Apparatus and Method for Memory Address Encryption

An apparatus comprising:

• a microprocessor for providing an original logical address,
• an MMU for generating a shifted logical address depending on the original logical address,
• an address encryption unit for encrypting the shifted logical address to obtain a physical address, the address encryption unit comprising an input interface for receiving the shifted logical address, and further comprising an encryption module for encrypting the shifted logical address depending on a cryptographic key to obtain the physical address, wherein the encryption module is configured to encrypt the shifted logical address by applying a map mapping the shifted logical address to the physical address, wherein the encryption module is configured to apply the map by conducting a multiplication and a modulo operation using the cryptographic key and a divisor of the modulo operation, such that the map is bijective,
• a data encryption-decryption unit for encrypting first plaintext data to obtain first ciphertext data and for decrypting second ciphertext data to obtain second plaintext data,
• a key storage for storing the cryptographic key,
• and a memory being configured to either store the first ciphertext data at the physical address, or to provide the second ciphertext data being stored at the physical address to the data encryption-decryption module.

A method for encrypting an input memory address to obtain an encrypted memory address, comprising:

• receiving the input memory address being an address of a memory,
• segmenting the input memory address into a plurality of input memory address segments, and
• encrypting each input memory address segment of the plurality of input memory address segments depending on a respective one of a plurality of cryptographic subkeys to obtain the encrypted memory address, wherein encrypting said input memory address segment comprises applying a map mapping said input memory address segment to an encrypted memory address segment of a plurality of encrypted memory address segments by conducting a multiplication and a modulo operation using one of the plurality of cryptographic subkeys and one of a plurality of divisors, such that the map is bijective,
• wherein the encrypted memory address segments of the plurality of encrypted memory address segments together form the encrypted memory address.