Integrated Encryption Engine for Memory Address Translation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In data processing systems with multiple cores and threads, secure data is at risk of unauthorized access due to processing overhead and inefficient encryption/decryption methods, leading to unencrypted data being stored in volatile memory, which compromises security and performance.

Innovation Solution

An integrated encryption engine within a processing core performs encryption and decryption operations in conjunction with a memory address translation data structure, such as an ERAT or TLB, using encryption-related page attributes to selectively stream secure data through the engine, ensuring secure data is only accessed and processed within authorized threads and cores.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If encryption/decryption is performed using software on a processor, then implementation flexibility is improved, but processing overhead and performance are worsened

Engineering Contradiction:

Improveimplementation flexibilityVSAvoidprocessing overhead

Core Design Contradiction:

Adaptability or versatilityVSProductivity

Solution Approach 1:

The patent replaces software-based encryption/decryption with a dedicated hardware encryption engine that operates in parallel to the processor. This substitution eliminates the processing overhead associated with software execution while maintaining implementation flexibility through configurable encryption algorithms and modes of operation.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

2Speed

If secure data is stored in unencrypted form in volatile memory (cache), then access speed is improved, but security is worsened due to unauthorized access risk

Engineering Contradiction:

Improveaccess speedVSAvoidsecurity

Core Design Contradiction:

SpeedVSReliability

Solution Approach 1:

The patent segments memory into secure and non-secure regions, with the encryption engine operating on specific memory segments. This allows unencrypted fast access in non-secure memory while maintaining security through encryption in secure memory regions, resolving the contradiction between speed and security.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The encryption engine acts as an intermediary between the processor and memory. It decrypts data from encrypted secure memory before it reaches the processor, and re-encrypts data before it is written to secure memory. This intermediary function enables the processor to access data at full speed without compromising security.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Productivity

If encryption/decryption is performed by a memory controller external to the processor, then processor performance is improved, but system complexity and data security management are worsened

Engineering Contradiction:

Improveprocessor performanceVSAvoidsystem complexity

Core Design Contradiction:

ProductivityVSDevice complexity

Solution Approach 1:

The patent merges the encryption engine with the processor architecture, integrating it into the processor core or as a closely coupled unit. This consolidation eliminates the need for external memory controller encryption functions, reducing system complexity while maintaining processor performance benefits.

Inventive Principle:

Principle #5Merging (Combining)

4Adaptability or versatility

If multiple threads share common cache memory, then resource utilization is improved, but security is worsened due to unauthorized data access between threads

Engineering Contradiction:

Improveresource utilizationVSAvoiddata security

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The patent applies local quality by encrypting specific memory regions or data structures while leaving other regions unencrypted. This allows different parts of the shared cache to have different security properties, enabling resource sharing between threads while protecting sensitive data from unauthorized access.

Inventive Principle:

Principle #3Local quality

Data Source

PatentUS8954755B2Memory address translation-based data encryption with integrated encryption engine

Publication Date: 2015.02.10 INTERNATIONAL BUSINESS MACHINE CORPORATION

AI summary

A method and circuit arrangement utilize an integrated encryption engine within a processing core of a multi-core processor to perform encryption operations, i.e., encryption and decryption of secure data, in connection with memory access requests that access such data. The integrated encryption engine is utilized in combination with a memory address translation data structure such as an Effective To Real Translation (ERAT) or Translation Lookaside Buffer (TLB) that is augmented with encryption-related page attributes to indicate whether pages of memory identified in the data structure are encrypted such that secure data associated with a memory access request in the processing core may be selectively streamed to the integrated encryption engine based upon the encryption-related page attribute for the memory page associated with the memory access request.