Indirection directories for cryptographic memory protection

At least one non-transitory machine accessible storage medium having instructions stored thereon, the instructions when executed on a machine, cause the machine to:

• identify a particular page in computer memory to be secured;
• allocate a metadata page in computer memory to store a first portion of security metadata for use in securing the particular page, wherein a second portion of the security metadata is to be pre-allocated in a secured portion of the computer memory, wherein the secured portion of the computer memory comprises on-die memory;
• and
• enter an address of the metadata page in a particular pointer in an indirection directory, wherein the indirection directory is pre-allocated in the secured portion of the computer memory, and the particular pointer is mapped to an address of the particular page,
• wherein the first portion of the metadata is to be stored outside the secured portion of the computer memory, the first portion of security metadata is to comprise a root of a replay integrity tree associated with the particular page, and the second portion of the security metadata comprises layers of the replay integrity tree associated with the particular page, wherein at least a portion of the replay integrity tree is stored in the secured portion of the computer memory and another portion of the replay integrity tree is stored outside the secured portion of the computer memory.

A system comprising:

• a processor;
• a memory comprising a secured region, wherein the secured region stores at least a portion of an indirection directory and first security metadata to implement at least a root of a replay integrity tree;
• and
• a memory encryption engine (MEE) comprising circuitry to:
• receive a request for data in a particular page of memory in the secured region;
• access a pointer in the indirection directory, wherein the pointer is to point to a particular metadata page of memory outside the secured region, the particular metadata page comprises second security metadata, the second security metadata comprises layers of the replay integrity tree other than the root of the replay integrity tree, and the replay integrity tree is for use in securing the data of the particular page;
• retrieve the second security metadata from the particular metadata page;
• and
• determine authenticity of the data of the particular page based on the replay integrity tree stored in the first and second security metadata.