Multi-Stage Memory Integrity Encryption for Data Mobility
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing memory integrity solutions face challenges in securely accessing and decrypting data that has been encrypted using key domain selectors, especially when data is moved to different physical addresses, as the encryption process loses key domain selector information and requires costly per-data structure maintenance.
Innovation Solution
A multi-stage memory integrity approach using a plurality of encryption and decryption engines that successively encrypt and decrypt data across multiple stages with different types of selectors, ensuring continuous access control and integrity through pseudo-decryption and pattern-based integrity checks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is encrypted using key domain selectors with physical address as tweak, then memory security and integrity are improved, but data cannot be correctly decrypted when moved to different physical addresses
Solution Approach 1:
The encryption process is divided into multiple stages: first encrypting data with key domain selector information, then separately encrypting with spatial selector (physical address) information. This segmentation allows each encryption stage to handle specific aspects of security independently, enabling data to be moved between physical addresses while maintaining decryptability through selective decryption stages.
Solution Approach 2:
Key domain selector information is embedded into the data during the initial encryption stage before the data is stored or moved. This preliminary embedding ensures that the security context is preserved with the data itself, allowing the data to be relocated to different physical addresses without losing its cryptographic identity and enabling correct decryption at the new location.
2Reliability
If key domain selector information is embedded in physical address, then encryption integrity is improved, but costly per-data structure maintenance is required
Solution Approach 1:
The patent combines key domain selector information with the encryption process itself rather than maintaining it in separate data structures. By integrating the security context into the cryptographic transformation, the system eliminates the need for additional per-data-structure key management overhead while preserving encryption integrity.
Solution Approach 2:
The encryption system uses the data's own cryptographic state to carry its security context. The encrypted data structure inherently contains the necessary key domain information through the multi-stage encryption process, making the data self-sufficient for its own verification and decryption without requiring external key management infrastructure.
3Reliability
If multi-stage encryption is implemented, then replay protection and integrity are improved, but decryption complexity increases
Solution Approach 1:
The decryption process is made dynamic and adaptive based on the operation type. For read operations, the full multi-stage decryption is performed. For move or copy operations, only partial decryption is performed to preserve security context. This dynamic approach maintains strong replay protection while reducing decryption complexity when full decryption is not necessary.
Solution Approach 2:
The system performs partial decryption only when necessary (for read operations), and uses pseudo-decryption or selective decryption for other operations like move or copy. This partial action approach provides sufficient replay protection and integrity verification without always requiring complete decryption, thereby reducing overall decryption complexity and improving performance.
Data Source
AI summary
Embodiments of apparatus, method, and storage medium associated with multi-stage memory integrity for securing/protecting memory content are described herein. In some embodiments, an apparatus may include multiple stages having respective encryption engines to encrypt data in response to a write or restore operation; wherein the encryption engines are to successively encrypt the data in a plurality of encryption stages using a plurality of tweaks based on a plurality of selectors of different types {s1, s2, . . . }. In embodiments, the multiple stages may further comprise one or more decryption engines to partially, fully, or pseudo decrypt the plural encrypted data, in response to a read, move or copy operation; wherein the one or more decryption engines are to partially, fully, or pseudo decrypt the plural encrypted data in one or more decryption stages using one or more tweaks based on a subset of the selectors of different types {s1, s2, . . . }.