Protecting execution environments within domains using encryption environment id to generate encryption key

A method comprising:

• performing processing in one of a fixed number of at least two domains, one of the domains being subdivided into a variable number of execution environments;
• using, by memory protection circuitry, a key input to perform encryption or decryption on data of a memory access request, issued to a memory address, from within a current one of the domains;
• translate, by memory translation circuitry, the memory address from a virtual memory address to a physical memory address;
• and
• provide, by the memory translation circuitry, an encryption environment identifier used to generate the key input, wherein the key input is different for each of the domains and for each of the execution environments;
• the key input for each of the domains is fixed at boot time of the apparatus;
• the key input for each of the execution environments is dynamic;
• and
• the memory access request is forwarded from the memory translation circuitry to the memory protection circuitry with the encryption environment identifier.

A non-transitory storage computer readable storage medium comprising a computer program for controlling a host data processing apparatus to provide an instruction execution environment for execution of target code, the computer program comprising:

• processing program logic configured to simulate processing of the target code in one of at least two domains, one of the domains being subdivided into a variable number of execution environments;
• and
• memory protection logic configured to use a key input to perform encryption or decryption on data of a memory access request, issued to a memory address, from within a current one of the domains;
• and
• memory translation protection logic configured to (i) translate the memory address from a virtual memory address to a physical memory address and (ii) to provide an encryption environment identifier used to generate the key input, wherein the key input is different for each of the domains and for each of the execution environments;
• the key input for each of the domains is fixed at boot time of the apparatus;
• the key input for each of the execution environments is dynamic;
• and
• the memory access request is forwarded from the memory translation protection logic to the memory protection logic with the encryption environment identifier.