SYSTEM ARCHITECTURE FOR ENCRYPTING EXTERNAL MEMORY

• US 20170337141A1
• Filed: 05/18/2016
• Published: 11/23/2017
• Est. Priority Date: 05/18/2016
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Geagan, John B., Ponceleon, Dulce B.
• Granted Patent: US 10,992,453 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/75 by inhibiting the analysis of circuitry or operation
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: H04L 9/002 Countermeasures against attacks on cryptographic mechanisms network architectures or network communication protocols for protection against malicious traffic H04L63/1441

Abstract

A system architecture providing memory encryption suitable for protection against liquid nitrogen and trace probe attacks. In one embodiment, a method of and system for memory encryption are provided. A write request is received at a memory controller. The write request includes first data and a first address. The memory controller is embedded in a CPU and is operatively coupled to memory external to the CPU. The first data are encrypted at the memory controller to generate encrypted first data. The encrypted first data are written to the memory.

Claims

1. A method comprising:

receiving at a memory controller a write request, the write request comprising first data and a first address, the memory controller being embedded in a CPU and operatively coupled to memory external to the CPU;

encrypting, at the memory controller, the first data to generate encrypted first data;

writing the encrypted first data to the memory.

2. The method of claim 1, further comprising:

receiving at the memory controller a read request, the read request comprising a second address;

reading encrypted second data from the memory;

decrypting, at the memory controller, the encrypted second data to generate second data.

3. The method of claim 1, further comprising:

determining a first translated address from the first address, and wherein the encrypted first data are written to the memory at the first translated address.

4. The method of claim 2, further comprising:

determining a second translated address from the second address, and wherein the encrypted second data are read from the memory at the second translated address.

5. The method of claim 1, wherein encrypting the first data comprises:

reading at the memory controller a first cryptographic key; and

applying the first cryptographic key to the first data.

6. The method of claim 5, wherein the first cryptographic key is read from a volatile memory.

7. The method of claim 6, further comprising:

detecting a physical intrusion; and

deleting the first cryptographic key.

8. The method of claim 5, further comprising:

generating the first cryptographic key upon powering of the memory controller.

9. The method of claim 3, wherein determining the first translated address comprises:

applying a cryptographic function.

10. The method of claim 4, wherein determining the second translated address comprises:

applying a cryptographic function.

11. The method of claim 1, wherein encrypting the first data comprises:

reading at the memory controller a first cryptographic key of a plurality of cryptographic keys, the first cryptographic key being selected on the basis of the first address; and

applying the first cryptographic key to the first data.

12. A system comprising:

a memory controller, the memory controller being embedded in a CPU and being operatively coupled to a memory external to the CPU, the memory controller adapted to;

receive a write request, the write request comprising first data and a first address;

encrypt the first data to generate encrypted first data; and

write the encrypted first data to the memory.

13. The system of claim 12, wherein the memory controller is further adapted to:

receive a read request, the read request comprising a second address;

read encrypted second data from the memory;

decrypt at the memory controller the encrypted second data to generate second data.

14. The system of claim 12, wherein the memory controller is further adapted to:

determine a first translated address from the first address, and wherein the encrypted first data are written to the memory at the first translated address.

15. The system of claim 13, wherein the memory controller is further adapted to:

determine a second translated address from the second address, and wherein the encrypted second data are read from the memory at the second translated address.

16. The system of claim 12, wherein the memory controller is further adapted to:

read a first cryptographic key; and

apply the first cryptographic key to the first data.

17. The system of claim 16, wherein the first cryptographic key is read from a volatile memory.

18. The system of claim 17, wherein the memory controller is further adapted to:

detect a physical intrusion; and

delete the first cryptographic key.

19. The system of claim 16, wherein the memory controller is further adapted to:

generate the first cryptographic key upon powering of the memory controller.

20. The system of claim 12, wherein encrypting the first data comprises:

reading a first cryptographic key of a plurality of cryptographic keys, the first cryptographic key being selected on the basis of the first address; and

applying the first cryptographic key to the first data.