Processor Crypto Engine for Secure Object Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computer systems face vulnerabilities in protecting sensitive data and software from attacks, as existing methods fail to securely encrypt and decrypt data except during CPU processing, leaving information susceptible to theft by other software.
Innovation Solution
A processor mechanism incorporating a crypto engine and new machine instructions (esm and lsm) to load and manage encryption keys, ensuring that sensitive data and code within a Secure Object are cryptographically protected at all times except during processing within the CPU, preventing access by other software.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is encrypted at all times except during CPU processing, then security against software attacks is improved, but device complexity increases due to the need for crypto engine and special machine instructions
Solution Approach 1:
The patent embeds a crypto engine within the processor architecture, creating a nested security layer. The crypto engine is integrated into the processor core, with special machine instructions (esm and lsm) that operate at the hardware level. This nesting allows encryption/decryption functionality to be embedded directly in the processing path, providing security without requiring external cryptographic devices.
Solution Approach 2:
The patent introduces special machine instructions (esm - enter secure mode, and lsm - leave secure mode) as intermediaries between the CPU and encrypted data. These instructions act as mediators that control access to the crypto engine and manage the transition between encrypted and decrypted states. The intermediary instructions provide a controlled interface that maintains security while enabling necessary data processing.
2Reliability
If sensitive data is kept encrypted during storage and transmission, then confidentiality is improved, but processing speed decreases due to decryption requirements
Solution Approach 1:
The patent implements preliminary decryption action by automatically decrypting data in the CPU cache or register files when the processor needs to access it. The decryption occurs in advance of the actual processing operation, so that when the CPU needs to process the data, it is already in decrypted form. This eliminates the need for decryption during the critical processing path, maintaining both security and speed.
Solution Approach 2:
The patent maintains continuous encryption protection by ensuring that data remains encrypted during storage and transmission, and only temporarily decrypted when absolutely necessary for processing. The crypto engine continuously manages encryption/decryption operations, and the special instructions ensure that decrypted data is immediately re-encrypted when leaving the secure processing context. This continuous protection minimizes the window of vulnerability while maintaining processing efficiency.
Data Source
AI summary
A computer system includes a mechanism supporting a Secure Object that includes information that is cryptographically protected so that other software on the computer system cannot access or undetectably tamper with the information, thereby protecting both a confidentiality and an integrity of the Secure Object information from other software while making an unencrypted form of the Secure Object information available to the Secure Object itself during execution of the Secure Object. The Mechanism includes a crypto engine that decrypts and integrity-checks Secure Object information as the Secure Object information moves into the computer system from external storage and encrypts and updates an integrity value for Secure Object information as the Secure Object information moves out of the computer system to the external storage.