Encrypted data processing design including cleartext register files

A processor comprising:

• a cache of a central processing unit (CPU) configured to store ciphertext data;
• a register file configured to store cleartext data, the register file accessible by functional units of the CPU, wherein protection tags are set to on for any register entries of the register file that are protected by encrypted data processing (EDAP) responsive to data of such register entries originating from load instructions, wherein the protection tags are set to on by setting bit placeholders associated with the protection tags in each respective register entry to a first value;
• functional units configured to process the cleartext data from the register file, wherein the cleartext data of the register file is only accessible by the functional units during execution;
• and
• an encryption unit configured to decrypt ciphertext data from the cache into cleartext to be loaded into the register file and further configured to encrypt cleartext computation results from the register file into ciphertext computation results to be stored into the cache upon execution by the functional units, wherein the register file storing cleartext data is only available to an authorized application having access to an encryption key used to encrypt and decrypt the data by the encryption unit.

A computer program product comprising one or more computer readable storage media, and program instructions collectively stored on the one or more computer readable storage media, the program instructions comprising instructions configured to cause one or more processors to perform a method comprising:

• accessing, in response to a load instruction, encrypted data from a cache of a central processing unit (CPU) to be loaded into a register entry of a register file, the register file accessible by at least one functional unit of the CPU;
• setting, based on the accessing being responsive to the load instruction, a protection tag within the register entry to on by setting a bit placeholder associated with the protection tag to a first value, wherein protection tags are set to on for any register entries of the register file that are protected by encrypted data processing (EDAP) responsive to data of such register entries originating from load instructions;
• decrypting, in response to receiving an encryption key from an application authorized to access the encrypted data, the encrypted data to receive cleartext data;
• writing the cleartext data to the register entry, wherein the cleartext data written to the register entry is only accessible by the at least one functional unit during execution;
• processing the cleartext data using the at least one functional unit to receive cleartext computation results;
• writing the cleartext computation results back to the register entry;
• accessing the cleartext computation results within the register entry;
• encrypting, in response to receiving the encryption key from the application authorized to access the encrypted data, the cleartext computation results to receive ciphertext computation results;
• and
• storing the ciphertext computation results to the cache of the CPU.