Memory Bus Link Encryption for Integrity and Replay Protection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing memory systems face challenges in protecting data integrity and confidentiality due to physical attacks on the links between memory and processing hardware, with data at rest encryption providing limited replay protection.

Innovation Solution

Implementing link encryption and integrity checks on memory bus data, using cryptographic protocols like AES-GMAC and AES-GCM, to ensure confidentiality, integrity, and replay protection without significant performance overhead.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Object-affected harmful factors

If data at rest encryption is implemented in memory devices, then data confidentiality is improved, but replay protection capability deteriorates

Engineering Contradiction:

Improvedata confidentialityVSAvoidreplay protection

Core Design Contradiction:

Object-affected harmful factorsVSReliability

Solution Approach 1:

The patent segments the protection mechanism into two distinct parts: data at rest encryption (using AES) for confidentiality, and a separate authentication code (MAC) using AES-GMAC for replay protection. This segmentation allows each mechanism to specialize in its strength without compromising the other, resolving the contradiction between confidentiality and replay protection.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent merges data encryption and authentication into a unified protection scheme where AES encrypts the data and AES-GMAC generates an authentication code that is transmitted with the encrypted data. This combination provides both confidentiality and replay protection simultaneously, eliminating the trade-off between the two security aspects.

Inventive Principle:

Principle #5Merging (Combining)

2Object-affected harmful factors

If link encryption and integrity checks are implemented on memory bus data, then data protection capability is improved, but system performance deteriorates

Engineering Contradiction:

Improvedata protection capabilityVSAvoidsystem performance

Core Design Contradiction:

Object-affected harmful factorsVSProductivity

Solution Approach 1:

The patent performs preliminary action by computing the authentication code (MAC) before data transmission and storing it with the encrypted data. This allows the receiving end to quickly verify integrity without requiring complex real-time computations, thus improving protection capability while minimizing performance impact.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent replaces traditional error detection mechanisms (like simple parity or checksums) with cryptographic authentication using AES-GMAC. This substitution provides stronger security guarantees while maintaining computational efficiency through hardware acceleration of the cryptographic operations.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

3Reliability

If cryptographic protocols like AES-GMAC and AES-GCM are used for link protection, then replay protection is improved, but computational overhead increases

Engineering Contradiction:

Improvereplay protectionVSAvoidcomputational overhead

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The patent optimizes the computational parameters by selecting appropriate MAC lengths (e.g., 32 or 64 bits) that provide sufficient replay protection without excessive computational overhead. The authentication tag length can be adjusted based on security requirements, allowing flexible trade-off between replay protection strength and computational cost.

Inventive Principle:

Principle #35Parameter changes

Solution Approach 2:

The patent implements self-service by having the same cryptographic hardware that performs encryption also generate the authentication code. This integrated approach eliminates the need for separate computational resources, reducing overall overhead while providing both confidentiality and replay protection through the same cryptographic engine.

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS12549331B2Memory bus integrity and data encryption (IDE)

Publication Date: 2026.02.10 INTEL CORP

AI summary

A memory subsystem includes link encryption for the system memory data bus. The memory controller can provide encryption for data at rest and link protection. The memory controller can optionally provide link encryption. Thus, the system can provide link protection for the data in transit. The memory module can include a link decryption engine that can decrypt link encryption if it is used, and performs a link integrity check with a link integrity tag associated with the link protection. The memory devices can then store the encrypted protected data and ECC data from the link decryption engine after link protection verification.