Techniques for multi-domain memory encryption
AssigneeIntel Corporation
InventorsSIDDHARTHA CHHABRA, DAVID M. DURHAM
Life of this patent
Estimating the term…
Abstract
Various embodiments are generally directed to techniques for multi-domain memory encryption, such as with a plurality of cryptographically isolated domains, for instance. Some embodiments are particularly directed to a multi-domain encryption system that provides one or more of memory encryption, integrity, and replay protection services to a plurality of cryptographic domains. In one embodiment, for example, an apparatus may comprise a memory and logic for an encryption engine, at least a portion of the logic implemented in circuitry coupled to the memory. In various embodiments, the logic may receive a memory operation request associated with a data line of a set of data lines stored in a protected memory separate from the memory.
Claims22
An apparatus, comprising:
- circuitry;
- and
- memory coupled to the circuitry, the memory comprising a plurality of domain keys and instructions, the instructions when executed by the circuitry cause the circuitry to:
- receive a memory operation request associated with a data line of a plurality of data lines comprised in a protected memory;
- identify a first cryptographic domain of a plurality of cryptographic domains based on the memory operation, the first cryptographic domain associated with a first one of the plurality of domain keys;
- and
- utilize a non-temporal move on the data line with a second domain key of the plurality of domain keys to change association of the data line from the first cryptographic domain to a second cryptographic domain, the second cryptographic domain associated with the second one of the plurality of domain keys.
A non-transitory computer-readable medium comprising instructions that, in response to being executed by circuitry in a trusted execution environment (TEE) comprising the circuitry and memory comprising a plurality of domain keys, cause the circuitry to:
- receive a memory operation request associated with a data line of a plurality of data lines comprised in a protected memory;
- identify a first cryptographic domain of a plurality of cryptographic domains based on the memory operation, the first cryptographic domain associated with a first one of the plurality of domain keys;
- and
- utilize a non-temporal move on the data line with a second domain key of the plurality of domain keys to change association of the data line from the first cryptographic domain to a second cryptographic domain, the second cryptographic domain associated with the second one of the plurality of domain keys.
A method, comprising:
- receiving, at circuitry of a trusted execution environment (TEE), a memory operation request associated with a data line of a plurality of data lines comprised in a protected memory;
- identifying a first cryptographic domain of a plurality of cryptographic domains based on the memory operation, the first cryptographic domain associated with a first one of a plurality of domain keys stored in a memory of the TEE;
- and
- utilizing a non-temporal move on the data line with a second domain key of the plurality of domain keys to change association of the data line from the first cryptographic domain to a second cryptographic domain, the second cryptographic domain associated with the second one of the plurality of domain keys.
Dependencies are inferred from the claim text.