Protected Memory Initialization with Encryption and Dynamic Enclave Allocation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer security systems fail to provide robust protection against hardware and software attacks, particularly in memory regions, allowing attackers to compromise sensitive data through undetected modifications and replay attacks.
Innovation Solution
Implementing a memory encryption engine (MEE) that provides cryptographic mechanisms for encryption, integrity, and replay protection, along with a dynamic enclave page cache (EPC) that allows for secure memory regions to be dynamically reallocated, ensuring confidentiality and integrity of data within protected regions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If memory encryption and protection mechanisms are implemented, then security against hardware and software attacks is improved, but device complexity increases
Solution Approach 1:
A memory encryption engine (MEE) is introduced as an intermediary component between the processor and main memory. The MEE intercepts and encrypts data before it reaches main memory, and decrypts data when retrieved. This mediator handles all cryptographic operations, protecting memory data without requiring the processor itself to implement complex encryption logic, thus improving security while managing device complexity through specialization.
Solution Approach 2:
The memory system is segmented into protected regions (enclaves) and unprotected regions. The MEE selectively applies encryption only to pages marked as protected, identified through specific memory management data structures. This segmentation allows the system to focus security resources on critical data while avoiding the overhead of encrypting entire memory spaces, balancing security improvements with acceptable device complexity.
2Adaptability or versatility
If static memory allocation is used for secure regions, then device complexity is reduced, but adaptability to different security demands decreases
Solution Approach 1:
The system implements dynamic memory allocation for protected regions through a movable boundary mechanism. The MEE maintains a data structure that tracks the extent of protected memory pages, allowing this boundary to be expanded or contracted as security demands change. When new protected data needs to be stored, the boundary extends to include additional pages; when protected data is released, the boundary contracts. This dynamic approach enables the system to adapt to varying security requirements without committing fixed memory resources, achieving high adaptability with manageable complexity through software-controlled memory management.
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
The present disclosure provides a processor device comprising a processor core and a memory controller coupled with the processor core to provide access to main memory. The main memory is to include a protected region of an application address space to store secured pages. The processor core is to perform operations in response to a content copy instruction, the content copy instruction to indicate an address of a source page and an address of a target page in the protected region of the application address space. The operations include to: initialize the target page in the protected region of the application address space; select content of the source page to be copied; copy the selected content to the target page in the protected region of the application address space; and modify an access permission level of the target page.