Method for fast decryption of processor instructions in an encrypted instruction power architecture
AssigneeInternational Business Machines Corporation
InventorsGordon McIntosh, Edward Silha
Life of this patent
Estimating the term…
Abstract
A method and apparatus are provided for an independent operating system for the prevention of certain classes of computer attacks that have previously not been preventable. Detailed is an effective methodology to implement instruction decryption using the existing instruction set for a processor. Significant hurdles are addressed in the processor architecture so as to limit the impact to processor execution timing. Instruction execution timing is not altered in the processor core. Any additional processing is overlapped into existing operations and, therefore, the impact on processor throughput is minimal.
Claims20
A method in a data processing system for preventing attacks, the method comprising:
- fetching an encrypted architected instruction;
- separating the encrypted architected instruction into one or more encrypted opcodes and a set of instruction bits;
- decrypting the one or more encrypted opcodes using one of a plurality of modes to form one or more decrypted opcodes;
- combining the one or more decrypted opcodes and the set of instruction bits to form a decrypted architected instruction;
- and
- passing the decrypted architected instruction to an instruction execution unit.
A data processing system comprising:
- a bus system;
- a communications system connected to the bus system;
- a memory connected to the bus system, wherein the memory includes a set of instructions;
- an instruction execution unit;
- and
- a processing unit connected to the bus system, wherein the processing unit executes the set of instructions to fetch an encrypted architected instruction;
- separate the encrypted architected instruction into one or more encrypted opcodes and a set of instruction bits;
- decrypt the one or more encrypted opcodes using one of a plurality of modes to form one or more decrypted opcodes;
- combine the one or more decrypted opcodes and the set of instruction bits to form a decrypted architected instruction;
- and pass the decrypted architected instruction to an instruction execution unit.
A apparatus for preventing attacks, the apparatus comprising:
- fetching means for fetching an encrypted architected instruction;
- separating means for separating the encrypted architected instruction into one or more encrypted opcodes and a set of instruction bits;
- decrypting means for decrypting the one or more encrypted opcodes using one of a plurality of modes to form one or more decrypted opcodes;
- combining means for combining the one or more decrypted opcodes and the set of instruction bits to form a decrypted architected instruction;
- and
- passing means for passing the decrypted architected instruction to an instruction execution unit.
Dependencies are inferred from the claim text.