# US 8,751,830 B2 · Memory address translation-based data encryption/compression > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,751,830 B2 - Document ID: US8751830B2 - Status: Granted - Kind: B2 - Application number: 13/355,806 - Filed: 2012-01-23 - Published: 2013-07-25 - Granted: 2014-06-10 - Earliest claimed: 2012-01-23 - Assignees: International Business Machines Corporation - Applicants: Adam J. Muff; Paul E. Schardt; Robert A. Shearer; Matthew R. Tubbs - Inventors: Adam J. Muff; Paul E. Schardt; Robert A. Shearer; Matthew R. Tubbs - Web page: https://patentgrep.com/patent/US8751830B2 ## CPC - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G06F 12/1408: {by using cryptography (for digital transmission H04L9/00)} - G06F 12/10: Address translation - G06F 12/145: {the protection being virtual, e.g. for virtual blocks or segments before a translation mechanism} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method and circuit arrangement selectively stream data to an encryption or compression engine based upon encryption and/or compression-related page attributes stored in a memory address translation data structure such as an Effective To Real Translation (ERAT) or Translation Lookaside Buffer (TLB). A memory address translation data structure may be accessed, for example, in connection with a memory access request for data in a memory page, such that attributes associated with the memory page in the data structure may be used to control whether data is encrypted/decrypted and/or compressed/decompressed in association with handling the memory access request. ## Claims ### Claim 1 A method of accessing data in a data processing system, the method comprising: in response to a memory access request initiated by a thread in a processing core, accessing a memory address translation data structure to perform a memory address translation for the memory access request; accessing an encryption-related page attribute in the memory address translation data structure to determine whether the memory page associated with the memory access request is encrypted, wherein the encryption-related page attribute comprises a level attribute that identifies at least one level of a multi-level memory architecture within which the memory page is encrypted; and selectively streaming secure data in the memory page through an encryption engine to perform an encryption operation on the secure data based upon whether the memory page associated with the memory access request is determined to be encrypted; wherein the memory access request comprises a first memory access request associated with a first process executed by the processing core, the method further comprising: in response to a second memory access request associated with a second process that is not authorized to access the memory page, asserting a software exception; and in response to the second memory access request, determining whether the memory page is encrypted, and when the memory page is encrypted, indicating that the page is encrypted when asserting the software exception. ### Claim 2 (depends on 1) The method of claim 1, wherein the memory address translation data structure includes a plurality of page table entries, each page table entry including a real address associated with the memory page associated with the page table entry and the encryption-related page attribute associated with such memory page. ### Claim 3 (depends on 1) The method of claim 1, further comprising, in response to a second memory access request initiated by a second thread, restricting access to the memory page by the second thread by comparing a process identifier associated with the second thread to access control data in the memory address translation data structure and denying access to the memory page by the second thread in response to the comparison. ### Claim 4 (depends on 1) The method of claim 1, further comprising in response to a third memory access request associated with a third process that is not authorized to access the memory page, determining whether the memory page is encrypted, and if so, performing a system shutdown. ### Claim 5 (depends on 1) The method of claim 1, wherein the encryption-related page attribute comprises an encrypted attribute that indicates whether the memory page is encrypted. ### Claim 6 (depends on 1) The method of claim 1, wherein selectively streaming secure data in the memory page through the encryption engine is based upon whether the level attribute indicates that the memory page is encrypted at a source or destination level for the memory access request. ### Claim 7 (depends on 1) The method of claim 1, wherein the encryption operation is selected from the group consisting of encrypting the secure data and decrypting the secure data. ### Claim 8 A circuit arrangement, comprising: a multi-core processor including a plurality of processing cores; and a memory address translation data structure disposed in a first processing core among the plurality of processing cores, the memory address translation data structure configured to store address translation data for a memory page, wherein the memory address translation data structure is further configured to store an encryption-related page attribute for the memory page, wherein the encryption-related page attribute comprises a level attribute that identifies at least one level of a multi-level memory architecture within which the memory page is encrypted; wherein the multi-core processor is configured to, in response to a memory access request initiated by a thread in the first processing core and associated with the memory page, selectively stream secure data from the memory page through an encryption engine to perform an encryption operation on the secure data based upon whether the memory page associated with the memory access request is encrypted, wherein the memory access request comprises a first memory access request associated with a first process executed by the processing core, and wherein the first processing core is configured to, in response to a second memory access request associated with a second process that is not authorized to access the memory page, determine whether the memory page is encrypted, and when the memory page is encrypted, indicate that the page is encrypted when asserting a software exception. ### Claim 9 (depends on 8) The circuit arrangement of claim 8, wherein the memory address translation data structure includes a plurality of page table entries, each page table entry including a real address associated with the memory page associated with the page table entry and the encryption-related page attribute associated with such memory page. ### Claim 10 (depends on 8) The circuit arrangement of claim 8, wherein the first processing core is configured to, in response to a third memory access request associated with a third process that is not authorized to access the memory page, determine whether the memory page is encrypted, and if so, perform a system shutdown. ### Claim 11 (depends on 8) The circuit arrangement of claim 8, wherein the multi-core processor is configured to selectively stream secure data in the memory page through the encryption engine based upon whether the level attribute indicates that the memory page is encrypted at a source or destination level for the memory access request. ### Claim 12 (depends on 8) The circuit arrangement of claim 8, wherein the encryption operation is selected from the group consisting of encrypting the secure data and decrypting the secure data. ### Claim 13 A method of accessing data in a data processing system, the method comprising: in response to a memory access request initiated by a thread in a processing core, accessing a memory address translation data structure to perform a memory address translation for the memory access request; accessing an encryption-related page attribute in the memory address translation data structure to determine whether the memory page associated with the memory access request is encrypted; and selectively streaming secure data in the memory page through an encryption engine to perform an encryption operation on the secure data based upon whether the memory page associated with the memory access request is determined to be encrypted; wherein the memory access request comprises a first memory access request associated with a first process executed by the processing core, the method further comprising: in response to a second memory access request associated with a second process that is not authorized to access the memory page, determining whether the memory page is encrypted, and when the memory page is encrypted if so, performing a system shutdown. ### Claim 14 A circuit arrangement, comprising: a multi-core processor including a plurality of processing cores; and a memory address translation data structure disposed in a first processing core among the plurality of processing cores, the memory address translation data structure configured to store address translation data for a memory page, wherein the memory address translation data structure is further configured to store an encryption-related page attribute for the memory page; wherein the multi-core processor is configured to, in response to a memory access request initiated by a thread in the first processing core and associated with the memory page, selectively stream secure data from the memory page through an encryption engine to perform an encryption operation on the secure data based upon whether the memory page associated with the memory access request is encrypted, wherein the memory access request comprises a first memory access request associated with a first process executed by the processing core, and wherein the first processing core is configured to, in response to a second memory access request associated with a second process that is not authorized to access the memory page, determine whether the memory page is encrypted, and when the memory page is encrypted, perform a system shutdown. ### Claim 15 (depends on 1) The method of claim 1, further comprising: in response to a third memory access request, accessing the memory address translation data structure to perform a memory address translation for the third memory access request; accessing a compression-related page attribute in the memory address translation data structure to determine whether a second memory page associated with the third memory access request is compressed; and selectively streaming data in the second memory page through a compression engine to perform a compression operation on the data based upon whether the second memory page associated with the third memory access request is determined to be compressed. ### Claim 16 (depends on 15) The method of claim 15, wherein each page table entry in the memory address translation data structure further includes a compression-related page attribute. ### Claim 17 (depends on 15) The method of claim 15, wherein the compression-related page attribute comprises a compression-related level attribute that identifies at least one level of the multi-level memory architecture within which the second memory page is compressed, and wherein selectively streaming data in the second memory page through the compression engine is based upon whether the compression-related level attribute indicates that the second memory page is compressed at a source or destination level for the third memory access request. ### Claim 18 (depends on 15) The method of claim 15, wherein the compression operation is selected from the group consisting of compressing the data and decompressing the data. ### Claim 19 (depends on 8) The circuit arrangement of claim 8, wherein the multi-core processor is further configured to: in response to a third memory access request, access the memory address translation data structure to perform a memory address translation for the third memory access request; access a compression-related page attribute in the memory address translation data structure to determine whether a second memory page associated with the third memory access request is compressed; and selectively stream data in the second memory page through a compression engine to perform a compression operation on the data based upon whether the second memory page associated with the third memory access request is determined to be compressed. ### Claim 20 (depends on 19) The method of claim 19, wherein each page table entry in the memory address translation data structure further includes a compression-related page attribute. ### Claim 21 (depends on 19) The method of claim 19, wherein the compression-related page attribute comprises a compression-related level attribute that identifies at least one level of the multi-level memory architecture within which the second memory page is compressed, and wherein the multi-core processor is configured to selectively stream data in the second memory page through the compression engine based upon whether the compression-related level attribute indicates that the second memory page is compressed at a source or destination level for the third memory access request. ### Claim 22 (depends on 19) The method of claim 19, wherein the compression operation is selected from the group consisting of compressing the data and decompressing the data.