Cryptographic Address Prefetch Circuitry to Prevent Cache Data Leaks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing prefetch circuits in computing systems are vulnerable to data leaks due to mistaking secret data for memory addresses, allowing attackers to unauthorized access and observe secret data by monitoring cache locations affected by mistakenly prefetched memory lines.
Innovation Solution
Implementing a cryptographic address prefetch circuit that encrypts memory addresses with a secret key, decrypting presumed memory addresses to hide original data content from attackers, thereby preventing data leaks while maintaining high performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a prefetch circuit attempts to access memory locations by using data values as addresses, then prefetching performance is improved, but data leaks occur when secret data is mistakenly accessed
Solution Approach 1:
The patent introduces an intermediary layer (the cryptographic address transformation mechanism) between the prefetch circuit and memory access. This intermediary transforms data values into encrypted addresses, allowing the prefetch circuit to treat all memory locations uniformly as addresses while preventing direct access to secret data. The cryptographic transformation acts as a mediator that enables prefetching functionality while blocking the harmful data leak path.
Solution Approach 2:
The patent extracts the harmful capability of directly using data values as addresses from the prefetch circuit. By separating this function and replacing it with cryptographic address transformation, the system removes the vulnerable pathway that allows data leaks while preserving the beneficial prefetching behavior through the transformed address space.
2Reliability
If cryptographic address transformation is applied to prevent data leaks, then security is improved, but device complexity increases
Solution Approach 1:
The patent makes the cryptographic address transformation mechanism universal by applying it to all memory access operations regardless of whether the address is legitimately encrypted or represents actual data. This multi-functional approach allows the same transformation logic to serve both security purposes (preventing data leaks) and performance purposes (enabling prefetching), thereby reducing overall system complexity despite the added cryptographic functionality.
Solution Approach 2:
The patent merges the cryptographic transformation function with the existing address generation and prefetching logic. Instead of adding a separate, independent security module, the cryptographic address transformation is integrated into the address processing pipeline, combining multiple functions (address validation, encryption, prefetching) into a unified mechanism that reduces structural complexity.
Data Source
AI summary
Prefetch (e.g., prefetcher) circuits and methods that allow the safe prefetch of any speculative memory references using cryptographic addressing are described. In certain examples, a computing system includes a memory; a register to store a cryptographic address prefetch key; a core to generate a memory access request for the memory; a cache; and a prefetch circuit to: generate a speculative memory access request for an encrypted memory address based at least in part on the memory access request, decrypt the encrypted memory address to determine a memory line stored at the memory address decrypted by the cryptographic address prefetch key to generate a plaintext address, and store a memory line referenced by the plaintext address in the cache.