MMU Direct Memory Access Encryption with Application Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Applications with encrypted data face challenges in securely interacting with peripherals due to plain text communication, which can be compromised by an untrusted operating system kernel.
Innovation Solution
Direct memory access encryption using application-provided keys, facilitated by modifying the memory management unit with an encryption/decryption hardware unit, allows secure communication between applications and peripherals by encrypting DMA transactions on-the-fly using user-provided keys, protecting confidentiality and integrity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If applications use encrypted data, then data confidentiality is improved, but communication with peripherals becomes insecure due to plain text transmission
Solution Approach 1:
The MMU acts as an intermediary between applications and peripherals, performing encryption and decryption of DMA transactions. The MMU encrypts data before it leaves the application and decrypts data incoming from peripherals, ensuring that plain text communication never occurs on the bus while maintaining secure peripheral interaction.
Solution Approach 2:
The patent replaces the traditional plain text communication mechanism with an encrypted communication mechanism. By substituting the clear text transmission protocol with encryption-based DMA transactions, the system maintains peripheral communication functionality while eliminating security vulnerabilities.
2Reliability
If encryption hardware is added to the MMU, then security is improved, but device complexity increases
Solution Approach 1:
The encryption and decryption functionality is merged directly into the MMU hardware structure. By combining these security functions with the existing memory management unit, the patent avoids creating separate encryption devices and reduces overall system complexity while achieving secure DMA transactions.
Solution Approach 2:
The MMU is designed to perform multiple functions: traditional memory management tasks plus encryption and decryption operations. This multi-functionality eliminates the need for separate dedicated encryption hardware, thereby reducing device complexity while maintaining enhanced security capabilities.
3Adaptability or versatility
If application-provided keys are used, then key management flexibility is improved, but key distribution and management complexity increases
Solution Approach 1:
Applications generate and manage their own encryption keys independently without requiring centralized key distribution infrastructure. Each application self-generates keys and uses them for encrypting and decrypting its own DMA transactions, eliminating complex key management systems while maintaining flexibility.
Data Source
AI summary
In one example in accordance with the present disclosure, a method may include retrieving, at a memory management unit (MMU), encrypted data from a memory via direct memory access and determining, at the MMU, a peripheral that is the intended recipient of the encrypted data. The method may also include accessing an application key used for transmission between an application and the peripheral, wherein the application key originates from the application and decrypting, at the MMU, the encrypted data using the application key and transmitting the decrypted data to the peripheral.