CACHE STRUCTURE FOR A COMPUTER SYSTEM PROVIDING SUPPORT FOR SECURE OBJECTS

• US 20100332850A1
• Filed: 09/09/2010
• Published: 12/30/2010
• Est. Priority Date: 06/26/2009
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Boivie, Richard Harold
• Granted Patent: US 9,298,894 B2
• Time in Patent Office: Days
• US Class Current: 713/189
• CPC Class Codes: G06F 12/0802 Addressing of a memory level in which the access to the desired data or data block requires associative addressing means, e.g. caches
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 21/125 by manipulating the program code, e.g. source code, compiled code, interpreted code, machine code
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 2212/1052 Security improvement
• CPC Class Codes: G06F 2212/402 Encrypted data
• CPC Class Codes: G06F 2212/6042 Allocation of cache space to multiple users or processors
• CPC Class Codes: H04L 2209/12 Details relating to cryptographic hardware or logic circuitry

Abstract

A method (and structure) of enhancing efficiency in processing using a secure environment on a computer, includes, for each line of a cache, providing an associated object identification label field associated with the line of cache, the object identification label field storing a value that identifies an owner of data currently stored in the line of cache.

Claims

1. A method of enhancing efficiency in processing using a secure environment on a computer, said method comprising:

for each line of a cache, providing an associated object identification label field associated with said line of cache, said object identification label field storing a value that identifies an owner of data currently stored in said line of cache.

2. The method of claim 1, further comprising:

upon loading data into said line of cache, additionally loading a value into its associated object identification label field.

3. The method of claim 2, wherein said value identifies a secure object uniquely associated with said data, said secure object comprising a data structure tangibly embodied in a machine-readable medium and containing encrypted data when said secure object is stored in an external memory, said encrypted data being decrypted when said secure object is retrieved from said external memory into said cache for execution of said secure object by a central processing unit (CPU) in said computer.

4. The method of claim 3, wherein a predetermined standard value is assigned for said object identification label field if no secure object is associated as an owner with data stored in said line of cache.

5. The method of claim 4, further comprising, upon an access request for data in said line of cache, initially determining whether said object identification label field indicates that the data stored therein is associated with a secure object.

6. The method claim 5, further comprising:

if said object identification label field of said requested line of cache indicates no association with any secure object, permitting access of said data by a CPU making said access request.

7. The method of claim 5, further comprising:

if said object identification label field of said requested line of cache indicates an association with a secure object, comparing a value of said object identification label field of said requested line of cache with a value of an object identification of an object executing in the CPU and making the request.

8. The method of claim 7, further comprising:

if the object identification value of the object making the request matches the value in the object identification label field, permitting an access of the data stored in said line of cache by the CPU making the access request.

9. The method of claim 7, further comprising:

if the object identification value of the object making the request fails to match the object identification value in the object identification label field in the cache;

invalidating the requested cache line of data;

retrieving from said external memory an encrypted data corresponding to said requested cache line of data;

loading said encrypted data into said cache line either without a decryption of said data or decrypting said retrieved data using a decryption key of the currently executing secure object; and

permitting an access to said data in said cache line for the CPU making the access request.

10. The method of claim 9, as embodied in a set of instructions tangibly embodied on a machine-readable storage medium.

11. The method of claim 10, wherein said set of instructions comprises one of:

firmware instructions controlling a cache controller; and

a set of computer instructions tangibly embedded on a tangible storage medium, in preparation for loading onto a memory device in a cache controller.

12. An apparatus, comprising:

a cache including a plurality of cache lines, each said cache line having an owner field identifying an owner, if any, of data stored in said cache line; and

a cache controller that controls an access of said data stored in said cache line as based upon whether said access has been made by said owner identified in said owner identification field or a value in the owner identification field indicates that non-secured data is stored in said cache line.

13. The apparatus of claim 12, wherein a predetermined value is used in said owner identification field if the data stored in said cache line is not secured data.

14. The apparatus of claim 12, wherein values in said owner identification field identify a specific secure object associated with said data, said secure object comprising a data structure containing encrypted data and/or code when said secure object is stored in an external memory, said data being decrypted when said secure object is retrieved from said external memory into said cache for execution of said secure object by a central processing unit (CPU) in said apparatus.

15. The apparatus of claim 14, further comprising:

an object-id register that stores a value of an object currently executing a thread or process on the CPU that is making an access request for data from said cache, wherein said cache controller, upon an access request for data in a line of cache, initially determines whether a value stored in said owner label field of said line of cache matches a value stored in said object-id register.

16. The apparatus of claim 15, wherein:

if the value stored in the owner label field matches the value stored in the object-id register or indicates that no secured data is stored in the requested cache line, said cache controller permits access to the data stored in the requested line of cache; and

if the values fail to match and the value stored in the owner label field indicates secured data, the cache controller declares a cache miss.

17. The apparatus of claim 16, wherein, if a cache miss is declared, the cache controller:

invalidates the requested cache line of data;

retrieves from a memory an encrypted data corresponding to said requested cache line of data;

loads said encrypted data into said cache line without a decryption of said data;

and permits an access to said encrypted data for the CPU making the access request.

19. The cache controller of claim 17, wherein:

a predetermined value stored in the owner field indicates that the line does not contain secured data;

if the value stored in the owner label field matches the value stored in the object-id register or the line does not contain secured data, said cache controller permits access to the data stored in the requested line of cache; and

otherwise, the cache controller declares a cache miss.

20. The cache controller of claim 19, wherein, if a cache miss is declared for a requested line of cache, said cache controller:

invalidates the requested line of cache;

reads encrypted data from an external memory;

executes one of the following;

stores the encrypted data into said requested line of cache; and

decrypts said encrypted data using a decryption key of the object making said request identified by the object-id register rather than a decryption key of a true owner of information in the requested line of cache and stores the decrypted data into said requested line of cache, said decrypted data thereby being data incorrectly decrypted;

and provides access the data stored in the requested line of cache.

18. A cache controller, comprising:

a data port receiving a value identifying an owner of a process or thread currently being executed by a central processing unit (CPU) associated with a cache controlled by said cache controller, said process or thread requesting access to data stored in a line of said cache; and

a storage device storing a set of instructions that cause said cache controller to determine if a value stored in an owner identification field of the requested line of cache matches the value received at said input port.