SOFTWARE CRYPTOPROCESSOR

• US 20130067245A1
• Filed: 09/13/2012
• Published: 03/14/2013
• Est. Priority Date: 09/13/2011
• Status: Active Grant

• Current Assignee: Meta Platforms, Inc. (f/k/a Facebook, Inc.)
• Original Assignee: Oded Horovitz
• Inventors: Weis, Stephen A., Rihan, Sahil, HOROVITZ, ODED, Waldspurger, Carl A,
• Granted Patent: US 9,164,924 B2
• Time in Patent Office: Days
• US Class Current: 713/193
• CPC Class Codes: G06F 12/0802 Addressing of a memory level in which the access to the desired data or data block requires associative addressing means, e.g. caches
• CPC Class Codes: G06F 12/0833 in combination with broadcast means (e.g. for invalidation or updating)
• CPC Class Codes: G06F 12/0888 using selective caching, e.g. bypass
• CPC Class Codes: G06F 12/12 Replacement control
• CPC Class Codes: G06F 12/128 adapted to multidimensional cache systems, e.g. set-associative, multicache, multiset or multilevel
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 2212/1052 Security improvement
• CPC Class Codes: G06F 2212/621 Coherency control relating to peripheral accessing, e.g. from DMA or I/O device

Abstract

Security of information—both code and data—stored in a computer'"'"'s system memory is provided by an agent loaded into and at run time resident in a CPU cache. Memory writes from the CPU are encrypted by the agent before writing and reads into the CPU are decrypted by the agent before they reach the CPU. The cache-resident agent also optionally validates the encrypted information stored in the system memory. Support for I/O devices and cache protection from unsafe DMA of the cache by devices is also provided.

Claims

1. A system for securing information in a computer comprising:

a central processing unit (CPU) that includes at least one core that receives and executes instructions and processes data;

a cache within the CPU;

system memory that has a system memory address space;

a software stack that runs on the CPU and is embodied at least partially as instructions and data stored in the system memory; and

an agent running within the cache and comprising an encryption/decryption module that encrypts information, which may comprise code and/or data, before it is written to the system memory by the CPU and decrypts the information read from system memory for, and before, processing by the CPU core as the instructions and data.

2. A system as in claim 1, in which:

the agent encrypts the information in blocks; and

the agent includes a validation module that associates with each encrypted, stored information block a validation value.

3. A system as in claim 2, in which the validation module subsequently re-computes the validation value for each information block and compares it with the corresponding, previously associated validation value, whereby the validation module can detect any changes to the information block.

4. A system as in claim 1, in which the software stack executes on a first portion of the system memory address space, which backs the cache, such that any read or write requests addressed to the first portion by a entity in the software stack are fulfilled by the cache without accessing system memory.

5. A system as in claim 4, in which the software stack also addresses a second, encrypted portion of system memory address space.

6. A system as in claim 5, further comprising:

system software that, at run-time, is at least substantially loaded within and executes in the cache;

in which;

the agent comprises a portion of the system software and is, during run-time, always resident in the cache.

7. A system as in claim 1, further comprising:

at least one I/O device that includes device memory; and

an I/O memory management unit configured to allow the I/O device to address and access the cache only for predetermined I/O operations under supervision of the agent.

8. A system as in claim 1, further comprising:

at least one I/O device that is configured for direct memory access via an I/O channel; and

an I/O memory management unit configured to block DMA to the cache.

9. A system as in claim 1, further comprising a trusted platform module component provided to securely load the agent into the cache before execution of other software in the software stack.

10. A system as in claim 1, in which the software stack includes a hypervisor and at least one virtual machine.

11. A system as in claim 1, in which the software stack includes an interpreter provided for executing unmodified commodity software.

12. A system as in claim 1, further comprising:

a cache-backing memory region that is a sub-set of the system memory and that is provided to contain a data pattern;

in which;

the agent is provided to inspect the contents of the cache-backing memory region to determine any change in the data pattern, indicating eviction of at least a part of the cache contents into the cache-backing memory region.

13. A method for securing information in a computer that has

a central processing unit (CPU) that includes at least one core that receives and executes instructions and processes data;

a cache within the CPU;

system memory that has a system memory address space; and

a software stack that runs on the CPU and is embodied at least partially as instructions and data stored in the system memory;

the method comprising;

loading an agent into the cache;

using the agent, encrypting information, which may comprise code and/or data, before it is written to the system memory by the CPU and decrypting the information read from the system memory for, and before, processing by the CPU core as the instructions and data.

14. A method as in claim 13, further comprising:

encrypting the information in memory blocks; and

computing and associating validation data with each encrypted memory block.

15. A method as in claim 14, in which the memory blocks are memory pages.

16. A method as in claim 14, further comprising:

re-computing the validation data for each information block and comparing it with the corresponding, previously associated validation data, thereby detecting changes to the information block.

17. A method as in claim 13, further comprising:

executing the software stack on a first portion of the system memory address space, which backs the cache; and

fulfilling in the cache any read or write requests addressed to the first portion by a entity in the software stack, without accessing system memory.

18. A method as in claim 17, further comprising allowing the software stack also to address a second portion of the system memory address space, which contains the encrypted information.

19. A method as in claim 13, in which the computer includes at least at least one I/O device that includes device memory, further comprising allowing the I/O device to address and access the cache only for predetermined I/O operations.

20. A method as in claim 13, in which the computer includes at least at least one I/O device that includes device memory, further comprising blocking direct memory access (DMA) to the cache by the I/O device.

21. A method as in claim 13, further comprising securely loading the agent into the cache before execution of other software in the software stack.

22. A method as in claim 13, in which the system memory address space is organized into memory blocks, further comprising:

determining a non-cache-conflicting-set of the memory blocks; and

marking only the system memory associated with the non-cache-conflicting as cacheable, thereby preventing cache conflicts by system memory.

23. A method as in claim 13, further comprising executing unmodified software in the software stack using interpretation.

24. A method as in claim 13, further comprising:

storing a data pattern in a cache-backing memory region; and

inspecting the contents of the cache-backing memory region to determine any change in the data pattern, indicating eviction of at least a part of the cache contents into the cache-backing memory region.

25. In a computer that has a central processing unit (CPU) that includes at least one core that receives and executes instructions and processes data;

a cache within the CPU;

system memory that has a system memory address space; and

a software stack that runs on the CPU and is embodied at least partially as instructions and data stored in the system memory;

a method for preventing cache conflicts by system memory pages comprising;

determining a non-cache-conflicting-set of the memory pages; and

marking only the system memory associated with the non-cache-conflicting as cacheable, thereby preventing cache conflicts by system memory.

26. A method as in claim 25, in which the computer includes a processor cache performance counter and each memory page comprises a set of memory units, the method further comprising:

invalidating contents of the cache;

reading in every unit in a set of pages to be tested;

record the value of the processor cache performance counter to determine a number of cache misses;

again reading in every unit in the set of pages to be tested;

again reading the processor cache performance counter; and

determining that the tested memory pages are non-cache-conflicting if the results of the two reads of the performance counter are equal.

27. A method as in claim 25, in each memory page comprises a set of memory units, the method further comprising:

reading in every unit in a set of pages to be tested;

measuring any access to the system memory by the CPU;

again reading in every unit in the set of pages to be tested;

searching for any reads from system memory addresses in the tested set of pages; and

if no read is found, determining that the tested memory pages are non-cache-conflicting and may coexist in the cache.

28. A method as in claim 25, further comprising:

invalidating the cache contents; and

inspecting a test set of the system memory pages to determine if any cache lines were written back to system memory.

29. A method as in claim 25, further comprising:

filling the cache with an initial data pattern;

flushing the cache to a cache-backing region of the system memory;

filling the cache with a test data pattern;

invalidating the cache; and

examining the cache-backing region of the system memory to determine which, if any, cache lines were evicted by identifying any cache lines that do not contain the initial data pattern.

30. A method as in claim 25, in which the computer has an x86 architecture, further comprising flushing the cache using a WBINVD instruction and invalidating the cache using an INVD instruction.