Deterministic Key Rotation Eliminates Replay Protection Tree Overhead
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure memory systems face significant performance and storage overheads due to the need for replay protection trees, which compromise either security or performance, and key rotation methods provide reduced overhead but at the cost of security vulnerabilities.
Innovation Solution
A deterministic key rotation system that eliminates the replay protection tree by using a memory hash register (MHR) to provide cryptographic summaries of memory contents, ensuring replay protection without the need for additional storage or performance overheads.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If replay protection trees are used to ensure security against replay attacks, then security is improved, but storage overhead and performance overhead increase significantly
Solution Approach 1:
The patent extracts the replay protection functionality from the traditional replay tree structure and implements it through deterministic key rotation. Instead of maintaining a separate replay tree in memory, the system uses cryptographic key rotation where each memory access updates the encryption key, thereby eliminating the need for storing replay protection trees while maintaining security against replay attacks.
Solution Approach 2:
The patent makes the encryption key serve multiple functions: it provides both confidentiality for memory data and replay protection simultaneously. By using the same key mechanism for both encryption and replay prevention, the system eliminates the need for separate replay protection structures, reducing storage overhead while maintaining security.
2Reliability
If replay protection trees are used to prevent replay attacks, then security is improved, but performance overhead increases due to tree traversal requirements
Solution Approach 1:
The patent removes the replay tree traversal operation from the memory access path by replacing it with deterministic key rotation. The security function is extracted from the tree structure and implemented through cryptographic key updates that occur as part of the normal memory access operations, eliminating the performance overhead associated with tree traversal.
Solution Approach 2:
The patent ensures that replay protection is continuously maintained through deterministic key rotation that occurs with every memory access. Instead of periodic or event-driven key updates, the system continuously rotates keys with each access, providing uninterrupted replay protection without requiring separate tree traversal operations.
3Quantity of substance
If key rotation is implemented to reduce storage overhead, then storage efficiency is improved, but security vulnerabilities arise due to reduced replay protection
Solution Approach 1:
The patent performs preliminary cryptographic preparation by establishing a deterministic key rotation schedule before memory operations begin. The system pre-computes or pre-establishes the key rotation mechanism, ensuring that replay protection is in place before any potential replay attack can occur, thereby maintaining security without requiring additional storage for replay trees.
4Quantity of substance
If traditional key rotation is used to reduce overhead, then storage and performance overhead are reduced, but deterministic replay protection is lost
Solution Approach 1:
The patent changes the parameters of key rotation from non-deterministic or periodic updates to deterministic updates based on memory access patterns. By making the key rotation deterministic and tied to specific memory operations, the system maintains replay protection that is both storage-efficient and security-strong, eliminating the trade-off between overhead and protection.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
There is disclosed in one example a microprocessor, including: an execution unit; a memory integrity engine (MIE) including a key rotation engine to rotate encryption keys for a secure memory region; and a memory hash register (MHR) to maintain a hash of a secure memory region state.