Back to results
US 2016/0104010 A1Published application
Microprocessor with secure execution mode and store key instructions
AssigneeVIA Technologies, Inc.
InventorsG. GLENN HENRY, TERRY PARKS, BRENT BEAN, THOMAS A. CRISPIN
Life of this patent
Estimating the term…
Abstract
A microprocessor conditionally grants a request to switch from a normal execution mode in which encrypted instructions cannot be executed, into a secure execution mode (SEM). Thereafter, the microprocessor executes a plurality of instructions, including a store-key instruction to write a set of one or more cryptographic key values into a secure memory of the microprocessor. After fetching an encrypted program from an instruction cache, the microprocessor decrypts the encrypted program into plaintext instructions using decryption logic within the microprocessor's instruction-processing pipeline.
Claims21
A microprocessor comprising:
- an instruction-processing pipeline;
- a processor bus;
- a cache memory hierarchy;
- and
- a secure memory, inaccessible via the processor bus and not part of the cache memory hierarchy, configured to store cryptographic keys;
- wherein the microprocessor is configured to restrict access to the secure memory by preventing a non-privileged program from reading or writing cryptographic key values to or from the secure memory;
- wherein the microprocessor is further configured to:
- receive a request to switch from a normal execution mode in which encrypted instructions cannot be executed, into a secure execution mode (SEM), in which they can;
- conditionally grant the request;
- execute an instruction to write a set of one or more cryptographic key values into a secure memory of the microprocessor;
- fetch an encrypted program from an instruction cache;
- and
- decrypt the encrypted program into plaintext instructions using decryption logic within the instruction-processing pipeline, the decryption logic using cryptographic key values stored in the secure memory, or one or more derivatives thereof, to decrypt the encrypted program;
- and
- execute the program without exposing the plaintext instructions to any non-privileged program or to any resources external to the microprocessor.
12 more elements
A method of securely executing encrypted instructions within a microprocessor, the method comprising:
- receiving a request to switch from a normal execution mode in which encrypted instructions cannot be executed, into a secure execution mode (SEM), in which they can;
- conditionally granting the request;
- executing an instruction to write a set of cryptographic key values into a secure memory of the microprocessor, wherein the secure memory is inaccessible from a processor bus of the microprocessor and is not part of a cache memory hierarchy, and wherein the non-privileged program is unable to read or write cryptographic key values from or to the secure memory;
- fetching an encrypted program from an instruction cache;
- and
- decrypting the encrypted program into plaintext instructions using decryption logic within the instruction-processing pipeline, and using one or more sets of one or more cryptographic key values stored in the secure memory, or one or more derivatives thereof, to decrypt the encrypted program;
- and
- executing the program without exposing the plaintext instructions to any non-privileged program or to any resources external to the microprocessor.
5 more elements
A computer program product encoded in at least one non-transitory computer usable medium for use with a computing device, the computer program product comprising:
- computer usable program code embodied in said medium, for specifying a microprocessor, the computer usable program code comprising:
- first program code for specifying a processor bus;
- second program code for specifying a cache memory hierarchy;
- and
- third program code for specifying a secure memory, inaccessible via the processor bus and not part of the cache memory hierarchy, configured to store cryptographic keys;
- fourth program code for specifying a configuration of the microprocessor to restrict access to the secure memory by preventing a non-privileged program from reading or writing cryptographic key values to or from the secure memory;
- fifth program code for specifying a configuration of the microprocessor to receive a request to switch from a normal execution mode in which encrypted instructions cannot be executed, into a secure execution mode (SEM), in which they can;
- sixth program code for specifying a configuration of the microprocessor to conditionally grant the request;
- seventh program code for specifying a configuration of the microprocessor to execute an instruction to write a set of one or more cryptographic key values into a secure memory of the microprocessor;
- eighth program code for specifying a configuration of the microprocessor to fetch an encrypted program from an instruction cache;
- and
- ninth program code for specifying a configuration of the microprocessor to decrypt the encrypted program into plaintext instructions using a decoder within the microprocessor, and using one or more sets of one or more cryptographic key values stored in the secure memory, or one or more derivatives thereof, to decrypt the encrypted program;
- and
- tenth program code for specifying a configuration of the microprocessor to execute the program without exposing the plaintext instructions to any non-privileged program or to any resources external to the microprocessor.
11 more elements
Dependencies are inferred from the claim text.