Cache Optimization With Shared CPU Cryptography for Direct IO Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems enabling direct cache access for external devices face inefficiencies due to the need for separate cryptographic engines per IO port, which limits confidentiality to point-to-point links and increases power and space requirements, while existing CPU cryptographic engines are not utilized for IO operations.
Innovation Solution
Implementing a cryptographic engine configured to operate in a direct cache access mode, which determines the destination of data transactions and bypasses memory writes when necessary, enabling direct data transfer to CPU cache or IO, and using message type identifiers to manage data delivery.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If separate cryptographic engines are implemented per IO port to enable direct cache access, then data confidentiality is improved, but power consumption and device space requirements increase
Solution Approach 1:
The patent makes the CPU cryptographic engine universal by enabling it to handle both traditional memory encryption/decryption operations and direct cache access operations. Instead of having dedicated cryptographic engines for each IO port, the single CPU cryptographic engine is configured to service multiple IO ports and handle encryption/decryption for both memory and direct cache access paths, thereby reducing overall power consumption while maintaining data confidentiality.
2Reliability
If separate cryptographic engines are implemented per IO port to enable direct cache access, then data confidentiality is improved, but device space requirements increase
Solution Approach 1:
The CPU cryptographic engine is designed to perform multiple functions: it handles encryption and decryption for traditional memory access paths as well as for direct cache access paths from multiple IO ports. This multi-functional design eliminates the need for separate cryptographic engines at each IO port, thereby reducing the overall device space required while maintaining security.
Solution Approach 2:
The patent merges the functions of multiple separate cryptographic engines (one per IO port) into a single shared CPU cryptographic engine. By combining these redundant cryptographic functions into one centralized resource, the device space required for cryptographic operations is significantly reduced while the security functionality is preserved across all IO ports.
3Reliability
If traditional memory access path is used with cryptographic operations, then data confidentiality is maintained, but performance deteriorates due to multiple encryption/decryption operations
Solution Approach 1:
The patent segments the data access path into two distinct modes: traditional memory access path and direct cache access path. For time-critical or performance-sensitive operations, data can be transferred directly to cache with fewer cryptographic operations, while less time-sensitive data can use the traditional memory path. This segmentation allows the system to optimize performance for critical paths without compromising the security of less critical paths.
Solution Approach 2:
For direct cache access operations, the patent enables the data to skip the intermediate memory storage step and go directly from the IO port to the CPU cache. This skipping of the memory write/read cycle reduces the number of cryptographic operations required (from up to ten down to eight), thereby improving performance for time-critical data transfers while maintaining security through the CPU cryptographic engine.
Data Source
AI summary
An apparatus includes a central processing unit (CPU), including a plurality of processing cores, each having a cache memory, a fabric interconnect coupled to the plurality of processing cores and cryptographic circuitry, coupled to the fabric interconnect including mesh stop station to receive memory data and determine a destination of the memory data and encryption circuitry to encrypt/decrypt the memory data based on a destination of the memory data.