# US 2017/0286320 A1 · Avoiding redundant memory encryption in a cryptographic protection system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2017/0286320 A1 - Document ID: US20170286320A1 - Status: Published application - Kind: A1 - Application number: 15/089,280 - Filed: 2016-04-01 - Published: 2017-10-05 - Earliest claimed: 2016-04-01 - Assignees: Intel Corporation - Applicants: Intel Corporation - Inventors: SIDDHARTHA CHHABRA; DAVID M. DURHAM; PRASHANT DEWAN - Web page: https://patentgrep.com/patent/US20170286320A1 ## CPC - G06F 13/28: using burst mode transfer, e.g. direct memory access {DMA}, cycle steal (G06F13/32 takes precedence) - G06F 12/145: {the protection being virtual, e.g. for virtual blocks or segments before a translation mechanism} - G06F 2212/1052: Security improvement - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract This disclosure is directed to avoiding redundant memory encryption in a cryptographic protection system. Data stored in a device may be protected using different encryption systems. Data associated with at least one trusted execution environment (TEE) may be encrypted using a first encryption system. Main memory in the device may comprise data important to maintaining the integrity of an operating system (OS), etc. and may be encrypted using a second encryption system. Data may also be placed into a memory location via direct memory access (DMA) and may be protected utilizing a third encryption system. Redundant encryption may be avoided by encryption circuitry capable of determining when data is already protected by encryption provided by another system. For example, the encryption circuitry may comprise encryption control circuitry that monitors indicators set at different points during data handling, and may bypass certain data encryption or decryption operations based on the indicator settings. ## Claims ### Claim 1 A device equipped for cryptographic memory protection, comprising: memory circuitry to store data, the memory circuitry including a first region in which encrypted data associated with at least one trusted execution environment is stored, a second region in which encrypted data associated with general memory is stored and at least one memory location in which encrypted data received via direct memory access is stored; and processing circuitry to process the data stored in the memory circuity, the processing circuitry including encryption circuitry to avoid redundant memory encryption by controlling at least one of a first encryption engine to perform data encryption and decryption for the first region or a second encryption engine to perform data encryption and decryption for the second region. ### Claim 2 (depends on 1) The device of claim 1, wherein the processing circuitry is based on Secure Guard Extensions (SGX) technology and the encryption circuitry includes a memory encryption engine (MEE). ### Claim 3 (depends on 1) The device of claim 1, wherein the first region corresponds to a first fixed range of memory addresses and the second region corresponds to a second fixed range of memory addresses. ### Claim 4 (depends on 1) The device of claim 1, further comprising input/output (I/O) circuitry to receive or generate I/O data and store the I/O data in the memory circuitry via direct memory access. ### Claim 5 (depends on 1) The device of claim 1, further comprising a third encryption engine to perform at least data encryption for the at least one memory location. ### Claim 6 (depends on 5) The device of claim 5, wherein the third encryption engine is to set a protection indicator bit indicating that data received via direct memory access has been encrypted. ### Claim 7 (depends on 6) The device of claim 6, wherein the processing circuitry is to cause an operating system in the device to set a secure I/O indicator bit associated with the at least one memory location, the secure I/O indicator bit indicating that the at least one memory location is a secure memory location. ### Claim 8 (depends on 7) The device of claim 7, wherein the processing circuitry comprises a translation lookaside buffer and the processing circuitry is to load a translation and the secure I/O indicator bit into the translation lookaside buffer. ### Claim 9 (depends on 7) The device of claim 7, wherein the encryption circuitry comprises at least encryption control circuitry, the first encryption engine and the second encryption engine. ### Claim 10 (depends on 9) The device of claim 9, wherein the encryption circuitry also comprises the third encryption engine. ### Claim 11 (depends on 9) The device of claim 9, wherein the encryption control circuitry is to control data encryption and decryption involving at least the second encryption engine based on a setting of at least one of the protection indicator bit and the secure I/O indicator bit. ### Claim 12 A method for cryptographic memory protection, comprising: receiving an access request at processing circuitry in a device to access a memory location in memory circuitry in the device, the memory circuitry including a first region in which encrypted data associated with at least one trusted execution environment is stored, a second region in which encrypted data associated with general memory is stored and at least one memory location in which encrypted data received via direct memory access is stored; determining, in encryption circuitry within the processing circuitry, the setting of at least one indicator bit corresponding to the data or the memory location; and avoiding redundant memory encryption by controlling, in the encryption circuitry, at least one of a first encryption engine in the encryption circuitry to perform data encryption and decryption for the first region or a second encryption engine to perform data encryption and decryption for the second region of the memory circuitry. ### Claim 13 (depends on 12) The method of claim 12, wherein accessing a memory location comprises writing data to the memory location or reading data from the memory location. ### Claim 14 (depends on 13) The method of claim 13, further comprising: determining, when an access request comprising data to be written is received via direct memory access, if the data to be written is to be encrypted prior to being written; and encrypting the data to be written utilizing a third encryption engine and setting a protection indicator bit associated with the data to be written based on a determination that the data to be written is to be encrypted prior to being written. ### Claim 15 (depends on 14) The method of claim 14, further comprising: determining if the protection indicator bit is set; controlling the second encryption engine to avoid encrypting the data to be written and based on a determination that the protection indicator bit is set; controlling the second encryption engine to encrypt the data to be written based on a determination that the protection indicator bit is not set; and forwarding the access request to a memory controller in the processing circuitry. ### Claim 16 (depends on 15) The method of claim 15, further comprising: storing the data to be written in the memory location. ### Claim 17 (depends on 12) The method of claim 12, further comprising: determining, when a request to read data is received, if a secure I/O indicator bit associated with the memory location is set; and setting the secure I/O indicator bit for a transaction corresponding to the request to read data based on a determination that the secure I/O indicator bit associated with the memory location is set. ### Claim 18 (depends on 17) The method of claim 17, further comprising: determining if the secure I/O indicator bit is set in the transaction; controlling the second encryption engine to avoid decrypting the data to be read based on a determination that the protection indicator bit is set in the transaction; controlling the second encryption engine to decrypt the data to be read based on a determination that the protection indicator bit is not set in the transaction; and forwarding the access request to a memory controller in the processing circuitry. ### Claim 19 At least one machine-readable storage medium having stored thereon, individually or in combination, instructions for cryptographic memory protection that, when executed by one or more processors, cause the one or more processors to: receive an access request at processing circuitry in a device to access a memory location in memory circuitry in the device, the memory circuitry including a first region in which encrypted data associated with at least one trusted execution environment is stored, a second region in which encrypted data associated with general memory is stored and at least one memory location in which encrypted data received via direct memory access is stored; determine, in encryption circuitry within the processing circuitry, the setting of at least one indicator bit corresponding to the data or the memory location; and avoid redundant memory encryption by controlling, in the encryption circuitry, at least one of a first encryption engine in the encryption circuitry to perform data encryption and decryption for the first region or a second encryption engine to perform data encryption and decryption for the second region of the memory circuitry. ### Claim 20 (depends on 19) The storage medium of claim 19, wherein the instructions to access a memory location comprise instructions to write data to the memory location or read data from the memory location. ### Claim 21 (depends on 20) The storage medium of claim 20, further comprising instructions that, when executed by one or more processors, cause the one or more processors to: determine, when an access request comprising data to be written is received via direct memory access, if the data to be written is to be encrypted prior to being written; and encrypt the data to be written utilizing a third encryption engine and set a protection indicator bit associated with the data to be written based on a determination that the data to be written is to be encrypted prior to being written. ### Claim 22 (depends on 21) The storage medium of claim 21, further comprising instructions that, when executed by one or more processors, cause the one or more processors to: determine if the protection indicator bit is set; control the second encryption engine to avoid encrypting the data to be written based on a determination that the protection indicator bit is set; control the second encryption engine to encrypt the data to be written based on a determination that the protection indicator bit is not set; and forward the access request to a memory controller in the processing circuitry. ### Claim 23 (depends on 22) The storage medium of claim 22, further comprising instructions that, when executed by one or more processors, cause the one or more processors to: store the data to be written in the memory location. ### Claim 24 (depends on 20) The storage medium of claim 20, further comprising instructions that, when executed by one or more processors, cause the one or more processors to: determine, when a request to read data is received, if a secure I/O indicator bit associated with the memory location is set; and set the secure I/O indicator bit for a transaction corresponding to the request to read data based on a determination that the secure I/O indicator bit associated with the memory location is set. ### Claim 25 (depends on 24) The storage medium of claim 24, further comprising instructions that, when executed by one or more processors, cause the one or more processors to: determine if the secure I/O indicator bit is set in the transaction; control the second encryption engine to avoid decrypting the data to be read based on a determination that the protection indicator bit is set in the transaction; control the second encryption engine to decrypt the data to be read based on a determination that the protection indicator bit is not set in the transaction; and forward the access request to a memory controller in the processing circuitry.