Encryption Circuitry Avoiding Redundant Memory Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing device security systems face challenges in efficiently protecting data from malicious attacks due to redundant encryption processes, which can impact device performance and create vulnerabilities, especially in virtualized computing environments where multiple encryption systems are used.
Innovation Solution
A cryptographic protection system that employs a combination of different encryption systems for data stored in trusted execution environments, general memory, and data accessed via direct memory access, with encryption circuitry that monitors indicators to avoid redundant encryption operations by determining the origin and encryption status of data, thereby controlling which encryption engines to use for encryption and decryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple encryption systems are used to protect data in different memory regions, then data security is improved, but processing overhead increases due to redundant encryption operations
Solution Approach 1:
The system sets indicator bits in advance to mark whether data has been encrypted. Before performing encryption operations, the system checks these pre-set indicators to determine if encryption is needed, avoiding redundant processing.
Solution Approach 2:
The system uses indicator bits as feedback signals to communicate the encryption status of data between different encryption engines. This feedback mechanism allows subsequent encryption operations to be conditionally skipped based on previous encryption actions.
2Reliability
If encryption operations are performed on all data access, then comprehensive security protection is achieved, but device performance deteriorates
Solution Approach 1:
Indicator bits are set in advance to mark encrypted data. When data access requests are made, the system checks these pre-set indicators to quickly determine whether encryption/decryption is needed, avoiding unnecessary processing and maintaining performance.
Solution Approach 2:
Different encryption approaches are applied to different memory regions based on their security requirements. The system selectively applies encryption only where needed rather than uniformly across all data, optimizing performance while maintaining security.
3Productivity
If redundant encryption is avoided by monitoring data origin, then processing efficiency is improved, but system complexity increases
Solution Approach 1:
Indicator bits serve as intermediaries to carry information about data encryption status between different components of the system. This simple binary mechanism enables complex coordination without requiring sophisticated communication protocols.
Solution Approach 2:
The system uses simple parameter changes (setting or clearing indicator bits) to track encryption status. This approach transforms a potentially complex tracking problem into a simple state change mechanism that is easy to implement and manage.
Data Source
AI summary
This disclosure is directed to avoiding redundant memory encryption in a cryptographic protection system. Data stored in a device may be protected using different encryption systems. Data associated with at least one trusted execution environment (TEE) may be encrypted using a first encryption system. Main memory in the device may comprise data important to maintaining the integrity of an operating system (OS), etc. and may be encrypted using a second encryption system. Data may also be placed into a memory location via direct memory access (DMA) and may be protected utilizing a third encryption system. Redundant encryption may be avoided by encryption circuitry capable of determining when data is already protected by encryption provided by another system. For example, the encryption circuitry may comprise encryption control circuitry that monitors indicators set at different points during data handling, and may bypass certain data encryption or decryption operations based on the indicator settings.