Cache Memory Realm Identifier Encryption Key Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Software stored in electronic devices is vulnerable to unauthorized access and reverse engineering, leading to intellectual property loss, as existing secure software execution methods are inadequate in protecting software from hackers.
Innovation Solution
A method utilizing a cache memory device that employs ephemeral encryption keys to manage memory transactions, where a realm identifier and realm indicator bit are used to control access, ensuring that only authorized access to specific memory regions is allowed, and data is encrypted and decrypted accordingly.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If software is stored in memory devices for execution, then software functionality is enabled, but software becomes vulnerable to unauthorized access and reverse engineering
Solution Approach 1:
The patent divides the memory space into distinct realms, each protected by unique ephemeral encryption keys. Software modules are assigned to specific realms, and access control is implemented at the realm level rather than requiring full memory protection, enabling selective access while maintaining software execution capability.
Solution Approach 2:
The system performs preliminary encryption of software modules before they are loaded into memory, and establishes realm boundaries and access control policies in advance. Ephemeral encryption keys are generated and associated with specific realms before software execution begins, preventing unauthorized access from the outset while allowing legitimate execution.
2Reliability
If encryption is applied to protect software in memory, then security is improved, but access control complexity increases
Solution Approach 1:
The patent employs dynamic ephemeral encryption keys that are generated temporarily for each realm and automatically invalidated when the realm is destroyed or the software module is removed. This dynamic key management provides strong security while simplifying access control, as the system only needs to manage key generation and invalidation rather than complex permission checks for every access request.
Solution Approach 2:
The system uses ephemeral encryption keys that are created temporarily and discarded after use, rather than managing long-term complex key hierarchies. Each realm receives a unique ephemeral key for its duration, providing security without requiring sophisticated key management infrastructure. The keys are inexpensive to generate and automatically expire, reducing overall system complexity.
3Productivity
If cache memory is used to speed up software execution, then processing speed is improved, but cached data becomes vulnerable to extraction and analysis
Solution Approach 1:
The patent applies different security characteristics to different cache regions based on their realm assignments. Each cache line is tagged with realm identifier information, and access to cached data is controlled based on the requesting thread's realm permissions. This allows high-speed cache access for authorized operations while preventing unauthorized extraction of intellectual property from cached software modules.
Solution Approach 2:
The system introduces realm identifiers and access control mechanisms as intermediaries between the cache memory and processing units. When software modules are cached, they are associated with realm identifiers that mediate access requests. The cache controller verifies realm permissions before allowing data access, enabling fast cache operation while blocking attempts to extract protected intellectual property.
4Reliability
If software modules are isolated using encryption keys, then security is improved, but key management complexity increases
Solution Approach 1:
The patent implements automatic key discarding when software modules are removed from memory or when realms are destroyed. Ephemeral encryption keys are generated when needed and automatically discarded afterward, eliminating the need for complex key storage and management infrastructure. The system recovers security by ensuring keys are completely invalidated, while simplifying management through automatic lifecycle handling.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
In an aspect, a cache memory device receives a request to read an instruction or data associated with a memory device. The request includes a first realm identifier and a realm indicator bit, where the first realm identifier enables identification of a realm that includes one or more selected regions in the memory device. The cache memory device determines whether the first realm identifier matches a second realm identifier in a cache tag when the instruction or data is stored in the cache memory device, where the instruction or data stored in the cache memory device has been decrypted based on an ephemeral encryption key associated with the second realm identifier when the first realm identifier indicates the realm and when the realm indicator bit is enabled. The cache memory device transmits the instruction or data when the first realm identifier matches the second realm identifier.