Microprocessor with on-the-fly switching of decryption keys

A method of securely executing instructions in a microprocessor, the method comprising:

• storing a first set of one or more cryptographic keys for decrypting encrypted instructions into a secure memory;
• fetching a first set of encrypted instructions;
• decrypting the first set of encrypted instructions using the first set of one or more cryptographic keys;
• fetching an encrypted store-key instruction to store a second set of one or more cryptographic keys for decrypting encrypted instructions into a secure memory;
• decrypting the encrypted store-key instruction using the first set of one or more cryptographic keys;
• executing the decrypted store-key instruction by storing the second set of one or more cryptographic keys into the secure memory;
• fetching a second set of encrypted instructions;
• decrypting the second set of encrypted instructions using the second set of one or more cryptographic keys.

A computer program product encoded in at least one non-transitory computer usable medium for use with a computing device, the computer program product comprising:

• computer usable program code embodied in said medium, for specifying a microprocessor, the computer usable program code comprising:
• first program code for specifying a secure memory configured to store and provide cryptographic keys for use in decrypting encrypted instructions;
• and
• second program code for specifying an instruction-processing pipeline configured to fetch instructions from a cache and execute them, the pipeline comprising:
• third program code for specifying a fetch unit configured to fetch both unencrypted and encrypted instructions of an instruction set architecture (ISA) supported by the microprocessor, wherein the ISA includes an store-key instruction to store one or more cryptographic keys into the secure memory, and wherein the microprocessor supports store-key instructions that are encrypted;
• fourth program code for specifying a decryption circuit configured to decrypt encrypted instructions using cryptographic keys received from the secure memory;
• and
• fifth program code for specifying one or more execution units configured to execute instructions or microinstructions translated from instructions;
• sixth program code for specifying a configuration of the microprocessor to respond to an encrypted store-key instruction by using a first set of one or more cryptographic keys to decrypt the encrypted store-key instruction, and thereafter executing the decrypted store-key instruction, and thereafter using a second set of one or more cryptographic keys provided by the encrypted store-key instruction to decrypt a subsequent set of one or more encrypted instructions.