MEMORY ENCRYPTION METHOD COMPATIBLE WITH A MEMORY INTERLEAVED SYSTEM AND CORRESPONDING SYSTEM

• US 20150358300A1
• Filed: 03/12/2015
• Published: 12/10/2015
• Est. Priority Date: 06/05/2014
• Status: Active Grant

• Current Assignee: STMicroelectronics International N.V. (STMicroelectronics NV)
• Original Assignee: STMicroelectronics International N.V. (STMicroelectronics NV), STMicroelectronics SAS (STMicroelectronics NV)
• Inventors: URZI, Ignazio Antonino, Zargar, Asif Rashid
• Granted Patent: US 9,419,952 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 21/71 to assure secure computing or processing of information
• CPC Class Codes: G06F 21/79 in semiconductor storage media, e.g. directly-addressable memories
• CPC Class Codes: H04L 63/0464 using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 9/0618 Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation

Abstract

A method for managing an operation of an encrypted global interleaved memory space physically implemented according to an interleaving addressing scheme in encrypted memory banks of a plurality of memories respectively belonging to a plurality of channels. The method includes providing each channel with a local address pointer configured to be incrementally moved along the global memory space each time the global memory space is addressed at the current address pointed by the pointer, and in an absence of movement of the local pointer of a channel during a time period, addressing the global memory space from the channel through the address interleaving with a specific transaction at the current address, and upon reception at the channel of the specific transaction having been initiated by the channel, re-encrypting data located at the current address with a new encryption key and incrementing the local address pointer to its next position.

Claims

1-10. -10. (canceled)

11. A method for managing an encrypted global interleaved memory space physically implemented according to an interleaving addressing scheme in encrypted memory banks of a plurality of memories respectively belonging to a plurality of channels, the encrypted global interleaved memory space being addressable with transactions through the interleaving addressing scheme for routing each transaction to the channel containing the physical memory location corresponding to the transaction address in accordance with the interleaving addressing scheme, the method comprising:

providing each channel with a local address pointer configured to be incrementally moved along the encrypted global interleaved memory space each time the encrypted global interleaved memory space is addressed at the current address pointed by the local address pointer;

addressing the encrypted global interleaved memory space from the channel with a specific transaction at the current address in an absence of movement of the local address pointer during a time period; and

re-encrypting data located at the current address with a new encryption key and incrementing the local address pointer to its next position upon reception at the channel of the specific transaction having been initiated by the channel.

12. The method according to claim 11, wherein, a range of addresses of an interleaved memory zone being equal to an address interleaving step, and upon reception at a first channel of a specific transaction having been initiated by a second channel, discarding the specific transaction and sending an error transaction to the second channel, and upon reception of the error transaction at the second channel, incrementing the local address pointer of the second channel by the address interleaving step.

13. The method according to claim 11, further comprising:

encrypting data to be stored within a memory bank and decrypting data to be read from a memory bank and, upon reception at a channel of a specific transaction having been initiated by the channel

reading the data located at the current address and encrypted with a previous encryption key,

decrypting the encrypted data with the previous encryption key,

selecting a new primary key,

generating the new encryption key from at least the selected new primary key,

re-encrypting the decrypted data with the new encryption key, and

rewriting the re-encrypted data at the current address.

14. The method of claim 12, wherein said encrypted global interleaved memory space contains memory regions covering at least one memory zone, and further comprising upon reception of a transaction addressing a memory region:

assigning a region identification associated to the memory region; and

generating the new encryption key from at least the selected new key and the region identification.

15. A device comprising:

a plurality of channels;

an encrypted global interleaved memory space physically implemented according to an interleaving addressing scheme in encrypted memory banks of a plurality of memories respectively belonging to the plurality of channels, the encrypted global interleaved memory space being addressable with transactions through an address interleaving for routing each transaction to the channel containing the physical memory location corresponding to the transaction address in accordance with the interleaving addressing scheme; and

each channel further comprising

a local address pointer configured to be incrementally moved along the encrypted global interleaved memory space each time the encrypted global interleaved memory space is addressed at the current address pointed by the local address pointer, and

a local controller configured to, in an absence of movement of the local address pointer during a time period, address the encrypted global interleaved memory space through the interleaving addressing scheme with a specific transaction at the current address, and upon reception of the specific transaction having been initiated by the local controller, control re-encrypting data located at the current address with a new encryption key and increment the local address pointer to its next position.

16. The device according to claim 15, further comprising:

at least one master address decoder and a plurality of local address decoders respectively associated to the plurality of channels;

each address decoder configured to implement the address interleaving with the interleaving addressing scheme;

at least one master element configured to address the encrypted global interleaved memory space with transactions through the at least one master address decoder; and

the local controller of a channel being configured to, in an absence of movement of the local address pointer of the channel during a time period, address the encrypted global interleaved memory space through the local address decoder associated to the channel with the specific transaction at the current address.

17. The device according to claim 15, a range of addresses of an interleaved memory zone being equal to an address interleaving step, and upon reception at a channel of a specific transaction having been initiated by a second local controller of a second local processor of a second channel, a first local controller of a first channel are further configured to control discarding the specific transaction and send an error transaction to the second local controller, and upon reception of the error transaction the second local controller is configured to increment a local address pointer of the second local processor by the address interleaving step.

18. The device according to 15, wherein each channel further comprises a local encryptor/decryptor configured to encrypt data to be stored within a memory bank and to decrypt data to be read from a memory bank and the local controller is configured, upon reception at the channel of a specific transaction having been initiated by the local controller, to select a new primary key, control reading the data located at the current address and encrypted with a previous encryption key, control the encryptor/decryptor for decrypting the encrypted data with the previous encryption key, generating the new encryption key from at least the selected new primary key and re-encrypting the decrypted data with the new encryption key, control rewriting the re-encrypted data at the current address.

19. The device according to claim 17, wherein the encrypted global interleaved memory space contains memory regions covering at least one memory zone, each local processor further comprising:

an address filter configured, upon reception of a transaction addressing a memory region, to assign a region identification associated to the memory region, and the local encryptor/decryptor is configured to generate the new encryption key from at least the selected new key and the region identification.

20. The device according to claim 15, further comprising a System on Chip including the local processor of each channel, the master elements and a plurality of memory interfaces respectively coupled to the plurality of memories being outside of the System on Chip, a communication medium being a Network on Chip.

21. A device comprising:

a plurality of channels; and

an encrypted global interleaved memory space physically implemented according to an interleaving addressing scheme in encrypted memory banks of a plurality of memories respectively belonging to the plurality of channels, the encrypted global interleaved memory space being addressable with transactions through an address interleaving for routing each transaction to the channel containing the physical memory location corresponding to the transaction address in accordance with the interleaving addressing scheme.

22. The device of claim 21, wherein each channel further comprising a local address pointer configured to be incrementally moved along the encrypted global interleaved memory space each time the encrypted global interleaved memory space is addressed at the current address pointed by the local address pointer.

23. The device of claim 22, further comprising a local controller configured to, in an absence of movement of the local address pointer during a time period, address the encrypted global interleaved memory space through the interleaving addressing scheme with a specific transaction at the current address, and upon reception of the specific transaction having been initiated by the local controller, control re-encrypting data located at the current address with a new encryption key and increment the local address pointer to its next position.