Cache Partitioning for Memory Encryption Engine Performance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current hardware-based data security solutions for computing devices introduce additional processing overhead, leading to slower performance due to their low-level operation and inability to effectively combat higher-privileged malware, while software-based solutions are insufficient against such threats.
Innovation Solution
Implementing a device with a memory encryption engine (MEE) that partitions its cache to separate version and MAC data from counter data, allowing for efficient memory protection by reducing the need to load security metadata from memory and improving data processing performance through counter-mode encryption and tree walk authentication mechanisms.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If hardware-based protective solutions are implemented early during boot-up, then memory protection against malware is improved, but processing overhead increases and overall performance decreases
Solution Approach 1:
The cache is divided into multiple partitions, with specific partitions dedicated to storing security metadata (MAC data, version data) and other partitions for counter data. This segmentation allows the system to efficiently retrieve only the necessary metadata for authentication without processing entire cache contents, thereby maintaining protection while reducing overhead.
Solution Approach 2:
Security metadata including MAC data and version data are pre-loaded into dedicated cache partitions during early boot-up or before data access operations. This preliminary action ensures that authentication data is readily available in fast cache memory rather than requiring repeated accesses to slower memory, improving both protection speed and overall performance.
2Reliability
If security metadata is stored in memory for encryption and decryption operations, then data security is improved, but bandwidth overhead increases due to repeated loading from memory
Solution Approach 1:
The cache is segmented into dedicated partitions for security metadata (MAC data, version data) and counter data. This segmentation ensures that security metadata is cached separately and can be efficiently retrieved without accessing counter data, reducing the bandwidth required for loading and processing security information during encryption and decryption operations.
Solution Approach 2:
Security metadata is pre-loaded into dedicated cache partitions before encryption or decryption operations begin. This preliminary caching action eliminates the need for repeated memory accesses during data processing, significantly reducing bandwidth overhead while maintaining data security through authenticated encryption modes.
3Productivity
If cache is used to store security metadata for fast access, then data processing speed is improved, but cache complexity increases
Solution Approach 1:
The cache is divided into distinct partitions with specific functions: partitions for MAC data, partitions for version data, and partitions for counter data. This segmentation provides a clear organizational structure that simplifies cache management and access logic compared to a monolithic cache, while enabling fast access to security metadata for improved data processing speed.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
This disclosure is directed to cache and data organization for memory protection. Memory protection operations in a device may be expedited by organizing cache and/or data structure while providing memory protection for encrypted data. An example device may comprise processing module and a memory module. The processing module may include a memory encryption engine (MEE) to decrypt encrypted data loaded from the memory module, or to encrypt plaintext data prior to storage in the memory module, using security metadata also stored in the memory module. Example security metadata may include version (VER) data, memory authentication code (MAC) data and counter data. Consistent with the present disclosure, a cache associated with the MEE may be partitioned to separate the VER and MAC data from counter data. Data organization may comprise including the VER and MAC data corresponding to particular data in the same data line.