Protecting a memory
AssigneeIntel Corporation
InventorsEugene M. Kishinevsky, Siddhartha Chhabra, Men Long, Jungju Oh, David M. Durham
Life of this patent
Estimating the term…
Abstract
In an embodiment, a processor includes: at least one core to execute instructions; and a memory protection logic to encrypt data to be stored to a memory coupled to the processor, generate a message authentication code (MAC) based on the encrypted data, the MAC to have a first value according to a first key, obtain the encrypted data from the memory and validate the encrypted data using the MAC, where the MAC is to be re-keyed to have a second value according to a second key and without the encrypted data. Other embodiments are described and claimed.
Claims13
At least one non-transitory computer readable medium comprising instructions that when executed cause a system to:
- responsive to a read request from a hardware core of a processor, obtain, in a memory protection logic of the processor, encrypted data from a memory and decrypt the encrypted data according to a data dependent decryption mode to obtain decrypted data;
- generate a validation integrity value based on the encrypted data;
- decrypt an encrypted integrity value with a first key, the encrypted integrity value associated with the encrypted data;
- provide the decrypted data to the hardware core of the processor based on a comparison of the decrypted integrity value and the validation integrity value if the decrypted integrity value matches the validation integrity value, and if the decrypted integrity value does not match the validation integrity value, report an integrity violation and not provide the decrypted data to the hardware core of the processor;
- obtain the encrypted integrity value from the memory and again decrypt the encrypted integrity value with the first key;
- encrypt the decrypted integrity value with a second key to obtain a second encrypted integrity value, wherein the decryption again of the encrypted integrity value and the encryption of the integrity value with the second key are performed during a re-keying operation;
- and
- according to a re-keying schedule, re-key a plurality of integrity values each associated whit a data segment stored in the memory;
- arbitrate between a memory request and the re-keying operation for the integrity value;
- and
- select the re-keying operation for the integrity value when a first priority associated with the re-keying operation is greater than a second priority associated with the memory request.
A processor comprising:
- at least one core to execute instructions;
- and
- a memory protection logic comprising hardware circuitry to encrypt data to be stored to a memory coupled to the processor, generate a message authentication code (MAC) based on the encrypted data, the MAC to have a first value according to a first key, obtain the encrypted data from the memory and validate the encrypted data using the MAC, wherein the MAC is re-keyed to have a second value according to a second key and without the encrypted data, wherein the memory protection logic is configured to re-key a region of MACs stored in a storage according to a pointer, wherein first MACs of the region of MACs stored in the storage at a location below the pointer are keyed with the second key and second MACs of the region stored in the storage at a location above the pointer are keyed with the first key.
Dependencies are inferred from the claim text.