Configurable Memory Encryption Engine for Bandwidth-Constrained Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security techniques for computer systems fail to provide flexible and reliable protection for applications and data, particularly in terms of memory address ranges, as they often compromise performance due to high bandwidth requirements for replay protection mechanisms.
Innovation Solution
The implementation of a configurable security range register that divides protected memory into two categories: an encryption-only range and a full protection range, using the memory encryption engine to provide encryption, integrity, and replay protection only where necessary, thereby minimizing bandwidth impact and enhancing system performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If replay protection mechanisms are implemented for memory encryption, then security and integrity are improved, but memory bandwidth consumption increases significantly
Solution Approach 1:
The memory address space is segmented into multiple regions, each with different security levels. Some regions receive full replay protection while others receive only encryption, allowing the system to balance security requirements against bandwidth consumption by applying protection mechanisms selectively to different memory segments.
Solution Approach 2:
Different security levels are applied to different regions of memory based on their specific requirements. Critical memory regions receive full protection including replay protection trees, while less critical regions receive only encryption, optimizing the overall system security-bandwidth tradeoff by making protection quality local rather than uniform.
2Reliability
If full protection is applied to all memory ranges, then security is improved, but system performance deteriorates due to bandwidth overhead
Solution Approach 1:
The memory address space is divided into multiple regions with different security levels. By segmenting memory and applying protection selectively rather than uniformly, the system maintains data integrity for critical regions while preserving system performance through reduced overhead in less critical regions.
Solution Approach 2:
Instead of applying full protection to all memory, the system applies partial protection only where necessary. This partial action approach maintains adequate security for critical data while avoiding the performance penalty of applying excessive protection mechanisms across the entire memory space.
3Adaptability or versatility
If configurable security levels are implemented, then flexibility is improved, but device complexity increases
Solution Approach 1:
The memory encryption engine is designed with multi-functionality, capable of operating in different modes (encryption-only or full protection with replay protection trees) depending on the region. This universal design allows a single engine to provide multiple security levels without requiring separate hardware for each mode, thus improving flexibility while limiting complexity growth.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A processor implementing techniques for supporting configurable security levels for memory address ranges is disclosed. In one embodiment, the processor includes a processing core a memory controller, operatively coupled to the processing core, to access data in an off chip memory and a memory encryption engine (MEE) operatively coupled to the memory controller. The MEE is to responsive to detecting a memory access operation with respect to a memory location identified by a memory address within a memory address range associated with the off-chip memory, identify a security level indicator associated with the memory location based on a value stored on a security range register. The MEE is further to access at least a portion of a data item associated with the memory address range of the off-chip memory in view of the security level indicator.