Memory Controller Secure Path for Side Channel Attack Resistance

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Memory access leakage, particularly timing and location information, in memory controllers can be exploited by malicious attacks like Side Channel Attacks (SCA), compromising security during secure memory transactions.

Innovation Solution

Implementing a secure path in the memory controller that obscures memory access timing information by using a closed page policy, preventing address-dependent reordering between secure and non-secure transactions, and segregating secure requests into a dedicated container to resist SCA while minimizing performance impact on non-secure transactions.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If address-dependent reordering is applied to optimize memory transaction scheduling, then productivity is improved, but security deteriorates due to memory access leakage

Engineering Contradiction:

Improvememory transaction scheduling efficiencyVSAvoidmemory access leakage

Core Design Contradiction:

ProductivityVSObject-affected harmful factors

Solution Approach 1:

The patent segments the scheduling queue into secure and non-secure portions, applying different scheduling policies to each segment. Secure transactions are placed in a dedicated secure container that prevents address-dependent reordering, while non-secure transactions can utilize optimization techniques. This segmentation resolves the contradiction by isolating security-critical operations from performance-optimizing operations.

Inventive Principle:

Principle #1Segmentation

2Reliability

If secure transactions are isolated in a dedicated container, then security is improved, but device complexity increases

Engineering Contradiction:

Improvesecurity against SCAVSAvoidscheduling queue structure

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent introduces a secure container as an intermediary structure between the scheduling queue and the memory interface. This container acts as a mediator that receives secure transactions, applies security-preserving scheduling policies, and outputs them to the memory interface. The intermediary approach improves security while containing complexity within a well-defined module rather than distributing it throughout the entire system.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Reliability

If closed page policy is applied to secure transactions, then security is improved by obscuring timing information, but productivity decreases

Engineering Contradiction:

Improvetiming information obscurationVSAvoidsecure transaction throughput

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The patent applies the closed page policy locally only to secure transactions within the secure container, while non-secure transactions can utilize more aggressive page policies for improved performance. This local application of quality measures ensures that security-critical operations receive the necessary protection without imposing the performance penalty across all memory transactions, thus resolving the contradiction between security and productivity.

Inventive Principle:

Principle #3Local quality

Data Source

PatentUS11526632B2Securing address information in a memory controller

Publication Date: 2022.12.13 RAMBUS INC

AI summary

Methods and systems for enabling secure memory transactions in a memory controller are disclosed. Responsive to determining that an incoming request is for a secure memory transaction, the incoming request is placed in a secure request container. The memory container then enters a state where re-ordering between requests for secure memory transactions placed in the secure request container and requests for non-secure memory transactions from other containers is prevented in a scheduling queue.