CPU Crypto Envelope with Selective Address Bus Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security measures for Central Processing Units (CPUs) are inadequate as they can be vulnerable to reverse engineering due to exposed signal interfaces, and existing cryptographic solutions degrade system performance by increasing memory access latency and cache operations.
Innovation Solution
A cryptographic unit is integrated between the processing core and external DRAM, encrypting the N-M significant bits of address lines and data bus lines, while leaving the M least significant bits unencrypted to maintain burst access efficiency, thereby enhancing security without degrading performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a cryptographic unit is placed between the processing core and external memory to encrypt data, then security is improved, but system performance degrades due to increased memory access latency
Solution Approach 1:
The address bus is segmented into two parts: encrypted and unencrypted. The cryptographic unit encrypts only the necessary portion of the address (N-M significant bits) while leaving other portions unencrypted, allowing selective application of encryption to balance security and performance
Solution Approach 2:
Different parts of the address bus are treated differently - some bits are encrypted while others are not. This local differentiation allows the system to maintain security for critical address information while preserving fast access paths for other address components, thereby reducing overall latency
2Reliability
If cryptographic encryption is applied to all address lines, then security is improved, but the number of page open/close operations in DRAM increases excessively, making the system unusable
Solution Approach 1:
The address bus is divided into encrypted and unencrypted segments, allowing the system to maintain security while preserving DRAM burst access patterns by leaving certain address bits unencrypted
Solution Approach 2:
The encryption is applied selectively to specific parameters (N-M significant bits of the address) rather than all address lines, changing the encryption scope parameter to optimize both security and memory access efficiency
Data Source
AI summary
In one embodiment, a Central Processing Unit having a processing core. The processing core connects to an internal memory bus having N address lines and X data lines. A cache connects to the internal memory bus and uses M of N bits of the N address lines to address data stored in the cache. A cryptographic unit in the CPU encrypts data written to an external memory and decrypts data read from the external memory. The cryptographic unit encrypts and decrypts N-M address lines of the internal memory bus and the data lines of the bus.