Secure Processor DMA Decryption for Selective Data Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing processor configurations require large-scale modifications and excessive costs to implement full security measures, as they often encrypt and decrypt all information, including instructions and execution results, which is not necessary for all usage scenarios, making them inefficient for protecting only a portion of the information.
Innovation Solution
A processor with an execution unit, local memory, and a DMA unit that performs decryption and encryption only for specific information modules, allowing encrypted data or instruction codes to be stored outside and decrypted within the processor's local memory, which is accessible only from within, thereby providing high-security protection with minimal additional components.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If full security measures are implemented to encrypt and protect all information including instructions and execution results, then security level is improved, but device complexity and cost increase excessively
Solution Approach 1:
The patent segments the security protection scope by introducing a secure area within the processor that selectively protects only specific information (encrypted instructions and data) while leaving other information unprotected. This is achieved by dividing the processor into secure and non-secure regions, with the secure area containing encryption/decryption hardware and protected memory spaces.
Solution Approach 2:
The patent applies security measures locally rather than globally by implementing encryption and protection only in specific areas where needed (instruction cache, data cache, secure memory regions) while leaving other processor operations unprotected. This allows selective application of security based on local requirements rather than uniform protection across the entire system.
2Reliability
If full security measures are implemented to encrypt and protect all information including instructions and execution results, then security level is improved, but manufacturing cost increases excessively
Solution Approach 1:
The patent segments the security implementation to include only essential encryption/decryption hardware within the processor chip, while storing encrypted data externally in ordinary memory devices. This reduces manufacturing costs by avoiding the need for comprehensive security hardware throughout the entire system while maintaining protection for critical information.
Solution Approach 2:
The patent implements partial security action by protecting only the portions of information that require security (encrypted instructions and data) rather than all information processed by the system. This avoids the excessive cost of full-system encryption while achieving adequate security for protected content.
3Speed
If encrypted data and instruction codes are decoded and stored in cache memory inside the processor for execution, then processing speed is improved, but security risk increases if hardware for encryption is separate from processor chip
Solution Approach 1:
The patent merges the encryption/decryption hardware with the processor chip by integrating secure hardware modules directly into the processor architecture. This allows encrypted data to be decrypted and stored in internal cache memory without requiring external security hardware, thereby maintaining both high processing speed and security.
Solution Approach 2:
The patent introduces an intermediary secure hardware module within the processor that acts as a mediator between external encrypted data and internal cache memory. This module handles decryption and secure storage, enabling fast access to protected data while maintaining security isolation.
Data Source
AI summary
A processor includes an execution unit configured to execute a program, a bus coupled to the execution unit, a local memory coupled to the bus, a DMA unit coupled to the bus, and an interface to couple the bus to an exterior, wherein the DMA unit is configured to perform a DMA transfer process in response to instruction from the execution unit, to load information by the DMA transfer process from the exterior through the interface, to decrypt the loaded information, and to write the decrypted information to the local memory by the DMA transfer process.