Memory Data Encryption via Process-Specific Scrambling Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional computing systems allow privileged processes to access all memory, making it vulnerable to unauthorized access and data breaches by nefarious entities.
Innovation Solution
Implementing a hardware-based data security mechanism using a scrambler circuit within the memory management unit (MMU) to encrypt and decrypt memory data using process-specific scrambling keys, ensuring that only authorized processes can correctly interpret the data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If privileged processes are allowed to access all memory for system management, then system control capability is improved, but data security deteriorates
Solution Approach 1:
The patent segments memory access permissions by associating different scrambling keys with different processes. Each process has its own unique scrambling key that is tied to its virtual memory space, effectively dividing the previously unified memory access privilege into process-specific segments. This allows the system to maintain control capability while preventing unauthorized access between processes.
Solution Approach 2:
The patent applies local quality by making memory encryption properties specific to each process's virtual memory space. The scrambling key is locally tied to the process identifier and virtual address space, so that encryption and decryption operations are performed with process-specific keys. This ensures that each process can access its own memory while other processes cannot, creating localized security zones within the memory system.
2Object-affected harmful factors
If hardware-based encryption is implemented in the MMU, then data security is improved, but device complexity increases
Solution Approach 1:
The patent merges the encryption/decryption functionality directly into the MMU structure. The scrambling key association logic, virtual address translation, and memory access control are combined in a single integrated MMU unit. This consolidation allows hardware-based encryption to be implemented without adding separate encryption devices, as the MMU itself performs both address translation and security functions.
Solution Approach 2:
The MMU performs encryption and decryption operations automatically as part of its normal memory management function. When a process accesses memory, the MMU autonomously retrieves the appropriate scrambling key based on the process identifier, performs the encryption/decryption operation, and completes the memory access without requiring separate encryption hardware or software intervention. This self-service approach minimizes additional complexity.
3Object-affected harmful factors
If process-specific scrambling keys are used for memory encryption, then unauthorized access prevention is improved, but processing overhead increases
Solution Approach 1:
The patent performs preliminary action by pre-associating scrambling keys with process identifiers before memory access operations occur. When a process is created or loaded, its scrambling key is established and stored in the MMU's key association structure in advance. During memory access operations, the MMU simply retrieves the pre-associated key based on the process identifier, avoiding the need for complex key selection or generation during the actual encryption/decryption process.
Data Source
AI summary
Methods, apparatuses, and systems related to securing memory data are described. A hardware circuit is configured to encrypt and decrypt memory data using a scrambling key unique to a computing process processing the memory data. In writing the memory data, the hardware circuit generates scrambled memory data based on encrypting the memory data according to the security key. The scrambled memory data is stored for the write operation instead of the memory data. When the same process reads back the scrambled data, the same security key can be used to decrypt the scrambled data and recover the initial unscrambled memory data.