Virtual Memory Encryption for SOC Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Embedded computing systems face security vulnerabilities due to the lack of encryption for data transferred between a system-on-chip (SOC) and external memory, making them susceptible to reverse engineering and hacking, while adding cryptographic pipeline stages increases costs and is not feasible for existing SOCs.
Innovation Solution
Implementing a memory hierarchy with a scratchpad memory level between caches and external memory to encrypt data before storage in external memory and decrypt it on demand, allowing for increased security without dedicated cryptographic hardware between DRAM and caches.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic pipeline stages are added between DRAM and caches, then data security is improved, but device cost and complexity increase
Solution Approach 1:
The patent extracts the encryption/decryption functionality from dedicated cryptographic hardware pipeline stages and relocates it to software-based virtual memory management. The virtual memory manager performs encryption/decryption operations on demand when data is transferred between encrypted external memory and unencrypted caches, eliminating the need for dedicated cryptographic hardware while maintaining security.
Solution Approach 2:
The virtual memory manager acts as an intermediary between the encrypted external memory and unencrypted caches. It mediates the data transfer process by encrypting data before writing to external memory and decrypting data when reading from external memory, thereby providing security without requiring dedicated cryptographic hardware in the memory pipeline.
2Reliability
If all data is encrypted in external memory, then security is improved, but data access performance deteriorates due to additional encryption/decryption operations
Solution Approach 1:
The patent applies partial encryption by encrypting only the data stored in external memory while keeping data in caches unencrypted. This selective encryption approach provides security for the most vulnerable data (stored externally) without the performance penalty of encrypting all data paths, including those within the secure SOC boundary.
Solution Approach 2:
The virtual memory manager performs encryption/decryption operations in advance during memory management tasks rather than during data access operations. Encryption occurs when data is written to external memory, and decryption occurs when data is read, preparing the data state before it is needed for processing.
3Reliability
If a memory hierarchy with scratchpad memory is implemented, then data security is improved without dedicated hardware, but device complexity increases
Solution Approach 1:
The virtual memory manager performs multiple functions: it manages virtual memory addresses, handles page faults, and performs encryption/decryption operations. By combining these functions into a single software-based manager, the patent avoids adding dedicated hardware for each function while providing comprehensive security through the memory hierarchy.
Solution Approach 2:
The patent uses a virtual memory layer that copies data between virtual addresses and physical memory addresses. This virtual memory copying mechanism provides an additional layer of abstraction and security, allowing the system to encrypt data at the virtual memory level without requiring dedicated cryptographic hardware in the physical memory path.
Data Source
AI summary
The following description is directed to the use of encryption by a computing system. In one example, a method can include determining whether information associated with a logical address is stored unencrypted within an on-chip memory of an integrated circuit or whether the information associated with the logical address is stored encrypted within an off-chip memory external to the integrated circuit. When the information is not stored unencrypted within the on-chip memory and is stored encrypted within the off-chip memory: a page associated with the logical address can be retrieved from the off-chip memory containing the encrypted information; the retrieved page can be decrypted to generate unencrypted information; and the unencrypted information can be stored in a frame of the on-chip memory.