Selective RAM Scrambling via Data Tagging for Security
Solution Overview
Problem
Current RAM scrambling techniques are less secure due to their simpler encryption methods, making them vulnerable to pattern matching attacks that can reverse-engineer the key and algorithm, compromising protected data such as DRM content.
Innovation Solution
Implementing selective memory scrambling within computing devices by using tagging information to determine if data is protected content, applying a scrambling routine only when necessary, and storing it in a secure domain, thereby neutralizing pattern matching attacks and optimizing memory performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If simple encryption techniques are used for RAM scrambling, then memory performance is maintained and resource consumption is reduced, but security against pattern matching attacks deteriorates
Solution Approach 1:
The patent applies different encryption complexities to different data based on their sensitivity and protection requirements. High-complexity encryption is applied only to data marked with protection indicators, while simple scrambling is used for other data, achieving local optimization of security without uniformly increasing system complexity
Solution Approach 2:
The memory is segmented into different domains (secure domain and unsecure domain) based on data protection requirements. The memory controller divides data processing into separate paths: one for protected data requiring complex encryption and another for unprotected data using simple scrambling, allowing selective security enhancement
2Reliability
If all data is scrambled in memory, then security against pattern matching attacks is improved, but memory performance and productivity deteriorate
Solution Approach 1:
Instead of uniformly applying scrambling to all memory operations, the system applies encryption only locally to data that requires protection (data with protection indicators). This selective approach maintains security for critical data while preserving memory performance for general operations
Solution Approach 2:
The system applies partial scrambling - only to the portion of data that needs protection - rather than excessive full-scrambling of all data. This partial action approach provides sufficient security for protected data while avoiding the performance penalty of encrypting unnecessary data
3Adaptability or versatility
If tagging information is added to data to identify protected content, then selective scrambling capability is improved, but device complexity and data processing overhead increase
Solution Approach 1:
The tagging information mechanism serves multiple functions: it identifies protected data for selective encryption, enables memory domain classification, and facilitates access control. This multi-functionality approach provides versatile selective scrambling capability without proportionally increasing complexity
Solution Approach 2:
Tagging information acts as an intermediary between the data and the memory controller's decision-making logic. Rather than complex analysis of data content, the tags provide a simple intermediate representation that guides the memory controller to apply appropriate scrambling, reducing processing complexity
Data Source
AI summary
A method for selectively scrambling data within a memory associated with a computing device based on data tagging. The computing device may define security domains that are protected. Data generated by an application may be packaged as a data bus transaction having tagging information describing the application and/or the data. The data bus transaction may be transmitted over a bus of the computing device to a memory, such as internal memory, where the computing device may compare the tagging information to stored information describing security domains. When the data is determined to be protected based on the tagging information, the computing device may perform scrambling operations on the data. In an aspect, the tagging information may describe a virtual machine used to execute various applications on a processor. In another aspect, the tagging information may define destination memory addresses or content protection bit values.