Selective XIP Encryption to Cut SoC Memory Access Latency
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing System on a Chip (SoC) technologies suffer from performance losses due to encrypting and authenticating every block of data read from external memory, leading to increased latency and reduced throughput.
Innovation Solution
Implement selective encryption and authentication of data based on predefined sequences or pseudorandom algorithms, encoding descriptions of encrypted and authenticated subsets into a small header, and performing decryption and authentication only on necessary data blocks within the SoC.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption and authentication operations are performed on every block of data read from external memory, then security is maintained, but performance is degraded with increased latency and reduced throughput
Solution Approach 1:
The patent segments the data processing workflow by dividing data blocks into different categories (XIP and non-XIP) and applying different security operations to each segment. XIP data blocks execute directly from external memory without decryption, while non-XIP blocks are decrypted and authenticated before use. This segmentation allows critical performance paths to operate at full speed while maintaining security where necessary.
Solution Approach 2:
The patent applies different security qualities to different parts of the data storage system. Specifically, it implements selective encryption and authentication based on the data's execution requirements: some regions (XIP) have no encryption for maximum performance, while other regions (non-XIP) have full encryption and authentication for security. This local differentiation resolves the contradiction by optimizing each region's security level according to its functional requirements.
2Reliability
If encryption operations are performed on all data blocks, then data confidentiality is ensured, but processing time increases
Solution Approach 1:
The patent implements partial action by applying encryption and authentication operations only to the extent necessary for security. Instead of encrypting all data blocks, it selectively applies these operations only to non-XIP data blocks that require protection, while leaving XIP blocks unencrypted. This partial application of security measures maintains confidentiality where needed while avoiding the time penalty on performance-critical paths.
3Reliability
If authentication codes are computed for every data block, then data integrity is verified, but computational overhead increases
Solution Approach 1:
The patent segments the authentication process by computing MACs only for non-XIP data blocks rather than all blocks. The system divides data into XIP segments (no authentication needed) and non-XIP segments (authentication required), thereby reducing the total number of MAC computations while maintaining integrity verification for protected data.
Solution Approach 2:
The patent applies different integrity verification qualities to different data regions. Non-XIP regions receive full authentication with MAC computation to ensure integrity, while XIP regions skip authentication to reduce computational overhead. This local quality approach ensures integrity where necessary without the universal computational burden.
Data Source
AI summary
An example apparatus includes: interface circuitry; and programmable circuitry configured to: obtain a set of processor instructions; select a first subset of processor instructions from the set; encrypt the first subset of processor instructions; select a second subset of processor instructions from the set; compute a plurality of message authentication codes (MACs) corresponding to the second subset of processor instructions; cause the interface circuitry to write the set of processor instructions to an external memory; and cause the interface circuitry to write a description of the first subset of processor instructions, a description of the second subset of processor instructions, and the plurality of MACs to the external memory.