Processor Cache Partitioning for Secure Cryptoprocessor Execution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Software-based cryptoprocessor systems face performance degradation due to limited cache space, leading to significant overhead from encrypted paging between the small trusted cache and large untrusted main memory, especially in cloud-computing environments where physical control over hardware is lacking.
Innovation Solution
Employing cache-partitioning techniques and secure processor enclaves to create a large, secure backing store, preventing cache evictions of non-enclave lines and ensuring confidentiality and integrity through hardware-enforced encryption and integrity checks, thereby enhancing performance and security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is stored in the processor cache for secure execution, then security is improved, but the limited cache space causes performance degradation due to frequent paging
Solution Approach 1:
The patent divides the cache into multiple partitions, with dedicated secure cache partitions for encrypted data and non-secure partitions for other operations. This segmentation allows secure data to occupy guaranteed cache space without being evicted by non-secure operations, resolving the conflict between security requirements and performance by preventing paging for secure data while maintaining overall system productivity.
2Productivity
If the cache size is increased to improve performance, then execution speed is improved, but the cost and complexity of the system increases
Solution Approach 1:
Instead of uniformly increasing the entire cache size, the patent applies local quality by creating specific secure cache partitions with enhanced security properties within the existing cache structure. This allows performance improvement for secure operations without proportionally increasing overall system complexity or cost, as only specific partitioned regions receive the security treatment.
3Reliability
If cryptographic operations are performed during data transfer between cache and memory, then security is improved, but the overhead increases and performance decreases
Solution Approach 1:
The patent performs cryptographic operations in advance by encrypting data before it is written to secure cache partitions and decrypting it before access. This preliminary action eliminates the need for repeated cryptographic operations during each data transfer between cache and memory, maintaining security while significantly reducing the time overhead associated with cryptographic processing.
Data Source
AI summary
A processor cache is logically partitioned into a main partition, located in the cache itself, and an enclave partition, located within an enclave, that is, a hardware-enforced protected region of an address space of a memory. This extends the secure address space usable by and for an application such as a software cryptoprocessor that is to execute only in secure regions of cache or memory.