Memory Encryption via Address-Dependent Key Derivation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computer systems are vulnerable to attacks that modify or alter data in memory, leading to unauthorized changes in program code, which can disrupt system operation and undermine security measures.
Innovation Solution
A computing environment that uses address bits to determine security features, employing an encryption circuit and key derivation circuit to encrypt and protect data stored in system memory, with the address bus determining the location for ciphertext storage and a Toeplitz function used in key derivation to enable encryption and integrity checks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If extensive encryption techniques and tamper evident mechanisms are employed to secure data in system memory, then the security and integrity of data are improved, but the device complexity and performance overhead increase
Solution Approach 1:
The patent applies different security measures to different memory locations based on their sensitivity. Not all memory is encrypted or protected uniformly - only specific regions marked with security attributes receive encryption and integrity protection. This allows the system to maintain security where needed while reducing complexity in less critical areas.
Solution Approach 2:
The memory space is divided into secure and non-secure regions, with the MMU managing separate address spaces. This segmentation allows the system to apply security mechanisms only to portions of memory that require protection, rather than applying them universally across the entire memory space, thereby reducing overall system complexity.
2Reliability
If encryption and verification mechanisms are applied to all memory data, then unauthorized alterations are prevented, but the processing speed and productivity decrease
Solution Approach 1:
The system applies security attributes selectively to specific memory regions based on their sensitivity and usage characteristics. High-integrity requirements are imposed only on critical data structures and code segments, while less critical areas operate without the overhead of encryption and verification, thereby maintaining processing speed.
Solution Approach 2:
Rather than applying full encryption and verification to all memory accesses, the system applies these mechanisms only to the extent necessary for protecting critical data. This partial application of security measures maintains productivity while providing adequate protection where required.
3Reliability
If the operating system manages memory security through extensive software routines, then data protection is improved, but the ease of operation and system responsiveness deteriorate
Solution Approach 1:
The MMU automatically manages memory security attributes and encryption based on the address space markings, without requiring explicit software intervention for each memory access. The hardware-level address translation and security attribute enforcement occur transparently, maintaining system responsiveness while providing robust data protection.
Solution Approach 2:
The MMU acts as an intermediary between the software application and the physical memory hardware, automatically handling security attribute enforcement and encryption/decryption operations. This intermediary layer abstracts the complexity of security management from the application layer, maintaining ease of operation while ensuring data protection.
Data Source
AI summary
A computing environment maintains the integrity of data stored in system memory. The system has an address bus that comprises a plurality of address lines. The value of at least a portion of the address line is determined by a real page number stored in a page table. The system also comprises an encryption circuit that converts data from plaintext to ciphertext as a function of a key value. A circuit derives the key value as a function of at least a portion of the address line that is set by the real page number.