Memory Controller TME MKTME Encryption Latency
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data encryption solutions for memory and storage devices are inefficient as they require operating system intervention, leading to increased transaction latency and exposure of unencrypted data during page swaps between memory and storage, which compromises security and performance.
Innovation Solution
Implementing Total Memory Encryption (TME) and Multi-Key Total Memory Encryption (MKTME) technologies within the memory controller to encrypt and decrypt data without OS involvement, using configuration registers to manage encryption keys and control data encryption/decryption operations directly in the memory controller, ensuring end-to-end protection and reducing latency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If operating system intervention is used for data encryption/decryption, then data security can be maintained, but transaction latency increases and system throughput decreases
Solution Approach 1:
The patent extracts the encryption/decryption function from the operating system and relocates it to dedicated hardware components (encryption/decryption circuits). This separation allows the OS to focus on high-level management while hardware handles security operations in parallel, eliminating OS-mediated latency and improving both security and performance simultaneously.
Solution Approach 2:
The patent introduces memory management units (MMUs) and encryption/decryption circuits as intermediary components between the OS and memory operations. These intermediaries handle encryption/decryption automatically during memory access operations, preventing plaintext exposure and reducing latency by processing security operations in the data path without requiring OS intervention.
2Reliability
If operating system intervention is used for data encryption/decryption, then data security can be maintained, but system throughput decreases
Solution Approach 1:
The patent extracts the encryption/decryption function from the operating system and relocates it to dedicated hardware components (encryption/decryption circuits). This separation allows the OS to focus on high-level management while hardware handles security operations in parallel, eliminating OS-mediated latency and improving both security and performance simultaneously.
Solution Approach 2:
The patent implements self-service encryption/decryption through hardware circuits that automatically perform security operations without OS intervention. The encryption/decryption circuits and MMUs handle security operations autonomously during memory access, allowing the system to maintain high throughput while ensuring data security through hardware-enforced encryption.
3Ease of operation
If page swaps between memory and storage are performed with OS intervention, then data can be managed, but unencrypted data may be exposed during transfer
Solution Approach 1:
The patent applies preliminary action by encrypting data in the memory controller before it is transferred to storage devices. The encryption/decryption circuits ensure data is encrypted during page swap operations before leaving the memory subsystem, preventing exposure during transfer while allowing the OS to manage data without direct involvement in security operations.
Solution Approach 2:
The patent introduces memory management units (MMUs) and encryption/decryption circuits as intermediary components between the OS and memory operations. These intermediaries handle encryption/decryption automatically during memory access operations, preventing plaintext exposure and reducing latency by processing security operations in the data path without requiring OS intervention.
4Productivity
If encryption/decryption operations are performed in the memory controller without OS involvement, then transaction latency is reduced and throughput improves, but system complexity increases
Solution Approach 1:
The patent segments the memory controller into distinct functional units: memory management units (MMUs) for address translation, encryption/decryption circuits for security operations, and control logic for coordinating these functions. This segmentation allows each component to specialize in its function, improving throughput through parallel processing while managing complexity through modular design.
Solution Approach 2:
The patent implements multi-functional components in the memory controller where MMUs and encryption/decryption circuits handle multiple operations (encryption, decryption, address translation, data transfer) within unified hardware structures. This multi-functionality reduces overall system complexity by consolidating security and memory management functions into integrated circuits rather than separate components.
Data Source
AI summary
This disclosure is directed to a processing device including a memory to store data, processing circuitry to process data, the processing circuitry including a memory controller to control access to the memory and encryption circuitry to encrypt and decrypt data, and I/O circuitry. The I/O circuitry includes an I/O port to write data to a storage device and to read data from the storage device and an enable encryption bit associated with the I/O port, the I/O port to receive a request to read data from the memory, to send a read command to the memory controller with an enable encryption attribute set when the enable encryption bit is set, and to send a read command to the memory controller with the enable encryption attribute not set when the enable encryption bit is not set. The memory controller is configured to get the data from the memory, to forward the data to the I/O port without decrypting the data when the enable encryption attribute is set, and to cause the encryption circuitry to decrypt the data and to forward the decrypted data to the I/O port when the enable encryption attribute is not set.