Cryptographic Pointer Encoding for Stack Memory Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current computing techniques face challenges in providing fine-grained memory protection and efficient data encryption, leading to performance overheads and increased costs due to the need for additional metadata and storage, especially in scenarios like Function as a Service (FaaS) workloads and object bounds information.
Innovation Solution
The implementation of cryptographic computing, which involves encoding pointers with metadata and using cryptographic addressing layers to enforce bounds and provide access control, reducing the need for separate metadata storage and improving performance by leveraging secret keys and ciphers for fine-grained access control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic mechanisms are used to encrypt data and pointers, then security is improved, but performance overhead increases due to additional computational requirements
Solution Approach 1:
The patent combines cryptographic operations with existing memory management operations by integrating the cryptographic engine within the memory controller. Encryption and decryption are merged with memory read/write operations, allowing security operations to occur in parallel with data access without requiring separate processing steps, thereby reducing performance overhead.
Solution Approach 2:
The memory controller performs cryptographic operations autonomously without requiring intervention from the CPU or other processing units. The cryptographic engine within the memory controller self-manages encryption and decryption of data and pointers during memory operations, eliminating the need for additional computational resources and reducing performance impact.
2Reliability
If separate metadata storage is used for memory protection, then access control is improved, but device complexity and storage costs increase
Solution Approach 1:
The patent merges protection metadata directly with the data being protected by encrypting both the data and its associated pointers using the same cryptographic mechanisms. This eliminates the need for separate metadata storage structures, as the cryptographic bindings themselves serve as the protection metadata, thereby reducing device complexity and storage requirements.
Solution Approach 2:
The cryptographic mechanisms serve multiple functions simultaneously: they provide data confidentiality through encryption, enable access control through cryptographic bindings, and provide integrity verification. This multi-functionality eliminates the need for separate dedicated metadata structures for each protection function, reducing overall system complexity.
Data Source
AI summary
A processor includes a register to store an encoded pointer to a variable in stack memory. The encoded pointer includes an encrypted portion and a fixed plaintext portion of a memory address corresponding to the variable. The processor further includes circuitry to, in response to a memory access request for associated with the variable, decrypt the encrypted portion of the encoded pointer to obtain first upper address bits of the memory address and a memory allocation size for a variable, decode the encoded pointer to obtain the memory address, verify the memory address is valid based, at least in part on the memory allocation size, and in response to determining that the memory address is valid, allow the memory access request.