Cryptographically Authenticated Address Bus for Replay Attack Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current memory protection technologies, such as multikey encryption and multikey with integrity, leave the memory address bus unprotected, making systems vulnerable to hardware replay attacks and access pattern monitoring.
Innovation Solution
The implementation of a cryptographically authenticated address bus (CAAB) using an intelligent memory design, which encrypts and integrity-protects memory addresses with authenticated counter mode encryption, and optionally deploys randomized replay trees (RR-Trees) to detect hardware replay attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If memory address bus is left unprotected to maintain system simplicity, then device complexity is reduced, but security against hardware replay attacks and access pattern monitoring deteriorates
Solution Approach 1:
The patent segments the memory protection system into two distinct parts: data bus protection (using existing multikey encryption) and address bus protection (using new authenticated address bus mechanisms). This segmentation allows each component to be optimized independently, with the address bus protection handling security while maintaining relative system simplicity.
Solution Approach 2:
The patent introduces an intermediary authenticated address bus layer between the processor and memory that adds security without requiring complete system redesign. This intermediary structure verifies address authenticity and prevents replay attacks while maintaining compatibility with existing memory architectures.
2Reliability
If authenticated counter mode encryption is implemented on address bus to prevent attacks, then security against hardware replay attacks is improved, but device complexity increases
Solution Approach 1:
The patent implements preliminary authentication of address bus transactions using authenticated counter mode encryption before memory access occurs. By verifying address authenticity in advance, the system prevents replay attacks without requiring complex post-access verification mechanisms.
Solution Approach 2:
The patent changes the parameter of address bus transmission from plain text to encrypted/authenticated format using counter mode encryption. This parameter change provides strong security guarantees while using well-established cryptographic primitives that can be implemented efficiently in hardware.
3Reliability
If randomized replay trees are deployed to detect hardware replay attacks, then security monitoring capability is improved, but performance overhead increases
Solution Approach 1:
The patent implements randomized replay trees that perform partial verification of memory accesses rather than full verification of every transaction. By randomly sampling and verifying only certain accesses, the system detects replay attacks with high probability while minimizing performance overhead compared to verifying every single access.
Data Source
AI summary
Detailed herein are embodiments utilizing a cryptographically authenticated address bus (CAAB) protection that uses an intelligent memory design to prevent attacks on the address bus without detection and eliminate the memory bus as an observability surface for an attacker to do access pattern analysis. Embodiments detailed herein describe an intelligent memory module which has cryptographic capabilities. In some embodiments, a memory controller and an intelligent memory module exchange a key and using this key, the address (on the address bus) is encrypted and integrity protected using authenticated counter mode encryption. The memory controller on receiving a read or a write request encrypts the address (e.g., using pre-generated encrypted counters to minimize cryptographic overheads). A message authentication code (MAC) also gets generated along with the encrypted address to be able to detect modification to the encrypted address.