (cache line) assigned to any leaf node is updated, the counter values ​​of all nodes on the path from the leaf node to the root node are basically counted up. Here, the counter assigned to the root node is specially protected so that it cannot be directly manipulated by an attacker. Then, the tag of the corresponding node is updated by the counter of the root node, the counter of each intermediate node, or the counter and data of each leaf node. This allows the tag of each node to track the latest status.

[0032] The counter assigned to each node of the authentication tree may be composed of a major counter whose value is represented by the upper bits of the multiple bits representing the value of the counter, and a minor counter whose value is represented by the lower bits. In this case, the major counter assigned to a node is shared by other nodes (i.e., sibling nodes) having a common parent node. This suppresses the increase in scale due to the counter. In addition, the cache line of a certain intermediate node stores, as counter values, the values ​​of multiple minor counters assigned to all child nodes of the intermediate node, and the value of one major counter shared by all child nodes of the intermediate node. Hereinafter, a counter composed of a major counter and a minor counter is also called a split counter.

[0033] If the counter assigned to each node is a split counter, the minor counter value is updated, or the minor counter value is initialized and then the major counter value is updated. If the major counter is updated, the minor counter values ​​assigned to all nodes sharing the major counter are initialized.

[0034] Here, in authentication processing using an authentication tree, it is required to improve processing performance by parallelizing data access. However, when access to data assigned to a leaf node and access to data assigned to another leaf node are performed in parallel, there is a possibility that update processing of an ancestor node common to these leaf nodes due to these accesses will collide.

[0035] To avoid such a situation, in authentication processing using an authentication tree, when an access (first access) to data assigned to a certain leaf node (first node) is made followed by an access (second access) to data assigned to another leaf node (second node), the following processing is executed. Parallel processing of authentication processing using an authentication tree will be explained below with reference to Fig. 4. Fig. 4 is a diagram for explaining parallel processing of authentication processing using an authentication tree.

[0036] First, in response to the first access, AMEE104 locks all nodes N1 to N4 on the path from the leaf node N1 to the root node N5, up to the first node N4 in which a cache line is cached, and then updates the locked nodes N1 to N4.

[0037] In addition, the AMEE 104 attempts to lock all nodes N6, N7, N3, and N4 on the path from the leaf node N6 to the root node N5, which is the first node in which the cache line is cached. However, the nodes on the path from the leaf node N6 to the node N4 include the node N3 (common ancestor node) that has already been locked in the first access. In this case, the AMEE 104 first locks all nodes N6 and N7 on the path from the leaf node N6 to the node N7 immediately before the node N3, and after the nodes N1 to N4 locked in the first access are unlocked, the AMEE 104 locks the remaining nodes N3 and N4 on the path from the node N3 to the node N4, and then updates the locked nodes N6, N7, N3, and N4.

[0038] Here, for example, when the value of the major counter of node N2 is updated in conjunction with an update of the value of the minor counter of node N2, not only the value of the minor counter of node N2 needs to be initialized, but also the value of the minor counter of node N7, which shares the major counter with node N2, needs to be initialized. However, since node N7 is locked due to the second access, the minor counter of node N7 cannot be updated.

[0039] Therefore, in the information processing device 1, the AMEE 104 is configured to be able to wait for the update process of the major counter value that occurs in conjunction with the update process of the minor counter value, with respect to the major counter and minor counter assigned to each node.

[0040] In the example of Fig. 5, even if the update process of the minor counter value of node N2 requires the update of the major counter value of node N2 (in other words, even if the minor counter value of node N2 is updated and the domain is exhausted), AMEE 104 waits without updating the major counter value of node N2. For example, AMEE 104 updates the minor counter value assigned to node N7 due to the update process of node N7 associated with the second access, and then updates the major counter value common to nodes N2 and N7. This enables the information processing device 1 to perform parallel processing of authentication processes using an authentication tree with high accuracy.

[0041] In this way, in the information processing device 1, the AMEE 104 is configured to be able to wait for the update process of the major counter value that occurs with the update process of the minor counter value for the major counter and the minor counter assigned to each node. This allows the information processing device 1 to perform parallel processing of authentication processing using an authentication tree with high accuracy. In other words, the information processing device 1 can improve confidentiality while improving processing performance through parallel processing.

[0042] In addition, AMEE104 may be configured to update the value of a major counter shared by multiple nodes having a common parent node with plenty of time before any of the minor counters assigned to each of the multiple nodes having a common parent node uses up the domain, so as to prevent update processing of the value of a minor counter that involves update processing of the value of a major counter from occurring.

[0043] Moreover, it is preferable that the AMEE 104 is configured not to accept additional processing for a child node of a common ancestor node updated by the first and second accesses among the nodes locked by the second access following the first access, before updating the major counter of the child node. In the example of Fig. 5, it is preferable that the AMEE 104 is configured not to accept additional processing for a node N7, which is a child node of a common ancestor node N3 updated by the first and second accesses among the nodes N6 and N7 locked by the second access, before updating the major counter of the node N7. This makes it possible to prevent the minor counter of the node N7 from being continuously updated and using up its domain before updating the major counter common to the nodes N2 and N7.

[0044] Furthermore, it is preferable to optimize the size of the authentication tree by deleting unnecessary nodes from among the multiple nodes that compose the authentication tree and adding necessary nodes. This reduces the pressure on the memory storage area caused by the authentication tree, for example, by deleting tags (authenticators) related to unused address spaces. In particular, when memory addresses are virtual, the address space to be authenticated may be significantly larger than the actual memory size, so optimizing the size of the authentication tree is effective.

[0045] Therefore, when AMEE104 deletes any of the multiple nodes constituting the authentication tree, it updates the counter value assigned to the parent node of the node to be deleted based on the counter value assigned to the node to be deleted. When AMEE104 adds a new node to the multiple nodes constituting the authentication tree at the same position as the deleted node, it sets the counter value assigned to the added node based on the counter value assigned to the parent node of the added node.

[0046] For example, when AMEE104 deletes any of the multiple nodes constituting the authentication tree, it updates the counter value assigned to the parent node of the node to be deleted to a value greater than the greater of the counter value assigned to the parent node of the node to be deleted and the counter value assigned to the node to be deleted. When AMEE104 adds a new node to the authentication tree at the same position as the deleted node, it sets the counter value assigned to the added node to be equal to or greater than the counter value assigned to the parent node of the added node.

[0047] FIG. 5 is a diagram for explaining an example of a flow of deleting and adding a node of an authentication tree. For example, if the counter value assigned to the node to be deleted indicates "10" and the counter value assigned to the parent node of the node to be deleted indicates "11", AMEE104 updates the counter value "11" assigned to the parent node of the node to be deleted to, for example, "12" or more. After that, when AMEE104 adds a new node to the authentication tree at the same position as the deleted node, it sets the counter value assigned to the node to be added to the counter value of the parent node or more, i.e., "12" or more. As a result, the counter value of the node to be deleted indicates "10" and the counter value of the added node indicates "12" or more. In other words, the counter of the node to be deleted and the counter of the added node indicate different values.

[0048] As a result, the counter value of the node to be added is always greater than the counter value of the node to be deleted (in other words, the counter of the node to be deleted and the counter of the node to be added show different values), so new authentication is required to add a node. In other words, in the information processing device 1, a node that was previously deleted is not added again to the authentication tree without being authenticated. As a result, the information processing device 1 can improve confidentiality.

[0049] Here, when the counter assigned to each node of the authentication tree is a split counter, AMEE104 performs the following process. For example, when AMEE104 deletes any of the multiple nodes constituting the authentication tree, it updates the value of the major counter assigned to the parent node of the node to be deleted to a value larger than the larger of the value of the major counter assigned to the parent node of the node to be deleted and the value of the major counter assigned to the node to be deleted. When AMEE104 adds a new node to the authentication tree at the same position as the deleted node, it sets the value of the major counter assigned to the added node to be equal to or larger than the value of the major counter assigned to the parent node of the added node. Note that when the value of the major counter shared by multiple nodes having a common parent node is updated, the value of each minor counter of the multiple nodes having a common parent node is initialized.

[0050] In this way, in the information processing device 1, when the AMEE 104 deletes any one of the multiple nodes constituting the authentication tree, the AMEE 104 updates the counter value assigned to the parent node of the node to be deleted based on the counter value assigned to the node to be deleted. Then, when the AMEE 104 adds a new node to the multiple nodes constituting the authentication tree at the same position as the deleted node, the AMEE 104 sets the counter value assigned to the added node based on the counter value assigned to the parent node of the added node. As a result, the counter value of the node to be deleted and the counter value of the added node become different, so that a new authentication is required to add a node. That is, in the information processing device 1, a node that was deleted in the past is not added to the authentication tree again without being authenticated. As a result, the information processing device 1 can improve confidentiality.

[0051] For example, in a cloud service, a virtual machine is provided to a customer. The virtual machine is provided with a virtual memory. This virtual memory is assigned an address space that exceeds the real memory. When applied to such a service, the information processing device 1 according to the present disclosure can improve confidentiality while improving processing capacity through parallel processing.

[0052] Furthermore, high confidentiality is required for the management of computers that handle financial information, computer security information, military information, health information, insurance information, safety information, etc. By applying the information processing device 1 according to the present disclosure to the management of such computers, it is possible to improve confidentiality while improving processing power through parallel processing.

[0053] <Embodiment 2> The flow of processing by the information processing device 1 will be described in more detail below.

[0054] In the following description, in a parallelizable authentication tree (PAT), ρ is a node, ccl(ρ) is a cache line assigned to node ρ, par(ρ) is a parent node of node ρ, and Cρ is a set of registered child nodes of node ρ. Node ρ is either an internal node or a leaf node. If node ρ is an internal node, node ρ is assigned a cache line including the counter values ​​of all child nodes of node ρ and tags generated at node ρ. If node ρ is a leaf node, node ρ is assigned a cache line including memory data. If node ρ is a leaf node, node ρ is further assigned a cache line including the tag of node ρ and the tags of other nodes that have a common parent node with node ρ.

[0055] Any internal node ρ is assigned a counter ctr(ρ). The counter and identifier are used as nonce in the cryptographic function that generates the tag (authenticator), and therefore need to be updated with every update of the authentication tree (including updates that return to the same memory state) to counter replay attacks.

[0056] In this disclosure, a case where the counter ctr(ρ) is a split counter consisting of a major counter ctr_maj(ρ) and a minor counter ctr_min(ρ) will be described as an example. The major counter ctr_maj(ρ) is shared with sibling nodes of the node ρ, whereas the minor counter ctr_min(ρ) is uniquely assigned to the node ρ. The cache line of the internal node ρ stores the major counter ctr_maj(τ) shared by all child nodes τ of the node ρ (where τ∈Cρ), the minor counters ctr_min(τ) assigned to each of all child nodes τ of the node ρ, and the tag tag(ρ) generated in the node ρ.

[0057] The minor counter cycles more frequently than the major counter. Therefore, some bits in the minor counter define some special meanings. Specifically, some bits in the minor counter define the non-registration (non-existence) of a node, the minimum value of the minor counter, and the maximum value of the minor counter. In the following, the non-registration of a node is represented as "end", the minimum value of the minor counter is represented as "bot", and the maximum value of the minor counter is represented as "top".

[0058] If node ρ is not registered, the minor counter ctr_min(ρ) of node ρ indicates “end”. Thereafter, when the counter ctr(ρ) of node ρ is assigned to the authentication tree cache 102, that is, when node ρ is added, the minor counter ctr_min(ρ) of node ρ is set to “bot”. Thereafter, every time the cache line ccl(ρ) is updated, the minor counter ctr_min(ρ) is incremented by 1, and before reaching “top”, the minor counter ctr_min(ρ) returns to “bot” by executing a carry-over process of the counter, CaryyUp(ρ). At this time, the value of the major counter ctr_maj(ρ) is incremented by 1.

[0059] Note that when node ρ has no descendants, it is possible to delete (prune) node ρ. The minor counter ctr_min(ρ) is set to "end" when the process Prune(ρ), which is the deletion process of node ρ, is executed. The size of the authentication tree changes dynamically due to the addition and deletion of nodes. The root counter never leaves the authentication tree cache 102.

[0060] When node ρ is an internal node, the cache line ccl(ρ) contains the tag tag(ρ) generated at node ρ. As long as the parent node par(ρ) of node ρ is cached, all operations do not require ancestor nodes higher than the parent node par(ρ).

[0061] <Hardware Configuration> The information processing apparatus 1 includes, as hardware, a cache 100, a memory 103, and an AMEE 104. The cache 100 is composed of a data cache 101 and an authentication tree cache 102. Only the cache lines of data among data, counters, and tags are cached in the data cache 101. Therefore, the processor can access only the data cache 101 among the data cache 101 and the authentication tree cache 102. In contrast, the AMEE 104 can access any of the data cache 101, the authentication tree cache 102, and the memory 103.

[0062] <Definition of Processing by AMEE 104> First, the generation process Tag of the tag tag(ρ) assigned to the internal node ρ by the AMEE 104 will be described. Let sk be the secret key (key 330), ρ be the identifier of the internal node ρ, ccl’(ρ) be the part other than the tag in the cache line ccl(ρ) of the internal node ρ, ctr(ρ) be the value of the counter of the internal node ρ, and tag(ρ) be the tag generated at the internal node ρ. Then, the generation process Tag of the tag tag(ρ) assigned to the internal node ρ by the AMEE 104 is expressed as follows.

[0063] Tag(sk,ρ,ccl'(ρ),ctr(ρ))→tag(ρ)

[0064] This indicates that a tag tag(ρ) assigned to an internal node ρ is generated using a secret key sk, an identifier of the internal node ρ, a cache line ccl′(ρ), and a counter ctr(ρ).

[0065] Next, a description will be given of the AuthEnc process of generating the tag tag(ρ) and the cache line cpt(ρ) of the ciphertext assigned to the leaf node ρ by the AMEE 104. If sk is a secret key, ρ is an identifier (address) of the leaf node ρ, ccl(ρ) is a cache line of plaintext data, ctr(ρ) is a counter value of the leaf node ρ, tag(ρ) is a tag generated in the leaf node ρ, and cpt(ρ) is a cache line of the ciphertext, the AuthEnc process of generating the tag tag(ρ) and the cache line cpt(ρ) of the ciphertext assigned to the leaf node ρ by the AMEE 104 is expressed as follows:

[0066] AuthEnc(sk,ρ,ccl(ρ),ctr(ρ)) →{tag(ρ),cpt(ρ)}

[0067] This means that the tag tag(ρ) assigned to the leaf node ρ and the ciphertext cache line cpt(ρ) are generated using the secret key sk, the identifier of the leaf node ρ, the cache line of plaintext data ccl(ρ), and the counter ctr(ρ).

[0068] Next, the authentication process VeriDec of the ciphertext cache line cpt(ρ) assigned to the leaf node ρ by AMEE104 will be described. Let sk be the private key, ρ be the identifier (address) of the leaf node ρ, cpt(ρ) be the ciphertext cache line, ctr(ρ) be the value of the counter of the leaf node ρ, tag(ρ) be the tag assigned to the leaf node ρ, and ccl(ρ) be the cache line of the plaintext data. Then, the authentication process VeriDec of the ciphertext cache line cpt(ρ) assigned to the leaf node ρ by AMEE104 is expressed as follows.

[0069] VeriDec(sk,ρ,cpt(ρ),ctr(ρ),tag(ρ)) →ccl(ρ) / “bot”

[0070] This means that the verification of the ciphertext cache line cpt(ρ) is performed using the private key sk, the identifier of the leaf node ρ, the counter ctr(ρ), and the tag tag(ρ). If the authentication is successful, the cache line ccl(ρ) of the plaintext data is generated. If the authentication fails, the counter ctr(ρ) is set to “bot”.

[0071] <Initialization of the authentication tree> First, the initialization of the authentication tree will be described. First, AMEE104 sets the private key sk. Then, AMEE104 sets the major counter ctr_maj(root) of the root node to “0” and the minor counter ctr_min(root) of the root node to “end”.

[0072] <Add(ρ) process; Process of adding node ρ to the authentication tree> Next, the Add(ρ) process by AMEE104 will be described. The Add(ρ) process is the process of adding node ρ to the authentication tree. This process can be executed when there is a cache line ccl(par(ρ)) of the parent node par(ρ) of node ρ in the authentication tree cache 102 and the minor counter ctr_min(ρ) of node ρ is set to "end" (YES in step S101), and will not be executed in other cases (NO in step S101) (step S106).

[0073] When the process of adding node ρ to the authentication tree is executed (YES in step S101), first, AMEE104 updates the minor counter ctr_min(ρ) of node ρ from "end" to "bot", and then stores the cache line ccl(ρ) of node ρ in the authentication tree cache 102 (step S102).

[0074] For example, when node ρ is an internal node (YES in step S103), AMEE104 sets the major counter of the child nodes stored in the cache line ccl(ρ) of node ρ to the same value as the counter ctr_maj(ρ), and sets the minor counters of all the child nodes stored in the cache line ccl(ρ) of node ρ to "end" (step S104).

[0075] On the contrary, when node ρ is a leaf node (NO in step S103), AMEE104 sets the cache line ccl(ρ) of node ρ to "0", and sets the cache line ccl(ρ) to the dirty state (step S105). Further, if node τ is a sibling node of leaf node ρ and the minor counters ctr_min(τ) of all sibling nodes τ are set to "end", AMEE104 stores the cache line including the tag tag(ρ) of node ρ in the authentication tree cache 102 (step S105).

[0076] <Prune(ρ) process; deletion process of node ρ in the authentication tree> Next, the Prune(ρ) process by the AMEE 104 will be described. The Prune(ρ) process is a process for deleting a node ρ of an authentication tree. This process can be executed when the cache line ccl(ρ) of the node ρ and the cache line ccl(par(ρ)) of the parent node par(ρ) of the node ρ exist in the authentication tree cache 102 (YES in step S201), and is not executed otherwise (NO in step S201) (step S210).

[0077] If node ρ is an internal node (YES in step S201 → YES in step S202), it is determined whether the minor counters of all child nodes stored in the cache line ccl(ρ) of node ρ are set to “end” (step S203).

[0078] For example, if any of the minor counters of multiple child nodes stored in the cache line ccl(ρ) of node ρ is not set to “end” (NO in step S203), the deletion process of node ρ is not executed (step S210).

[0079] On the other hand, if the minor counters of all child nodes stored in the cache line ccl(ρ) of node ρ are set to “end” (YES in step S203), AMEE104 updates the value of the major counter ctr_maj(ρ) of node ρ to the larger of ctr_maj(ρ) and the major counters of the child nodes stored in the cache line ccl(ρ) of node ρ (step S204).

[0080] Then, the AMEE 104 sets the minor counter ctr_min(ρ) of the node ρ to “end” (step S205). Then, the AMEE 104 executes the process CarryUp(par(ρ)) which is a carry process of the counter described later (step S206). Specifically, the AMEE 104 increments the value of the major counter ctr_maj(ρ) of the node ρ by one, and sets the minor counters ctr_min(τ) of all the sibling nodes of the node ρ whose minor counters are not set to “end” to “bot” (step S206). Then, the AMEE 104 executes the process Invalidata(ρ) which is an invalidation process of the node ρ described later (step S207). Specifically, the AMEE 104 deletes the cache line ccl(ρ) of the node ρ from the authentication tree cache 102 (step S207). Then, the process ends (YES in step S208).

[0081] If the node ρ is a leaf node (YES in step S201→NO in step S202), the AMEE 104 sets the minor counter ctr_min(ρ) of the node ρ to “end” (step S205). Then, the AMEE 104 executes the process of CarryUp(par(ρ)) (step S206). Specifically, the AMEE 104 increments the value of the major counter ctr_maj(ρ) of the node ρ by one, and sets the minor counters ctr_min(τ) of all the sibling nodes of the node ρ whose minor counters are not set to “end” to “bot” (step S206). Then, the AMEE 104 executes the process of Invalidata(ρ) (step S207). Specifically, the AMEE 104 deletes the cache line ccl(ρ) of the node ρ from the data cache 101 (step S207).

[0082] Also, when node ρ is a leaf node (NO in step S208), if the minor counters ctr_min(τ) of all sibling nodes τ are set to "end", AMEE104 deletes the cache line ccl(tag(ρ)) containing the tag tag(ρ) of node ρ from the authentication tree cache 102 (step S209). Then, the process ends (YES in step S208).

[0083] <Read(ρ) process; Cache line read process from memory to cache> Next, the Read(ρ) process by AMEE104 will be described. The Read(ρ) process is the process of reading the cache line of node ρ from the memory 103 to the cache 100. This process can be executed when the cache line ccl(ρ) of node ρ does not exist in either the data cache 101 or the authentication tree cache 102, and the cache line ccl(par(ρ)) of the parent node par(ρ) of node ρ exists in the authentication tree cache 102.

[0084] When node ρ is an internal node, first, AMEE104 reads the cache line ccl(ρ) of node ρ from the memory 103 and performs an authentication process on the cache line ccl(ρ). Specifically, AMEE104 verifies whether tag(ρ)=Tag(sk,ρ,ccl’(ρ),ctr(ρ)) holds.

[0085] When tag(ρ)=Tag(sk,ρ,ccl’(ρ),ctr(ρ)) holds, AMEE104 stores the cache line ccl(ρ) read from the memory 103 in the authentication tree cache 102. On the contrary, when tag(ρ)=Tag(sk,ρ,ccl’(ρ),ctr(ρ)) does not hold, AMEE104 returns information indicating authentication failure to the cache 100.

[0086] When node ρ is a leaf node, first, AMEE104 reads the cache line cpt(ρ) of the ciphertext of node ρ from memory 103 and reads the tag tag(ρ) assigned to node ρ from memory 103 or the authentication tree cache 102. Then, AMEE104 performs decryption and authentication processing on the cache line cpt(ρ) of the ciphertext by means of the process of VeriDec(sk,ρ,cpt(ρ),ctr(ρ),tag(ρ)).

[0087] If the authentication is successful, AMEE104 generates a cache line ccl(ρ) of the plaintext data and stores it in the data cache 101. If the authentication fails, after setting the counter ctr(ρ) to "bot", AMEE104 returns information indicating that the authentication has failed to the cache 100.

[0088] <WriteBack(ρ) process; cache line write-back process from cache to memory> Subsequently, the WriteBack(ρ) process by AMEE104 will be described. The WriteBack(ρ) process is a cache line write-back process from the cache 100 to the memory 103. This process can be executed when the cache line ccl(ρ) of the internal node ρ indicating the dirty state exists in the authentication tree cache 102 when node ρ is an internal node. Also, this process can be executed when the cache line ccl(ρ) of the leaf node ρ indicating the dirty state exists in the data cache 101 and the cache line ccl(tag(ρ)) storing the tag tag(ρ) of the leaf node ρ exists in the authentication tree cache 102 when node ρ is a leaf node. However, it is necessary that the minor counter ctr_min(ρ) of node ρ is not set to "top".

[0089] First, AMEE104 increments the value of the minor counter ctr_min(ρ) of node ρ by one. Then, AMEE104 sets the cache line ccl(par(ρ)) of node par(ρ) stored in the authentication tree cache 102 to the dirty state.

[0090] When node ρ is an internal node, AMEE104 generates the tag tag(ρ) of node ρ by processing Tag(sk, ρ, ccl’(ρ), ctr(ρ)). Then, AMEE104 replaces the tag contained in the cache line ccl(ρ) of node ρ with the new tag, and then writes the updated cache line ccl(ρ) back to the memory 103. Then, AMEE104 sets the cache line ccl(ρ) of node ρ stored in the authentication tree cache 102 to the clean state.

[0091] When node ρ is a leaf node, AMEE104 reads the cache line ccl(tag(ρ)) storing the tag tag(ρ) of node ρ from the memory 103 if it does not exist in the authentication tree cache 102. Then, AMEE104 performs an encryption process on the cache line ccl(ρ) of the plaintext data by processing AuthEnc(sk, ρ, ccl(ρ), ctr(ρ)). Specifically, AMEE104 encrypts the cache line ccl(ρ) of the plaintext data to generate the cache line cpt(ρ) of the ciphertext and the tag tag(ρ). Then, AMEE104 writes the generated cache line cpt(ρ) of the ciphertext back to the memory 103. Then, AMEE104 sets the cache line ccl(ρ) of the plaintext data of node ρ stored in the data cache 101 to the clean state. Then, AMEE104 replaces the tag of the cache line ccl(tag(ρ)) in the authentication tree cache 102 with a new tag.

[0092] <Invalidate(ρ) process; Invalidation process of node ρ> Next, the Invalidate(ρ) process by AMEE104 will be described. The Invalidate(ρ) process is the invalidation process of node ρ. This process can be executed when the cache line ccl(ρ) of node ρ indicating the clean state exists in the data cache 101 or the authentication tree cache 102. In this case, AMEE104 invalidates by deleting the cache line ccl(ρ) stored in the data cache 101 or the authentication tree cache 102.

[0093] <CarryUp(ρ) process; carry - up process of the counter included in ccl(ρ)> Next, the CarryUp(ρ) process by AMEE104 will be described. The CarryUp(ρ) process is the carry - up process of the counter included in the cache line ccl(ρ) of node ρ. This process can be executed when the cache line ccl(ρ) of node ρ exists in the authentication tree cache 102.

[0094] First, assuming that among all the child nodes of node ρ, the child node whose minor counter is not set to "end" is child node ω, AMEE104 executes the Read(ω) process for child node ω when child node ω is a leaf node or when child node ω does not exist in the authentication tree cache 102.

[0095] After that, AMEE104 increments the value of the major counter (the major counter assigned to node ω) stored in the cache line ccl(ρ) of node ρ by 1. Then, AMEE104 sets the minor counter ctr_min(ω) assigned to node ω to "bot".

[0096] After that, when node ω is a leaf node, AMEE104 executes the WriteBack(ω) process for node ω, and in other cases, sets the cache line ccl(ω) to the dirty state.

[0097] <Explanation of parallel processing of authenticated memory encryption processing> Next, we will explain the parallel processing of authenticated memory encryption processing. Since an operation on a node requires its parent node, the operation may recursively require many ancestor nodes. Therefore, multiple operations executed simultaneously are likely to require the same ancestor node at a specific time. Such sharing of a node by multiple operations complicates parallel processing of authentication processing using an authentication tree, so ingenuity is required for parallel processing of authenticated memory encryption processing.

[0098] In the following description, ρ is an arbitrary node in the authentication tree, σ is an ancestor node of node ρ, and path(ρ,σ) is a set of nodes other than nodes ρ and σ that exist on the path from node ρ to node σ. In this case, node σ is the anchor of node ρ represented by anc(ρ). When AMEE 104 reads or writes back the cache line ccl(ρ) of node ρ from or to memory, it needs to call the cache line of the node in path(ρ,anc(ρ)).

[0099] First, some locking processes performed by the AMEE 104 will be described.

[0100] <cw-lock;カウンタ·ワイズ·ロック> If the node τ, which is the parent node of node ρ, is cached in the authentication tree cache 102 or a storage area is allocated to it in the authentication tree cache 102, the AMEE 104 can cw-lock the node τ that is not cw-locked with respect to ctr(ρ). "Cw-locking the node τ with respect to ctr(ρ)" means restricting access to the node τ so that ctr(ρ) does not change. Also, if the node τ is cached in the authentication tree cache 102 or a storage area is allocated to it in the authentication tree cache 102, the AMEE 104 can cw-lock the node ρ that is not cw-locked with respect to ctr(ρ). "Cw-locking the node ρ with respect to ctr(ρ)" means restricting access to the node ρ so that ctr(ρ) does not change.

[0101] <ex-lock; exclusive lock> If the node ρ is not allocated a storage area in the authentication tree cache 102, the AMEE 104 can ex-lock the node ρ that has not yet been ex-locked. "Ex-locking the node ρ" means restricting access to the node ρ so that the information allocated to the node ρ does not change. Specifically, the AMEE 104 ex-locks the node ρ by adding the address of the cache line corresponding to the node ρ to the directory, and releases the ex-lock of the node ρ by deleting the address of the cache line corresponding to the node ρ from the directory.

[0102] Note that the AMEE 104 manages a directory that lists the addresses of nodes that are not allocated a storage area in the cache 100. Only the addresses of nodes that are not allocated the cache 100 are listed in the directory, and the corresponding data is not included. The AMEE 104 ex-locks the node with the address by listing the address of the cache line that is not cached in the authentication tree cache 102 in the directory.

[0103] <sp-lock; Split counter lock> AMEE104 can sp-lock an unsp-locked node ρ for the first operation. AMEE104 does not accept a sp-lock for a second operation following the first operation on a node ρ that has already been sp-locked, and only permits access to node ρ by the first operation. The sp-lock of node ρ means that AMEE104 restricts access to the child nodes of node ρ in order to execute the process of CarryUp(ρ). When AMEE104 attempts to execute the process of CaryyUp(ρ), the child nodes of node ρ may already be locked by other operations (preceding operations). Here, canceling the preceding operations would complicate the process. Therefore, while AMEE104 completes the preceding operations, it blocks access to the child nodes of node ρ by operations after the preceding operations by means of sp-lock.

[0104] The structures of CarryUp and sp-lock are the key to coexisting the delayed update of the major counter, split counter, and parallel processing, which will be described later.

[0105] Subsequently, some basic processes necessary for parallel processing of authentication using the authentication tree will be described. Specifically, each of the processes of ConRead(ρ), ConWriteBack(ρ), ConCarryUp(ρ), ConAdd(ρ), ConPrune(ρ), ConInvalidate(ρ) will be described. These processes are executed when requested from the data cache 101 if node ρ is a leaf node, and are executed when requested from the authentication tree cache 102 if node ρ is an internal node.

[0106] <ConRead(ρ) process> Here, the ConRead(ρ) process by the AMEE 104 will be described. The ConRead(ρ) process is a process of reading a cache line from memory to a cache during parallel processing. This process can be executed when the node ρ is registered in the authentication tree. If the node ρ is not registered in the authentication tree, the AMEE 104 registers the node ρ in the authentication tree by the ConAdd(ρ) process described later.

[0107] First, the process that is the premise of the ConRead(ρ) process will be described. It is assumed that the data cache 101 allocates the cache line ccl(ρ) of the node ρ as the storage area of ​​the cache line ccl(τ) of the node τ for a cache miss of the node ρ when the node ρ is a leaf node. In this case, when the cache line ccl(τ) indicates a dirty state, the data cache 101 causes the AMEE 104 to execute the ConWriteBack(τ) process described later. This allows the AMEE 104 to allocate a cache line indicating a clean state to the node ρ. Thereafter, the data cache 101 causes the AMEE 104 to execute the ConRead(ρ). When the data cache 101 receives the cache line ccl(ρ) from the AMEE 104, it rewrites the cache line ccl(τ) indicating a clean state to the cache line ccl(ρ). The above-mentioned cache miss of the node ρ is caused by the CPU or the prefetcher of the data cache 101 reading the node ρ.

[0108] Assume that, when the node ρ is an internal node, the AMEE 104 inquires whether the node ρ is cached in the authentication tree cache 102, and receives a response from the authentication tree cache 102 indicating that the node ρ is a cache miss and is not locked. In this case, assume that a cache line ccl(τ) indicating a clean state corresponding to an arbitrary node τ is not locked, is invalidated by an invalidate(τ) process, and is assigned as a storage area for the cache line ccl(ρ) of the node ρ. In this case, the AMEE 104 cw-locks the node ρ with respect to this cache line ccl(ρ). At this time, the AMEE 104 executes a ConRead(ρ) process. If there is no clean cache line in the authentication tree cache 102 to which the cache line ccl(ρ) of the node ρ can be assigned, the cache line ccl(ρ) is not assigned to the authentication tree cache 102, unlike the operation of a general cache. In this case, the AMEE 104 executes a ConWriteBack(τ) process described later for the unlocked node τ. Note that a cache miss for node ρ is caused by the AMEE 104 or a prefetcher in the authentication tree cache 102 reading node ρ.

[0109] Next, the process in the lock phase of the ConRead(ρ) process will be described with reference to Fig. 8. First, the AMEE 104 executes the Read(ρ) process to request the cache line ccl(par(ρ)) of the parent node par(ρ) of the node ρ from the authentication tree cache 102 (step S301). Specifically, every time the AMEE 104 requests the cache line ccl(par(τ)) of the parent node par(τ) of any node τ from the authentication tree cache 102, the AMEE 104 performs the following process. That is, if the node par(τ) is ex-locked or sp-locked, or if the node par(τ) or the node τ is cw-locked (YES in step S302), the AMEE 104 waits until the lock is released (step S303).

[0110] If node par(τ) is not ex-locked or sp-locked, and if node par(τ) and node τ are not cw-locked (NO in step S302), and if node par(τ) is cached in the authentication tree cache 102 (YES in step S304), the AMEE 104 cw-locks node par(τ) with respect to node τ (its counter) and ends the processing in the lock phase (step S306).

[0111] If a node par(τ) is allocated storage space in the authentication tree cache 102 but is not cached (NO in step S304), and if the node par(τ) is cw-locked with respect to (the counter of) a child node other than the node τ that is allocated storage space in the cache (YES in step S305), the AMEE 104 cw-locks the node par(τ) with respect to (the counter of) the node τ, and decides to acquire the cache line ccl(par(τ)) as an anchor at the end of the memory phase described below, and then terminates the processing in the lock phase (step S306).

[0112] If a node par(τ) is allocated storage space in the authentication tree cache 102 but is not cached (NO in step S304), and if the node par(τ) is not cw-locked with respect to the child node (counter) of the node par(τ) that is allocated storage space in the cache (NO in step S305), the AMEE 104 decides whether to allocate storage space for a cache line of the node par(τ) in the authentication tree cache 102 (step S307).

[0113] If the AMEE 104 allocates a cache line of the node par(τ) in the authentication tree cache 102 (YES in step S307), it cw-locks the node par(τ) with respect to (the counter of) the node τ (step S308). If it does not allocate a cache line (NO in step S307), it ex-locks the node par(τ) (step S309). These locks are performed simultaneously with a cache miss. After these locks, the AMEE 104 replaces the parent node par(ρ) of the node ρ with the node ρ (step S309) and returns to the process of step S301.

[0114] Next, the processing in the memory phase of the ConRead(ρ) processing will be described. First, for the Read(τ) processing for each node τ executed in the lock phase, the AMEE 104 waits without requesting the cache line of each node τ from the memory 103 until the phase transitions from the lock phase to the memory phase. If the AMEE 104 needs to request a cache line from the memory 103, the AMEE 104 executes processing to satisfy all of those requests in this memory phase. The AMEE 104 waits for a memory response and finally receives the response.

[0115] If the anchor π has been stored in the authentication tree cache 102 by a previous process, the AMEE 104 requests and receives the anchor π from the authentication tree cache 102 via the bypass channel.

[0116] Next, the process in the unlock phase of the ConRead(ρ) process will be described. The AMEE 104 executes the following process in order (descending order) for all nodes τ on the path from the child node of the anchor π (cached node) to the node ρ.

[0117] First, when the processing of Read(par(τ)) is completed or when the node par(τ) is the anchor π, the AMEE 104 resumes the processing of Read(τ).

[0118] When the processing of Read(τ) for a node τ other than the node ρ is completed, AMEE104 releases the lock on the cache line ccl(par(τ)) of the node par(τ). If the cache line ccl(τ) is assigned to the authentication tree cache 102, AMEE104 moves the cache line ccl(τ) to the authentication tree cache 102, and discards it if it is not assigned.

[0119] After that, when the processing of Read(ρ) for the node ρ is completed, AMEE104 releases the lock on the cache line ccl(par(ρ)) of the node ρ. Then, AMEE104 moves the cache line ccl(ρ) to the assigned cache line storage area. If the node ρ is an internal node, AMEE104 releases the lock on the node ρ.

[0120] <ConWriteBack(ρ) processing> Subsequently, the ConWriteBack(ρ) processing by AMEE104 will be described. The ConWriteBack(ρ) processing is the process of writing back the cache line from the cache to the memory during parallel processing.

[0121] Hereinafter, it is assumed that the cache line ccl(ρ) is cached and indicates the dirty state. Also, if the node ρ is an internal node, it is assumed that the node ρ is not cw - locked with respect to the node ρ. The data cache 101 and the prefetcher of AMEE104 can call the ConWriteBack(ρ) processing when they find a cache line indicating the dirty state.

[0122] Subsequently, the processing in the lock phase of the ConWriteBack(ρ) processing will be described.

[0123] If node ρ is an internal node, AMEE 104 cw-locks node ρ with respect to node ρ. At this time, AMEE 104 does not execute the Read(ρ) operation. AMEE 104 also identifies node σ, which is the closest ancestor node to node ρ among the nodes cached in the authentication tree cache 102 or the nodes that have been assigned storage space in the authentication tree cache 102, as a new anchor.

[0124] Other processing in the lock phase of the ConWriteBack(ρ) process is similar to that in the lock phase of the ConRead(ρ) process, and therefore description thereof will be omitted.

[0125] Next, the processing in the memory phase of the ConWriteBack(ρ) processing will be described. The processing in the memory phase of the ConWriteBack(ρ) processing will be omitted because it is similar to the processing in the memory phase of the ConRead(ρ) processing.

[0126] Next, the process in the unlock phase of the ConWriteBack(ρ) process will be described with reference to Fig. 9. The process in the unlock phase of the ConWriteBack(ρ) process is similar to the process in the unlock phase of ConRead(ρ) except that the nodes from the node ρ to the child node of the anchor σ are not unlocked. If the ancestor node σ is not cached, the AMEE 104 stores the cache line ccl(σ) in the authentication tree cache 102.

[0127] The AMEE 104 executes the following process in order (ascending order) for all nodes present on the path from the node ρ to the child node of the ancestor node σ.

[0128] First, the AMEE 104 executes the WriteBack(τ) process. This increments the value of the minor counter ctr_min(τ) of the node τ by one (step S401). If the node par(τ) is an anchor, the AMEE 104 limits the update of the authentication tree cache 102 to only the counter ctr(τ) of the node par(τ). Note that counters other than the node par(τ) may have been updated by other processes. If the minor counter ctr_min(τ) of the node τ reaches “top” (YES in step S402), the AMEE 104 executes the ConCarryUp(par(τ)) process (described later) via the bypass channel (steps S403 to S406). Here, the AMEE 104 copies the cache line ccl(par(τ)) of the node par(τ) and passes it to ConWriteBack(par(ρ)). If node par(τ) is ex-locked, AMEE 104 does not release the ex-lock of node par(ρ) by the following process. Specifically, if node par(τ) is cw-locked with respect to a node, AMEE 104 cw-locks node par(τ) with respect to node par(τ). If node τ is an internal node, AMEE 104 releases the lock on cache line ccl(τ) of node τ.

[0129] Then, the AMEE 104 unlocks the cache line ccl(σ) of the ancestor node σ.

[0130] Next, the ConCarryUp(ρ) process will be described with reference to Fig. 9. This process is called only from the ConWriteBack(ρ) process and the ConPrune(ρ) process, which will be described later, via the bypass channel.

[0131] First, the process in the lock phase of ConCarryUp(ρ) will be described. If any child node of node ρ is sp-locked, that is, if another ConCarryUp(ρ) process is already running, AMEE 104 cancels this ConCarryUp(ρ). However, the locks of node ρ and cache line ccl(ρ) are inherited.

[0132] If node ρ is not a parent node of a leaf node (NO in step S403), AMEE 104 requests all nodes τ whose minor counters ctr_min(τ) are not set to "end" among the child nodes of node ρ from the authentication tree cache 102 and sp-locks them (step S404). Note that the ex-lock placed on node τ does not prevent the progress of this process and the sp-lock.

[0133] Then, the AMEE 104 receives a response from the authentication tree cache 102. This response includes the status of each node (specifically, the state of cw-locked, ex-locked, allocated, cached, etc.). The AMEE 104 also receives the storage area of ​​the cached nodes.

[0134] Next, the processing in the memory phase of the ConCarryUp(ρ) processing will be described.

[0135] If node ρ is the parent node of a leaf node (YES in step S403), AMEE 104 executes the Read(τ) process for all nodes τ among the child nodes of node ρ whose minor counters ctr_min(τ) are not set to “end” (step S405).

[0136] If the node ρ is not a parent node of a leaf node and is ex-locked (NO in step S403), the AMEE 104 executes the Read(τ) process for all non-cached nodes τ (step S405).

[0137] Furthermore, if node ρ is not a parent node of a leaf node and is not ex-locked (YES in step S403), AMEE104 executes a Read(τ) process for all nodes τ that are not cached and are not cw-locked (step S405).

[0138] Then, the AMEE 104 finally receives the requested cache line from the memory 103 .

[0139] If node ρ is not the parent of a leaf node and a previous process updates the status of node τ stored in the authentication tree cache 102, and if node ρ is not ex-locked, then AMEE 104 requests and receives all nodes τ with a similar state from the authentication tree cache 102 via the bypass channel.

[0140] Next, the process in the unlock phase of the ConCarryUp(ρ) process will be described.

[0141] The AMEE 104 executes the remaining processing of the CarryUp(ρ) processing other than setting the cached cache line to a dirty state (step S406).

[0142] Here, if the node ρ is a parent node of a leaf node, the AMEE 104 executes WriteBack(τ) for all nodes τ whose minor counters are not set to “end” among the child nodes of the node ρ.

[0143] On the other hand, when node ρ is not the parent node of a leaf node, AMEE104 executes WriteBack(τ) when the following conditions are met. Specifically, first, when node ρ is ex-locked, AMEE104 executes WriteBack(τ) when among the child nodes of node ρ, there is no node τ whose minor counter is not set to "end" and is not cached. Also, when node ρ is not ex-locked, AMEE104 executes WriteBack(τ) when among the child nodes of node ρ, there is no node τ whose minor counter is not set to "end" and is either not cached or not cw-locked. When among the child nodes of node ρ, there is a node τ whose minor counter is not set to "end" and is cached, AMEE104 determines that the node τ is in a dirty state. Thereafter, AMEE104 releases the sp-lock from note τ.

[0144] Also, when node ρ is ex-locked, AMEE104 executes WriteBack(ρ) to release the lock. Also, when node ρ is not ex-locked, AMEE104 stores the cache line ccl(ρ) of node ρ in the authentication tree cache 102 and releases the lock of node ρ.

[0145] <ConAdd(ρ) processing> Subsequently, the ConAdd(ρ) processing by AMEE104 will be described. The ConAdd(ρ) processing is the process of adding node ρ to the authentication tree during parallel processing.

[0146] Assume that node ρ is a node that does not exist (is not registered) in the authentication tree cache 102. Also, when node ρ is an internal node, assume that a storage area is allocated to node ρ in the authentication tree cache 102 and node ρ is cw-locked.

[0147] First, the process in the lock phase of the ConAdd(ρ) process will be described. The process in the lock phase of the ConAdd(ρ) process is similar to the process in the lock phase of the ConRead(ρ) process, so the description will be omitted.

[0148] Next, the processing in the memory phase of the ConAdd(ρ) processing will be described. The processing in the memory phase of the ConAdd(ρ) processing is the same as that of the ConRead(ρ) processing, except that the Read(τ) processing for a certain node τ fails.

[0149] Next, the process in the unlock phase of the ConAdd(ρ) process will be described. First, AMEE 104 identifies the add anchor φ, which is the closest ancestor node from node ρ, among the nodes that have successfully completed the Read(φ) process. Then, AMEE 104 unlocks all nodes τ that exist on the path from the parent node par(φ) of the add anchor φ to the anchor anc(ρ) of node ρ.

[0150] Then, AMEE 104 arranges the nodes τ on the path from the child node of the additional anchor φ to the node ρ in descending order. Then, AMEE 104 executes Add(τ) for all the nodes τ arranged in descending order in order. Here, if the parent node par(τ) of node τ has not been assigned a storage area in the authentication tree cache 102, AMEE 104 executes WriteBack(par(τ)) to unlock node par(τ). On the other hand, if the node par(τ) has been assigned a storage area in the authentication tree cache 102, AMEE 104 moves node par(τ) to the authentication tree cache 102 and unlocks it.

[0151] Then, if the node ρ is an internal node, the AMEE 104 moves the cache line ccl(ρ) of the node ρ to the authentication tree cache 102 and releases the lock on it, and if the node ρ is a leaf node, the AMEE 104 returns the cache line ccl(ρ) of the node ρ to the data cache 101.

[0152] <ConPrune(ρ) process> Next, the ConPrune(ρ) process by AMEE104 will be described. The ConPrune(ρ) process is the process of deleting node ρ from the authentication tree during parallel processing.

[0153] Assume that the cache line ccl(ρ) of node ρ is cached. Also, assume that when node ρ is an internal node, node ρ is not cw-locked with respect to node ρ.

[0154] First, the processing in the lock phase of the ConPrune(ρ) process will be described. The processing in the lock phase of the ConPrune(ρ) process is basically the same as the processing in the lock phase of the ConRead(ρ) process. However, when node ρ is an internal node, AMEE104 first cw-locks node ρ.

[0155] Next, the processing in the memory phase of the ConPrune(ρ) process will be described. Since the processing in the memory phase of the ConPrune(ρ) process is the same as the processing in the memory phase of the ConRead(ρ) process, the description thereof will be omitted.

[0156] Next, the process in the unlock phase of the ConPrune(ρ) process will be described. The AMEE 104 executes the following process in order (ascending order) for all nodes τ present on the path from the node ρ to the child node of the anchor anc(ρ) of the node ρ. For example, if the node τ is a leaf node, the AMEE 104 executes Prune(τ) for the node τ. If the node τ is not a leaf node and all the minor counters of the cache line ccl(τ) are set to "end", the AMEE 104 executes Prune(τ). If the node τ is not a leaf node and the node τ is not assigned a storage area in the cache, the AMEE 104 executes WriteBack(τ) to unlock the node τ. If the node τ is not a leaf node and the node τ is assigned a storage area in the cache, the AMEE 104 unlocks the node τ.

[0157] In addition, in the Prune(τ) process in the ConPrune(ρ) process, ConCarryUp(par(τ)) is called instead of CarryUp(par(τ)). If node par(τ) is ex-locked when ConCarryUp(par(τ)) is called, the AMEE 104 passes cache line ccl(par(τ)) to ConCarryUp(par(τ)) as in the ConWriteBack process. In addition, in the Prune(τ) process in the ConPrune(ρ) process, ConInvalidate(τ) is called instead of Invalidate(τ).

[0158] Next, the recursive call process of the ConPrune(ρ) process will be described. If all the minor counters of the cache line ccl(anc(ρ)) of the anchor anc(ρ) of the node ρ are set to "end", the AMEE 104 recursively executes the ConPrune(anc(ρ)) process. It is assumed that the corresponding data can be deleted from the memory 103 independently.

[0159] <ConInvalidate(ρ) Process> Next, the ConInvalidate(ρ) process will be described. Assume that the cache line ccl(ρ) of node ρ is cached and indicates the clean state. In the ConInvalidate(ρ) process, AMEE104 waits until all the locks related to node ρ are released. When all the locks are released (or when there are no locks), the Invalidate process is executed.

[0160] As described above, in the information processing apparatus 1 according to the present disclosure, AMEE104 is configured to be able to wait for the update process of the value of the major counter that occurs along with the update process of the value of the minor counter with respect to the major counter and the minor counter assigned to each node. Thereby, the information processing apparatus 1 can accurately perform the parallel processing of the authentication process using the authentication tree. That is, the information processing apparatus 1 can improve the confidentiality while improving the processing performance by parallel processing.

[0161] Note that part or all of the processing of the information processing apparatus 1 can be realized by causing a CPU to execute a computer program.

[0162] Specifically, the above-mentioned program includes a set of instructions (or software code) for making the computer perform one or more functions described in the embodiment when the program is loaded into the computer. The program may be stored in a non-transitory computer-readable medium or a tangible storage medium. By way of example and not limitation, the computer-readable medium or tangible storage medium includes a random-access memory (RAM), a read-only memory (ROM), a flash memory, a solid-state drive (SSD) or other memory technology. Also, by way of example and not limitation, the computer-readable medium or tangible storage medium includes a CD-ROM, a digital versatile disc (DVD), a Blu-ray (registered trademark) disc or other optical disk storage. Also, by way of example and not limitation, the computer-readable medium or tangible storage medium includes a magnetic cassette, a magnetic tape, a magnetic disk storage or other magnetic storage device. The program may be transmitted on a transitory computer-readable medium or a communication medium. By way of example and not limitation, the transitory computer-readable medium or the communication medium includes an electrical, optical, acoustic, or other form of propagating signal.

[0163] Although the present disclosure has been described above with reference to the embodiments, the present disclosure is not limited to the above-mentioned embodiments. Various modifications that can be understood by a person skilled in the art can be made to the configuration and details of the present disclosure within the scope of the present disclosure. Furthermore, each embodiment can be appropriately combined with other embodiments.

[0164] Each drawing is merely an example for describing one or more embodiments. Each drawing may relate not only to one particular embodiment, but to one or more other embodiments. As can be understood by those skilled in the art, various features or steps described with reference to any one drawing may be combined with features or steps shown in one or more other drawings to create an embodiment not explicitly shown or described, for example. Not all features or steps shown in any one drawing are necessary to describe an exemplary embodiment, and some features or steps may be omitted. The order of steps described in any drawing may be changed as appropriate.

[0165] Furthermore, some or all of the above-described embodiments can be described as, but are not limited to, the following supplementary notes.

[0166] (Appendix 1) Memory, an authentication tree cache in which a part of the counters and the identifiers included in an authentication tree consisting of a plurality of nodes connected in a tree shape, each of which is assigned a pair of a counter and an identifier, and a tag generated using the counters and the identifiers included in the authentication tree are temporarily stored; a data cache in which a part of data assigned to each of a plurality of leaf nodes, which are nodes in the lowest layer among the plurality of nodes constituting the authentication tree, is temporarily stored; an authenticated memory encryption engine that performs encryption processing and authentication processing using the authentication tree on data exchanged between the data cache and the memory, and also performs authentication processing on tags generated at one or more nodes on a path from a leaf node to which the data is assigned to a root node; Equipped with A counter assigned to each node of the authentication tree is composed of a major counter whose value is represented by higher bits of a plurality of bits representing the value of the counter, and a minor counter whose value is represented by lower bits, and the major counter is shared by a plurality of nodes having a common parent node; the authenticated memory cryptographic engine is configured to wait for an update process of a major counter value that occurs in conjunction with an update process of a minor counter value, with respect to a major counter and a minor counter assigned to each of the nodes; Information processing device.

[0167] (Appendix 2) when updating a value of the major counter shared by a plurality of nodes having a common parent node, the authenticated memory cryptographic engine initializes values ​​of minor counters of each of the plurality of nodes having the common parent node. 2. An information processing device according to claim 1.

[0168] (Appendix 3) the authenticated memory cryptographic engine is configured to be able to update a value of the major counter shared by a plurality of nodes having a common parent node without updating a value of each of the minor counters of the plurality of nodes having the common parent node. 2. An information processing device according to claim 1.

[0169] (Appendix 4) The authenticated memory encryption engine includes: When a first access is used to update a first node among a plurality of nodes constituting the authentication tree, all nodes on a path from the first node to the root node, including a first node whose cache line is stored in the authentication tree cache, are locked, and then the locked node is updated; and when updating a second node among the multiple nodes constituting the authentication tree by a second access following the first access, if a third node that has already been locked by the first access is present among the nodes on the path from the second node to the root node, locking all nodes on the path from the second node to the node immediately preceding the third node, and after all nodes locked by the first access are unlocked, locking the remaining nodes on the path from the third node to the first node whose cache line is stored in the authentication tree cache among the nodes on the path from the third node to the root node, and then updating the locked node. 2. An information processing device according to claim 1.

[0170] (Appendix 5) the authenticated memory cryptographic engine is configured to perform an update process of the major counter value, which occurs in association with an update process of the minor counter value in a child node of the third node due to the first access, after updating the node locked by the second access. 5. The information processing device according to claim 4.

[0171] (Appendix 6) the authenticated memory cryptographic engine is configured to not accept additional processing for a child node of the third node locked by the second access before updating a value of a major counter of the child node. 5. The information processing device according to claim 4.

[0172] (Appendix 7) The authenticated memory encryption engine includes: When deleting any one of the plurality of nodes constituting the authentication tree, a value of a major counter assigned to a parent node of the node to be deleted is updated based on a value of a major counter assigned to a parent node of the node to be deleted, and When adding a new node to the authentication tree at the same position as the deleted node, a value of a major counter assigned to the added node is set based on a major counter assigned to a parent node of the added node. 2. An information processing device according to claim 1.

[0173] (Appendix 8) The authenticated memory encryption engine includes: When deleting any one of the plurality of nodes constituting the authentication tree, a major counter value assigned to a parent node of the node to be deleted is updated to a value larger than the larger of the major counter value assigned to the parent node of the node to be deleted and the major counter value assigned to the node to be deleted, and When adding a new node to the authentication tree at the same position as the deleted node, a value of a major counter assigned to the added node is set to be equal to or greater than a value of a major counter assigned to a parent node of the added node. 8. The information processing device according to claim 7.

[0174] (Appendix 9) Memory, an authentication tree cache in which a part of the counters and the identifiers included in an authentication tree consisting of a plurality of nodes connected in a tree shape, each of which is assigned a pair of a counter and an identifier, and a tag generated using the counters and the identifiers included in the authentication tree are temporarily stored; a data cache in which a part of data assigned to each of a plurality of leaf nodes, which are nodes in the lowest layer among the plurality of nodes constituting the authentication tree, is temporarily stored; an authenticated memory encryption engine that performs encryption processing and authentication processing using the authentication tree on data exchanged between the data cache and the memory, and also performs authentication processing on tags generated at one or more nodes on a path from a leaf node to which the data is assigned to a root node; Equipped with A counter assigned to each node of the authentication tree is composed of a major counter whose value is represented by higher bits of a plurality of bits representing the value of the counter, and a minor counter whose value is represented by lower bits, and the major counter is shared by a plurality of nodes having a common parent node. A method for controlling an information processing device, comprising: With respect to the major counter and the minor counter assigned to each of the nodes, a process of updating the value of the major counter, which process occurs in conjunction with a process of updating the value of the minor counter, is suspended; updating the values ​​of minor counters assigned to other nodes having a common parent node with the node to which the minor counter is assigned; performing an update process for the value of the major counter; A method for controlling an information processing device.

[0175] (Appendix 10) Memory, an authentication tree cache in which a part of the counters and the identifiers included in an authentication tree consisting of a plurality of nodes connected in a tree shape, each of which is assigned a pair of a counter and an identifier, and a tag generated using the counters and the identifiers included in the authentication tree are temporarily stored; a data cache in which a part of data assigned to each of a plurality of leaf nodes, which are nodes in the lowest layer among the plurality of nodes constituting the authentication tree, is temporarily stored; an authenticated memory encryption engine that performs encryption processing and authentication processing using the authentication tree on data exchanged between the data cache and the memory, and also performs authentication processing on tags generated at one or more nodes on a path from a leaf node to which the data is assigned to a root node; Equipped with A counter assigned to each node of the authentication tree is composed of a major counter whose value is represented by higher bits of a plurality of bits representing the value of the counter, and a minor counter whose value is represented by lower bits, and the major counter is shared by a plurality of nodes having a common parent node. A control program for causing a computer to execute a control process in an information processing device, a process of putting on hold an update process of a major counter value, which occurs in conjunction with an update process of a minor counter value, for a major counter and a minor counter assigned to each of the nodes; updating the values ​​of minor counters assigned to other nodes having a common parent node with the node to which the minor counter is assigned; updating the value of the major counter; A control program that causes a computer to execute the above.

[0176] Some or all of the elements (e.g., configurations and functions) described in Supplementary Notes 2 to 8 that are dependent on Supplementary Note 1 may also be dependent on Supplementary Notes 9 and 10 in the same dependent relationship as Supplementary Notes 2 to 8. Some or all of the elements described in any Supplementary Note may be applied to various hardware, software, recording means for recording software, systems, and methods. [Explanation of symbols]

[0177] 1. Information processing device 100 Cash 101 Data Cache 102 Authentication Tree Cache 103 Memory 104 Authenticated Memory Encryption Engine (AMEE) 301 Leaf Nodes 302 Plaintext Data 303 Ciphertext 304 Address 305 Counter 306 Tags 307 Cache Lines 311 Intermediate Nodes 312 Identifier 313 Counter 314 Counter 315 Tags 321 Root Node 322 Identifier 323 Route Counter 324 Counter 325 Tags 330 keys

Claims

1. Memory, an authentication tree cache in which a part of the counters and the identifiers included in an authentication tree consisting of a plurality of nodes connected in a tree shape, each of which is assigned a pair of a counter and an identifier, and a tag generated using the counters and the identifiers included in the authentication tree are temporarily stored; a data cache in which a part of data assigned to each of a plurality of leaf nodes, which are nodes in the lowest layer among the plurality of nodes constituting the authentication tree, is temporarily stored; an authenticated memory encryption engine that performs encryption processing and authentication processing using the authentication tree on data exchanged between the data cache and the memory, and also performs authentication processing on tags generated at one or more nodes on a path from a leaf node to which the data is assigned to a root node; Equipped with A counter assigned to each node of the authentication tree is composed of a major counter whose value is represented by higher bits of a plurality of bits representing the value of the counter, and a minor counter whose value is represented by lower bits, and the major counter is shared by a plurality of nodes having a common parent node; the authenticated memory encryption engine is configured to wait for an update process of a major counter value that occurs in conjunction with an update process of a minor counter value, with respect to a major counter and a minor counter assigned to each of the nodes; Information processing device.

2. when updating a value of the major counter shared by a plurality of nodes having a common parent node, the authenticated memory cryptographic engine initializes values ​​of minor counters of each of the plurality of nodes having the common parent node. The information processing device according to claim 1 .

3. the authenticated memory cryptographic engine is configured to be able to update a value of the major counter shared by a plurality of nodes having a common parent node without updating a value of each of the minor counters of the plurality of nodes having the common parent node. The information processing device according to claim 1 .

4. The authenticated memory encryption engine includes: When a first node among a plurality of nodes constituting the authentication tree is updated by a first access, all nodes on a path from the first node to a first node whose cache line is stored in the authentication tree cache among the nodes on the path from the first node to the root node are locked, and then the locked node is updated; when updating a second node among the multiple nodes constituting the authentication tree by a second access following the first access, if a third node that has already been locked by the first access is present among the nodes on the path from the second node to the root node, all nodes on the path from the second node to the node immediately preceding the third node are locked, and after all nodes locked by the first access are unlocked, the remaining nodes on the path from the third node to the first node whose cache line is stored in the authentication tree cache among the nodes on the path from the third node to the root node are locked, and then the locked node is updated. The information processing device according to claim 1 .

5. the authenticated memory cryptographic engine is configured to perform an update process of the major counter value, which occurs in association with an update process of the minor counter value in a child node of the third node due to the first access, after updating the node locked by the second access. The information processing device according to claim 4.

6. the authenticated memory cryptographic engine is configured not to accept any additional processing for a child node of the third node locked by the second access before an update processing of a value of a major counter of the child node. The information processing device according to claim 4.

7. The authenticated memory encryption engine includes: When deleting any one of the plurality of nodes constituting the authentication tree, a value of a major counter assigned to a parent node of the node to be deleted is updated based on a value of a major counter assigned to a parent node of the node to be deleted, and When adding a new node to the authentication tree at the same position as the deleted node, a value of a major counter assigned to the added node is set based on a major counter assigned to a parent node of the added node. The information processing device according to claim 1 .

8. The authenticated memory encryption engine includes: When deleting any one of the plurality of nodes constituting the authentication tree, a major counter value assigned to a parent node of the node to be deleted is updated to a value larger than the larger of the major counter value assigned to the parent node of the node to be deleted and the major counter value assigned to the node to be deleted, and When adding a new node to the authentication tree at the same position as the deleted node, a value of a major counter assigned to the added node is set to be equal to or greater than a value of a major counter assigned to a parent node of the added node. The information processing device according to claim 7.

9. Memory, an authentication tree cache in which a part of the counters and the identifiers included in an authentication tree consisting of a plurality of nodes connected in a tree shape, each of which is assigned a pair of a counter and an identifier, and a tag generated using the counters and the identifiers included in the authentication tree are temporarily stored; a data cache in which a part of data assigned to each of a plurality of leaf nodes, which are nodes in the lowest layer among the plurality of nodes constituting the authentication tree, is temporarily stored; an authenticated memory encryption engine that performs encryption processing and authentication processing using the authentication tree on data exchanged between the data cache and the memory, and also performs authentication processing on tags generated at one or more nodes on a path from a leaf node to which the data is assigned to a root node; Equipped with A counter assigned to each node of the authentication tree is composed of a major counter whose value is represented by higher bits of a plurality of bits representing the value of the counter, and a minor counter whose value is represented by lower bits, and the major counter is shared by a plurality of nodes having a common parent node. A method for controlling an information processing device, comprising: With respect to the major counter and the minor counter assigned to each of the nodes, a process of updating the value of the major counter, which process occurs in conjunction with a process of updating the value of the minor counter, is suspended; updating the values ​​of minor counters assigned to other nodes having a common parent node with the node to which the minor counter is assigned; performing an update process for the value of the major counter; A method for controlling an information processing device.

10. Memory, an authentication tree cache in which a part of the counters and the identifiers included in an authentication tree consisting of a plurality of nodes connected in a tree shape, each of which is assigned a pair of a counter and an identifier, and a tag generated using the counters and the identifiers included in the authentication tree are temporarily stored; a data cache in which a part of data assigned to each of a plurality of leaf nodes, which are nodes in the lowest layer among the plurality of nodes constituting the authentication tree, is temporarily stored; an authenticated memory encryption engine that performs encryption processing and authentication processing using the authentication tree on data exchanged between the data cache and the memory, and also performs authentication processing on tags generated at one or more nodes on a path from a leaf node to which the data is assigned to a root node; Equipped with A counter assigned to each node of the authentication tree is composed of a major counter whose value is represented by higher bits of a plurality of bits representing the value of the counter, and a minor counter whose value is represented by lower bits, and the major counter is shared by a plurality of nodes having a common parent node. A control program for causing a computer to execute a control process in an information processing device, a process of putting on hold an update process of a major counter value, which occurs in conjunction with an update process of a minor counter value, for a major counter and a minor counter assigned to each of the nodes; updating the values ​​of minor counters assigned to other nodes having a common parent node with the node to which the minor counter is assigned; updating the value of the major counter; A control program that causes a computer to execute the above.

Images