US RE48,716 E1 · Encryption-based security protection for processors

Abstract

Methods, systems, and arrangements enable increased security for a processor, including by implementing block encryption. The block may include multiple instructions and/or operations to be executed by the processor. The block may also include multiple bytes that are read into the processor byte by byte. Once a block-wide encrypted buffer has been filled from an external memory source, the block may be decrypted using an encryption algorithm (e.g., the Data Encryption Standard (DES), the triple DES, etc.), and the decrypted block may be forwarded to a decrypted buffer. The decrypted block may thereafter be moved into a cache, which may optionally be organized into an equivalent block width (e.g., for each way of a multi-way cache). Therefore, when a processing core/instruction decoder needs a new instruction, it may retrieve one from the cache, directly from the decrypted buffer, or from external memory (e.g., after undergoing decryption).

Claims95

Dependent claims

A method for providing secure external memory that stores instructions for a processor, comprising the steps of:

receiving a plurality of encrypted instructions into a buffer of the processor from the external memory, said plurality of encrypted instructions comprise a plurality of consecutive encrypted instructions, and said step of receiving said plurality of encrypted instructions into a buffer of the processor from the external memory comprises the step of receiving the plurality of consecutive encrypted instructions from a bus having a width equivalent to that of each consecutive encrypted instruction of the plurality of consecutive encrypted instructions;
decrypting the plurality of encrypted instructions substantially simultaneously using a selected decryption algorithm to produce a plurality of decrypted instructions;
and
forwarding at least one decrypted instruction of the plurality of decrypted instructions to a processing area of the processor.

1 more element

An arrangement for providing information security with a processor, the arrangement comprising:

an encrypted buffer, said encrypted buffer capable of accepting a plurality of encrypted units and adapted to offer the plurality of encrypted units;
a decryptor, said decryptor capable of accepting the plurality of encrypted units and adapted (i) to decrypt the plurality of encrypted units to produce a plurality of decrypted units and (ii) to offer the plurality of decrypted units;
a decrypted buffer, said decrypted buffer capable of accepting the plurality of decrypted units and adapted to offer at least one of a single decrypted-buffer-originated decrypted unit of the plurality of decrypted units and the plurality of decrypted units;
a cache, said cache capable of accepting the plurality of decrypted units and adapted to offer a single cache-originated unit of the plurality of decrypted units;
a processing area, said processing area capable of accepting a decrypted unit of the plurality of decrypted units and adapted (i) to ascertain a program address and (ii) to offer the program address;
a controller, said controller capable of accepting the program address and adapted to control movement of the plurality of decrypted units;
and
wherein said controller, at least partially, causes (i) said cache to offer the single cache-originated decrypted unit to said processing area if a first address associated with the single cache-originated decrypted unit corresponds to the program address and (ii) said decrypted buffer to offer the single decrypted-buffer-originated decrypted unit to said processing area and the plurality of decrypted units to said cache if a second address associated with the single decrypted-buffer-originated decrypted unit corresponds to the program address.

5 more elements

A method for providing enhanced security for a processor, comprising the steps of:

comparing a program address to at least one tag address of a cache to determine whether there is a hit;
if the hit is determined, then transferring at least one information unit from the cache to a processing area;
comparing the program address to an address corresponding to a decrypted buffer to determine whether there is a decrypted buffer match;
if the hit is not determined and the decrypted buffer match exists, then transferring another at least one information unit from the decrypted buffer to the processing area and transferring a plurality of information units from the decrypted buffer to the cache;
comparing the program address to an address corresponding to a decryption unit to determine whether there is a decryption unit match;
if the hit is not determined and the decrypted buffer match does not exist and the decryption unit match does exist, then decrypting another plurality of information units in the decryption unit and thereafter transferring the another plurality of information units from the decryption unit to the decrypted buffer and transferring yet another at least one information unit from the decrypted buffer to the processing area and transferring the another plurality of information units from the decrypted buffer to the cache.

3 more elements

A method for providing secure external memory that stores instructions for a processor, comprising the steps of:

receiving a plurality of encrypted instructions into a buffer of the processor from the external memory, said plurality of encrypted instructions comprise a plurality of consecutive encrypted instructions, and said step of receiving said plurality of encrypted instructions into a buffer of the processor from the external memory comprises the step of receiving the plurality of consecutive encrypted instructions from a bus having a width equivalent to that of each consecutive encrypted instruction of the plurality of consecutive encrypted instructions;
decrypting the plurality of encrypted instructions substantially simultaneously using a selected decryption algorithm to produce a plurality of decrypted instructions;
storing the plurality of decrypted instructions within a cache;
forwarding at least one decrypted instruction of the plurality of decrypted instructions to a processing area of the processor;
delaying the step of forwarding the at least one decrypted instruction of the plurality of decrypted instructions to a processing area of the processor until an instruction address requested by the processing area corresponds to an instruction address associated with the at least one decrypted instruction of the plurality of decrypted instructions;
and
wherein said step of forwarding at least one decrypted instruction of the plurality of decrypted instructions to a processing area of the processor comprises the step of forwarding the at least one decrypted instruction of the plurality of decrypted instructions to the processing area of the processor from the cache when the instruction address requested by the processing area corresponds to the instruction address associated with the at least one decrypted instruction of the plurality of decrypted instructions.

4 more elements

A method for providing secure external memory that stores instructions for a processor, comprising the steps of:

receiving a plurality of encrypted instructions into a buffer of the processor from the external memory;
decrypting the plurality of encrypted instructions substantially simultaneously using a selected decryption algorithm to produce a plurality of decrypted instructions, wherein said step of decrypting the plurality of encrypted instructions substantially simultaneously using said selected decryption algorithm to produce said plurality of decrypted instructions comprises the step of decrypting the plurality of encrypted instructions using at least one modified decryption key, the at least one modified decryption key being formed responsive, at least partly, to at least a portion of an address associated with at least one encrypted instruction of the plurality of encrypted instructions;
forwarding at least one decrypted instruction of the plurality of decrypted instructions to a processing area of the processor;
delaying said step of forwarding at least one decrypted instruction of the plurality of decrypted instructions to a processing area of the processor until an instruction address requested by the processing area corresponds to an instruction address associated with the at least one decrypted instruction of the plurality of decrypted instructions;
and
wherein said step of forwarding at least one decrypted instruction of the plurality of decrypted instructions to a processing area of the processor comprises the step of forwarding the at least one decrypted instruction of the plurality of decrypted instructions to the processing area of the processor when the instruction address requested by the processing area corresponds to the instruction address associated with the at least one decrypted instruction of the plurality of decrypted instructions.

3 more elements

A system for providing security to stored information, comprising:

at least one memory, said at least one memory storing a plurality of encrypted instructions, each encrypted instruction of the plurality of encrypted instructions associated with an address;
and
a processor, said processor operatively coupled to said memory to retrieve the plurality of encrypted instructions therefrom;
said processor including:
a first buffer, the first buffer capable of receiving the plurality of encrypted instructions;
a decryption unit, the decryption unit capable of receiving the plurality of encrypted instructions from the first buffer, the decryption unit adapted to decrypt the plurality of encrypted instructions using a block decryption algorithm to produce a plurality of decrypted instructions;
a second buffer, the second buffer capable of receiving the plurality of decrypted instructions from the decryption unit;
a cache memory, the cache memory capable of receiving the plurality of decrypted instructions from the second buffer;
a processing area comprising at least one of a central processing unit (CPU) and an instruction decoder, the processing area capable of receiving at least one decrypted instruction of the plurality of decrypted instructions;
and
a memory controller, the memory controller capable of controlling movement of the plurality of decrypted instructions, the memory controller adapted to provide the processing area the at least one decrypted instruction from the second buffer and to provide the cache the plurality of decrypted instructions from the second buffer.

8 more elements

Dependencies are inferred from the claim text.

Encryption-based security protection for processors

Life of this patent

Encryption-based security protection for processors

Life of this patent

Abstract

Claims95