Memory isolation security in a data processing system

A method of providing isolation security for a memory, the method comprising:

• storing an access match value comprising a tweak value concatenated with address bits defining an address range in the memory;
• receiving a request to access the memory;
• determining that the access is a write access to an address of the memory;
• determining that an access count of accesses to the memory is less than a predetermined value;
• choosing a dummy address for a read access;
• reading a first tag for the dummy address, wherein the first tag equaling a message authentication code (MAC) function of respective encrypted data and the tweak value for the address range, wherein the first tag is stored in a memory location of the memory that is sized to store parity bits;
• calculating a second tag, the second tag equaling a MAC function of encrypted data stored at the dummy address and the tweak value;
• comparing the second tag with the first tag to determine that the access is valid when the first tag matches the second tag;
• updating the access count in response to the first tag and the second tag matching;
• determining that the updated access count is equal to the predetermined value;
• calculating a third tag as a MAC function of encrypted data at the address to be written to and the tweak value;
• and
• performing the write access when the third tag and the first tag match.

A computer program comprising instructions stored in a non-transitory memory that when executed perform operations comprising:

• storing an access match value comprising a tweak value concatenated with address bits defining an address range in the non-transitory memory;
• receiving a request to access the non-transitory memory;
• determining that the access is a write access to an address of the non-transitory memory;
• determining that an access count of accesses to the memory is less than a predetermined value;
• choosing a dummy address for a read access;
• reading a first tag for the dummy address, wherein the first tag equaling a message authentication code (MAC) function of respective encrypted data and the tweak value for the address range, wherein the first tag is stored in a memory location of the non-transitory memory that is sized to store parity bits;
• calculating a second tag, the second tag equaling a MAC function of encrypted data stored at the dummy address and the tweak value;
• comparing the second tag with the first tag to determine that the access is valid when the first tag matches the second tag;
• updating the access count in response to the first tag matching the second tag;
• determining that the updated access count is equal to the predetermined value;
• calculating a third tag as a MAC function of encrypted data at the address to be written to and the tweak value;
• and
• performing the write access when the third tag matches the first tag.