摘要:
A method and system to provide an effective, scalable and yet low-cost solution for Confidentiality, Integrity and Replay protection for sensitive information stored in a memory and prevent an attacker from observing and/or modifying the state of the system. In one embodiment of the invention, the system has strong hardware protection for its memory contents via XTS-tweak mode of encryption where the tweak is derived based on “Global and Local Counters”. This scheme offers to enable die-area efficient Replay protection for any sized memory by allowing multiple counter levels and facilitates using small counter-sizes to derive the “tweak” used in the XTS encryption without sacrificing cryptographic strength.
摘要:
A processor includes a memory encryption engine that provides replay and confidentiality protections to a memory region. The memory encryption engine performs low-overhead parallelized tree walks along a counter tree structure. The memory encryption engine upon receiving an incoming read request for the protected memory region, performs a dependency check operation to identify dependency between the incoming read request and an in-process request and to remove the dependency when the in-process request is a read request that is not currently suspended.
摘要:
A method and system to provide a low-overhead cryptographic scheme that affords memory confidentiality, integrity and replay-protection by removing the critical read-after-write dependency between the various levels of the cryptographic tree. In one embodiment of the invention, the cryptographic processing of a child node can be pipelined with that of the parent nodes. This parallelization provided by the invention results in an efficient utilization of the cryptographic pipeline, enabling significantly lower performance overheads.
摘要:
A processor includes a memory encryption engine that provides replay and confidentiality protections to a memory region. The memory encryption engine performs low-overhead parallelized tree walks along a counter tree structure. The memory encryption engine upon receiving an incoming read request for the protected memory region, performs a dependency check operation to identify dependency between the incoming read request and an in-process request and to remove the dependency when the in-process request is a read request that is not currently suspended.
摘要:
A method and system to provide an effective, scalable and yet low-cost solution for Confidentiality, Integrity and Replay protection for sensitive information stored in a memory and prevent an attacker from observing and/or modifying the state of the system. In one embodiment of the invention, the system has strong hardware protection for its memory contents via XTS-tweak mode of encryption where the tweak is derived based on “Global and Local Counters”. This scheme offers to enable die-area efficient Replay protection for any sized memory by allowing multiple counter levels and facilitates using small counter-sizes to derive the “tweak” used in the XTS encryption without sacrificing cryptographic strength.
摘要:
A method and system to provide a low-overhead cryptographic scheme that affords memory confidentiality, integrity and replay-protection by removing the critical read-after-write dependency between the various levels of the cryptographic tree. In one embodiment of the invention, the cryptographic processing of a child node can be pipelined with that of the parent nodes. This parallelization provided by the invention results in an efficient utilization of the cryptographic pipeline, enabling significantly lower performance overheads.
摘要:
Encryption interface technologies are described. A processor can include a system agent, an encryption interface, and a memory controller. The system agent can communicate data with a hardware functional block. The encryption interface can be coupled between the system agent and a memory controller. The encryption interface can receive a plaintext request from the system agent, encrypt the plaintext request to obtain an encrypted request, and communicate the encrypted request to the memory controller. The memory controller can communicate the encrypted request to a main memory of the computing device.
摘要:
Memory encryption engine (MEE) integration technologies are described. A processor can include a processor core and an arbiter of a MEE system coupled to the processor core. The arbiter can receive a first contending request from a first queue and a second contending request from a second queue. The arbiter can further select the first queue to communicate the first message to an MEE of the MEE system or the second queue to communicate the second message to the MEE in view of arbitration criteria. The arbiter can further communicate the selected first message or the selected second message to the MEE.
摘要:
Memory encryption engine (MEE) integration technologies are described. A processor can include a processor core and an arbiter of a MEE system coupled to the processor core. The arbiter can receive a first contending request from a first queue and a second contending request from a second queue. The arbiter can further select the first queue to communicate the first message to an MEE of the MEE system or the second queue to communicate the second message to the MEE in view of arbitration criteria. The arbiter can further communicate the selected first message or the selected second message to the MEE.
摘要:
A processor is described that includes one or more processing cores. The processor includes a memory controller to interface with a system memory having a protected region and a non protected region. The processor includes a protection engine to protect against active and passive attacks. The processor includes an encryption/decryption engine to protect against passive attacks. The protection engine includes bridge circuitry coupled between the memory controller and the one or more processing cores. The bridge circuitry is also coupled to the protection engine and the encryption/decryption engine. The bridge circuitry is to route first requests directed to the protected region to the protection engine and to route second requests directed to the non protected region to the encryption/decryption engine.