Trusted I/O Encryption With Header Bypass for Secure DMA Messages
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current processors do not provide adequate protection for I/O data that moves across the on-chip boundary, leaving secure enclaves vulnerable to unauthorized access and data integrity breaches.
Innovation Solution
Implementing a cryptographic engine and channel identifier filter to encrypt I/O data while leaving header data unencrypted, ensuring message integrity and compatibility with existing software stacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If I/O data is encrypted to provide trusted I/O protection, then security and integrity are improved, but processing complexity and performance overhead increase
Solution Approach 1:
The I/O data stream is segmented into header portions and payload portions. The header is left unencrypted to enable existing software stacks to process metadata without cryptographic overhead, while the payload is encrypted to provide security. This segmentation resolves the contradiction by applying encryption selectively rather than uniformly across all data.
Solution Approach 2:
Different portions of the I/O data receive different treatments: the header is left in plaintext form to maintain compatibility with existing software, while the payload is encrypted to provide security. This local differentiation of data quality (encrypted vs. unencrypted) allows the system to achieve both security and compatibility without universal encryption overhead.
2Reliability
If full I/O data encryption is implemented, then security is improved, but compatibility with existing software stacks deteriorates
Solution Approach 1:
The data stream is divided into header and payload segments with different encryption treatments. The header segment remains unencrypted, allowing existing software stacks that expect plaintext headers to continue functioning without modification, while the payload segment is encrypted for security.
Solution Approach 2:
The system applies different quality characteristics to different parts of the data: the header maintains its original plaintext quality for compatibility, while the payload is transformed into encrypted form for security. This localized quality differentiation enables both compatibility and protection simultaneously.
3Reliability
If I/O data is encrypted across the on-chip boundary, then security against attacks is improved, but processing speed and performance deteriorate
Solution Approach 1:
The I/O data is segmented into header and payload portions that traverse the on-chip boundary at different times and through different security boundaries. The header can be processed quickly without encryption overhead, while the payload receives encrypted protection. This segmentation reduces the total amount of data requiring cryptographic processing, thereby improving overall speed.
Solution Approach 2:
Different security qualities are applied to different data portions: the header receives minimal security treatment for fast processing, while the payload receives full cryptographic protection. This local differentiation of security quality reduces the overall cryptographic processing burden and improves throughput.
Data Source
AI summary
Technologies for trusted I/O include a computing device having a hardware cryptographic agent, a cryptographic engine, and an I/O controller. The hardware cryptographic agent intercepts a message from the I/O controller and identifies boundaries of the message. The message may include multiple DMA transactions, and the start of message is the start of the first DMA transaction. The cryptographic engine encrypts the message and stores the encrypted data in a memory buffer. The cryptographic engine may skip and not encrypt header data starting at the start of message or may read a value from the header to determine the skip length. In some embodiments, the cryptographic agent and the cryptographic engine may be an inline cryptographic engine. In some embodiments, the cryptographic agent may be a channel identifier filter, and the cryptographic engine may be processor-based. Other embodiments are described and claimed.