Microprocessor Decryption Key Selection by Fetch Address
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing microprocessors face challenges in securely executing encrypted instructions, as attackers can exploit vulnerabilities in instruction set randomization methods, particularly in decrypting and executing encrypted instructions within the same time as plain text instructions, which may lead to security breaches.
Innovation Solution
A microprocessor design that stores multiple master keys in a secure memory, selects and derives decryption keys based on encrypted instruction fetch addresses, and uses these keys to decrypt instructions, ensuring secure execution while maintaining the same fetch time as plain text instructions, employing a key expander to increase the effective decryption key length and rotate or select new keys dynamically.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If instruction set randomization is implemented by encrypting programs and decrypting them within the processor, then security against code injection attacks is improved, but the complexity of the decryption mechanism increases and may lead to security vulnerabilities
Solution Approach 1:
The decryption mechanism is segmented into multiple independent components: a secure memory storing master keys, a key selection unit that chooses keys based on instruction fetch addresses, and a decryption unit that applies selected keys. This segmentation reduces overall complexity by making each component simpler and more manageable while maintaining security.
Solution Approach 2:
Master keys are pre-stored in secure memory before execution, and key selection is performed based on pre-computed relationships with instruction fetch addresses. This preliminary preparation eliminates the need for complex real-time key generation, simplifying the decryption mechanism while preserving security.
2Productivity
If decryption is performed within the processor at the same time as instruction fetch, then execution speed is maintained, but the complexity of the processor architecture increases
Solution Approach 1:
The decryption operation is merged with the instruction fetch operation in the processor pipeline. Both operations occur simultaneously using shared resources such as the instruction cache and fetch address, eliminating the need for separate decryption hardware and reducing architectural complexity while maintaining execution speed.
Solution Approach 2:
The processor uses its own existing resources (fetch address, instruction cache) to perform decryption without requiring external or additional dedicated decryption hardware. The fetch address itself is used to select the decryption key, making the system self-sufficient and reducing overall complexity.
3Reliability
If multiple master keys are stored in secure memory and selected based on fetch addresses, then encryption security is strengthened, but the memory access time and system complexity increase
Solution Approach 1:
Multiple master keys are pre-stored in secure memory in a ready state, indexed by portions of the fetch address. When an instruction is fetched, the corresponding key is already in place and can be selected immediately based on the address, eliminating the need for time-consuming key generation or search operations.
Solution Approach 2:
Different portions of the secure memory are assigned to store different master keys, with each key optimized for specific address ranges. This local organization allows for faster access by mapping fetch addresses directly to the appropriate key storage location, reducing memory access time while maintaining security.
4Reliability
If decryption keys are derived dynamically from master keys based on instruction fetch addresses, then resistance to cryptographic attacks is improved, but the computational overhead increases
Solution Approach 1:
The decryption key is derived by dynamically changing parameters of the master key based on the fetch address, such as selecting different key segments or applying simple transformations. This approach provides cryptographic strength through parameter variability while avoiding computationally expensive operations, thus reducing energy overhead.
Data Source
AI summary
A microprocessor and method are provided for securely decrypting and executing encrypted instructions within a microprocessor. A plurality of master keys are stored in a secure memory. Encrypted instructions are fetched from an instruction cache. A set of one or more master keys are selected from the secure memory based upon an encrypted instruction fetch address. The selected set of master keys or a decryption key derived therefrom is used to decrypt the encrypted instructions fetched from the instruction cache. The decrypted instructions are then securely executed within the microprocessor. In one implementation, the master keys are intervolved with each other to produce a new decryption key with every fetch quantum. Moreover, a new set of master keys is selected with every new block of instructions.