Total Memory Protection Replay Attack Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing memory protection technologies face challenges in providing comprehensive confidentiality, integrity, and rollback protection without incurring significant performance and storage overheads, making them unsuitable for widespread adoption in computing systems.
Innovation Solution
A Total Memory Protection (TMP) module is implemented, which includes encryption/decryption logic, integrity validation logic, and replay protection logic, using a combination of hardware, software, and firmware to manage keys and MAC values, ensuring data integrity and preventing replay attacks by re-keying mechanisms, thereby providing low-overhead confidentiality, integrity, and rollback protection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If robust memory protection mechanisms are implemented, then security against replay attacks is improved, but performance overhead increases
Solution Approach 1:
The patent divides memory protection into hierarchical levels (L1 cache, L2 cache, main memory) with different protection mechanisms applied at each level. This segmentation allows robust replay protection at critical levels while maintaining performance at other levels, resolving the contradiction between security and performance.
Solution Approach 2:
The patent applies replay protection selectively to specific memory regions and operations rather than uniformly across all memory access. By applying protection only where necessary (partial action), the system achieves adequate security without the full performance penalty of comprehensive protection.
2Reliability
If comprehensive memory protection is implemented, then data integrity is improved, but storage overhead increases
Solution Approach 1:
The patent embeds integrity verification data (tags, counters) within the existing memory structure rather than allocating separate storage. MAC values and protection metadata are nested within cache lines and memory structures, achieving comprehensive integrity protection without proportional increases in storage overhead.
3Reliability
If frequent re-keying operations are performed, then rollback protection is improved, but computational overhead increases
Solution Approach 1:
The patent implements re-keying operations at periodic intervals rather than continuously. Counter values are updated periodically, and re-keying is triggered by specific conditions (time-based, access-based) rather than every memory operation, providing rollback protection while limiting computational overhead to acceptable levels.
4Productivity
If low-overhead protection schemes are used, then performance is improved, but security against replay attacks deteriorates
Solution Approach 1:
The patent combines multiple protection mechanisms (encryption, MAC verification, counter-based replay detection, hierarchical caching) into a composite protection system. This composite approach achieves robust replay protection while maintaining performance by leveraging the strengths of each individual mechanism and their synergistic interactions.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
In an embodiment, a processor includes: at least one core to execute instructions; a cache memory coupled to the at least one core to store data; and a tracker cache memory coupled to the at least one core. The tracker cache memory includes entries to store an integrity value associated with a data block to be written to a memory coupled to the processor. Other embodiments are described and claimed.