Microprocessor Chunk Encryption Branch Switch Key
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing microprocessors face challenges in securely executing encrypted programs due to vulnerabilities in instruction set randomization, where attackers can exploit time differences in fetching encrypted and plain text instructions, and existing decryption mechanisms increase clock cycles and introduce vulnerabilities.
Innovation Solution
A microprocessor design that encrypts and decrypts instructions by dividing programs into chunks with distinct encryption keys, using a branch and switch key instruction to manage chunk boundaries, and employing a key expander to increase the effective decryption key length, ensuring encrypted and plain text instructions are fetched and executed in the same time without additional clock cycles.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If instruction set randomization is used to encrypt programs, then security against code injection attacks is improved, but attackers can exploit time differences in fetching encrypted and plain text instructions
Solution Approach 1:
The patent merges the fetching of encrypted instructions and plain text instructions into a single unified fetch operation. The microprocessor fetches both encrypted and plain text instructions simultaneously in the same clock cycle, eliminating the time difference that attackers could exploit. This is achieved by having the instruction cache return both versions of instructions together, allowing the processor to decrypt and execute without temporal vulnerability.
Solution Approach 2:
The patent performs preliminary decryption of instructions during the fetch stage itself, before execution. By decrypting instructions as they are fetched from the instruction cache, the processor ensures that no temporal window exists where encrypted instructions could be observed separately from their plain text equivalents, preventing timing-based attacks.
2Adaptability or versatility
If existing decryption mechanisms are used, then encrypted programs can be executed, but clock cycles are increased and vulnerabilities are introduced
Solution Approach 1:
The patent combines the decryption operation with the instruction fetch operation into a single unified process. Instead of fetching instructions and then separately decrypting them (which would require additional clock cycles), the microprocessor performs both operations simultaneously during the fetch stage, maintaining performance while enabling encrypted program execution.
Solution Approach 2:
The patent introduces an intermediary decryption mechanism that operates within the instruction cache pipeline. This intermediary decryption unit processes instructions during the normal fetch pipeline without adding external delay, acting as a mediator between the encrypted storage and the execution units, thereby enabling encrypted program execution without performance penalty.
Data Source
AI summary
A method for encrypting a program for subsequent execution by a microprocessor configured to decrypt and execute the encrypted program includes receiving an object file specifying an unencrypted program that includes conventional branch instructions whose target address may be determined pre-run time. The method also includes analyzing the program to obtain chunk information that divides the program into a sequence of chunks each comprising a sequence of instructions and that includes encryption key data associated with each of the chunks. The encryption key data associated with each of the chunks is distinct. The method also includes replacing each of the conventional branch instructions that specifies a target address that is within a different chunk than the chunk in which the conventional branch instruction resides with a branch and switch key instruction. The method also includes encrypting the program based on the chunk information.