Region-Granular Memory Encryption via Hardware Intermediary
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current memory protection mechanisms in x86 processor architecture are inadequate to prevent unauthorized access and monitoring of confidential data, as software programs and hardware devices can modify memory attributes and access sensitive information, and external monitoring of signals can reveal confidential data and processing methods.
Innovation Solution
A system and method that includes a memory management unit, security check unit, and encryption/decryption unit to manage memory regions, access security attributes, and encrypt/decrypt data based on encryption indicators, ensuring only authorized access and masking confidential data and processing methods.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If memory protection mechanisms are implemented using software and hardware devices, then memory access control is provided, but confidential data can still be modified or accessed by authorized programs and devices
Solution Approach 1:
The patent introduces an encryption/decryption unit as an intermediary component between the memory system and access requests. This unit acts as a mediator that automatically encrypts confidential data before it reaches memory and decrypts it only for authorized access, preventing both software programs and hardware devices from directly accessing or modifying confidential data in plaintext form.
2Ease of operation
If memory attributes are made modifiable by software programs, then flexibility and ease of operation are improved, but security against unauthorized access deteriorates
Solution Approach 1:
The patent applies different security qualities to different memory regions by implementing encryption specifically for confidential data portions while leaving other memory areas accessible. The encryption/decryption unit selectively processes only those memory regions containing confidential data, allowing normal software operation in non-sensitive areas while providing enhanced protection where needed.
3Productivity
If data is transmitted in plaintext within the memory system, then processing speed and productivity are improved, but vulnerability to external monitoring increases
Solution Approach 1:
The patent changes the parameter of data representation from plaintext to encrypted form for confidential information. The encryption/decryption unit transforms confidential data into an unreadable encrypted state during transmission and storage, making it invisible to external monitoring while maintaining efficient processing through hardware-accelerated encryption operations.
4Object-affected harmful factors
If encryption/decryption operations are performed on memory data, then security against external monitoring is improved, but system complexity and processing overhead increase
Solution Approach 1:
The patent implements a self-service encryption system where the encryption/decryption unit automatically manages the encryption and decryption of confidential data without requiring manual intervention or complex external security management. The system self-regulates by automatically encrypting data before memory storage and decrypting it only when authorized access is requested, reducing the burden on external security infrastructure.
Data Source
AI summary
A memory, system, and method for providing security for data stored within a memory and arranged within a plurality of memory regions. The method includes receiving an address within a selected memory region and using the address to access an encryption indicator. The encryption indicator indicates whether data stored in the selected memory page are encrypted. The method also includes receiving a block of data from the selected memory region and the encryption indicator and decrypting the block of data dependent upon the encryption indicator.