Processor Cache Data Scrambling Against Speculative Memory Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Unauthorized access to data in computer processors, particularly due to speculative execution and shared memory architectures, poses security vulnerabilities like Meltdown and Spectre, necessitating improved data protection methods.
Innovation Solution
Implementing data scrambling and unscrambling techniques within the processor using secret keys, specifically random numbers, to secure data in caches and main memory, ensuring unauthorized access is hindered without the keys, while minimizing performance impact through efficient multiplexer-based operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If data is stored in clear form in caches and main memory for fast access, then processing speed is improved, but unauthorized access to data becomes possible through shared memory and speculative execution
Solution Approach 1:
A scrambler component is introduced as an intermediary between the processor core and the cache/memory systems. This scrambler applies bitwise XOR operations using secret keys to transform clear data into scrambled form during write operations and restores scrambled data to clear form during read operations, thereby preventing unauthorized access while maintaining fast data access speeds
Solution Approach 2:
The data representation parameter is changed from clear form to scrambled form using bitwise XOR transformation with secret keys. This parameter change ensures that even if data is accessed through shared memory or via speculative execution, the unauthorized access only retrieves scrambled meaningless data, thus protecting against security vulnerabilities
2Object-affected harmful factors
If computational intensive encryption operations are applied to protect data, then data security is improved, but processing performance deteriorates
Solution Approach 1:
Instead of using complex, computationally intensive encryption algorithms, the patent employs simple bitwise XOR operations with secret keys. This lightweight approach provides adequate security protection without significantly impacting processor performance, effectively using a simpler, faster operation that achieves the security goal
Solution Approach 2:
The encryption method parameter is changed from complex computational encryption to simple bitwise XOR transformation. This parameter change maintains data security through the use of secret keys while avoiding the performance penalty associated with computationally intensive cryptographic operations
3Adaptability or versatility
If multiple processors share main memory for resource efficiency, then system utilization is improved, but security vulnerabilities increase due to potential unauthorized access
Solution Approach 1:
The scrambler acts as a mediator layer between multiple processors and the shared memory system. Each processor's data in the shared memory is scrambled with its specific secret key, so even though memory is shared, each processor can only access and decode its own scrambled data, preventing cross-processor unauthorized access while maintaining memory sharing benefits
Solution Approach 2:
The security protection is applied locally to each processor's data in the shared memory through individual secret keys. This local quality approach allows multiple processors to share the same physical memory infrastructure while each processor's data remains protected with its own scrambling key, enabling secure memory sharing
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Systems, apparatuses, and methods related to a computer system having a processor and a main memory storing scrambled data are described. The processor may have a cache, a register, an execution unit, and an unscrambler. The processor can load the scrambled data into the cache; and the unscrambler may convert the scrambled data into unscrambled data just in time for the register or the execution unit during instruction execution. The unscrambled data can be an instruction, an address, or an operand of an instruction. Unscrambling can be performed just before loading the data item in a scrambled form from the cache into the register in an unscrambled form, or after the data item leaves the register in the scrambled form as input to the execution unit in the unscrambled form. The unscrambled data and the scrambled data may have the same set of bits arranged in different orders.