Cacheline Access Control Encoding for Single-Key Memory Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing encryption systems for secure memory, such as Total Memory Encryption (TME) and Secure Memory Encryption (SME), face scalability issues with multi-key encryption for domain separation, requiring large numbers of keys and KeyIDs to be stored near the memory controller, leading to increased latency and reduced performance.
Innovation Solution
Implementing a single-key memory encryption engine with lightweight access control encoding upstream in the processor pipeline, which encodes cachelines to indicate shared values and uses domain-specific masking to ensure data integrity, eliminating the need for large keys and KeyIDs in the memory controller.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multi-key encryption is implemented for domain separation, then security is improved, but device complexity and key management overhead increase significantly
Solution Approach 1:
The patent segments the encryption system into two parts: a simplified single-key encryption engine in the memory controller and an access control encoding mechanism in the processor pipeline. This segmentation allows the memory controller to remain simple while domain separation functionality is achieved through the upstream encoding of cachelines with domain identifiers and masking bits.
Solution Approach 2:
The patent introduces an intermediary access control structure that includes domain identifiers and masking bits encoded in cachelines. This intermediary mechanism mediates between the single-key encryption engine and the multi-domain access control requirements, enabling domain separation without requiring multiple encryption keys in the memory controller.
2Adaptability or versatility
If large numbers of keys are stored near the memory controller, then multi-domain encryption capability is provided, but memory latency increases
Solution Approach 1:
The patent extracts the access control encoding functionality from the memory controller and places it in the processor pipeline upstream. This extraction eliminates the need for the memory controller to store and manage large numbers of keys, thereby reducing memory latency while preserving multi-domain encryption capability through the upstream encoding mechanism.
3Reliability
If multi-key encryption is used for domain separation, then access control is improved, but cache flush operations increase reducing performance
Solution Approach 1:
The patent performs preliminary encoding of domain identifiers and masking bits in cachelines upstream in the processor pipeline before memory operations. This preliminary action enables the system to maintain strong access control while avoiding the need for frequent cache flushes, as the encoding is already in place when data is written to or read from memory.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Techniques for masking and access control are described. In some examples, masking and access control circuitry to provide at least per-domain masking, and access control compression, of cache lines to be stored to memory in response to a store instruction and decompression of cache lines loaded from memory for compressible cache lines, wherein a cache line is to be compressed by encoding a pair of matching values in the cache line and storing the encoded pair as a value in the cache line.