Selective XIP Encryption With MAC Headers for Faster Memory Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing SoCs face performance losses due to encrypting and authenticating every block of data read from external memory, leading to increased latency and reduced throughput.
Innovation Solution
Implement selective encryption and authentication of XIP data based on predefined sequences and pseudorandom algorithms, encoding descriptions of encrypted and authenticated subsets into a small header, and using a Flash Sub-System (FSS) to selectively decrypt and authenticate only necessary data within the SoC.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If every block of data is encrypted and authenticated, then security is improved, but throughput is reduced and latency increases
Solution Approach 1:
The patent segments the data storage into two distinct regions: secure memory for sensitive data requiring encryption and authentication, and non-secure memory for general data access. This segmentation allows the system to apply security operations only where necessary, improving overall throughput while maintaining security for critical data blocks.
Solution Approach 2:
Different security qualities are applied to different regions of memory. The secure region implements full encryption and authentication (XIP with security), while the non-secure region allows direct execution without security overhead. This local differentiation resolves the contradiction by providing high security where needed and high performance where security is less critical.
2Reliability
If every block of data is encrypted and authenticated, then data integrity is improved, but access latency increases
Solution Approach 1:
The memory system is divided into secure and non-secure blocks, allowing integrity verification only for secure blocks. This segmentation eliminates unnecessary authentication operations for non-secure data, reducing access latency while maintaining integrity for protected data.
Solution Approach 2:
Instead of applying full encryption and authentication to all data blocks, the system applies these operations partially—only to secure blocks that require protection. This partial action reduces the overall time overhead while ensuring integrity for critical data.
3Productivity
If selective encryption is implemented, then throughput is improved, but device complexity increases
Solution Approach 1:
The patent introduces a flash security subsystem that automatically manages the segmentation between secure and non-secure memory regions. This subsystem handles the complexity of selective encryption internally, presenting a simplified interface to the processor while maintaining high throughput through intelligent data routing.
Solution Approach 2:
The flash security subsystem acts as an intermediary between the processor and external flash memory, managing the complex encryption and authentication operations. This intermediary absorbs the device complexity, allowing the main processor to benefit from improved throughput without directly handling security management complexity.
Data Source
AI summary
An example apparatus includes: interface circuitry; and programmable circuitry configured to: obtain a set of processor instructions; select a first subset of processor instructions from the set; encrypt the first subset of processor instructions; select a second subset of processor instructions from the set; compute a plurality of message authentication codes (MACs) corresponding to the second subset of processor instructions; cause the interface circuitry to write the set of processor instructions to an external memory; and cause the interface circuitry to write a description of the first subset of processor instructions, a description of the second subset of processor instructions, and the plurality of MACs to the external memory.