Subpage Memory Tags for Granular Encryption Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional data processing systems lack granular memory protection, as they typically encrypt all memory pages with a single key, offering limited protection and efficiency in managing memory access and encryption at a finer level.
Innovation Solution
The implementation of memory tags allows for subpage granular access control, enabling different lines within a physical page to be protected with unique tags, using hardware-based instructions for efficient read and write operations, and maintaining memory tag maps to associate tags with virtual and physical addresses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a single key is used to encrypt all memory pages, then device complexity is reduced, but memory protection granularity deteriorates
Solution Approach 1:
The patent divides memory protection into subpage-granular segments by introducing memory tags that can be independently assigned to different subpages within a page. Each tag contains a key identifier that enables independent encryption control for each subpage, thereby achieving fine-grained memory protection without requiring a completely new encryption architecture.
Solution Approach 2:
The patent applies different encryption keys to different subpages by storing key identifiers in memory tags associated with each subpage. This allows each subpage to have its own security characteristics and encryption key, enabling localized security policies while maintaining the overall page-based memory management structure.
2Adaptability or versatility
If memory tags are implemented for subpage granular protection, then memory protection granularity is improved, but device complexity increases
Solution Approach 1:
The patent merges the memory tag structure with the existing page table architecture by integrating tag fields into page table entries. This combination allows the system to leverage existing page table infrastructure for tag management, reducing the need for separate data structures and minimizing the increase in device complexity.
Solution Approach 2:
The patent designs the memory tag structure to serve multiple functions: storing key identifiers for encryption, tracking subpage protection status, and enabling various memory management operations. This multi-functionality reduces the need for separate mechanisms for each function, thereby limiting the overall complexity increase.
3Ease of manufacture
If software-based line processing is used, then implementation simplicity is maintained, but processing efficiency deteriorates
Solution Approach 1:
The patent replaces software-based memory line processing with hardware-based mechanisms including memory tags, key identifiers, and encryption/decryption units that operate in the memory management path. This substitution eliminates the performance overhead of software processing while maintaining the conceptual simplicity of the protection mechanism.
Data Source
Figure 1
Figure 2
Figure 3A
AI summary
A data processing system includes support for sub-page granular memory tags. The data processing system comprises at least one core, a memory controller responsive to the core, random access memory (RAM) responsive to the memory controller, and a memory protection module in the memory controller. The memory protection module enables the memory controller to use a memory tag value supplied as part of a memory address to protect data stored at a location that is based on a location value supplied as another part of the memory address. The data processing system also comprises an operating system (OS) which, when executed in the data processing system, manages swapping a page of data out of the RAM to non-volatile storage (NVS) by using a memory tag map (MTM) to apply memory tags to respective subpages within the page being swapped out. Other embodiments are described and claimed.