System for seamless processing of encrypted and non-encrypted data and instructions

• US 5,224,166 A
• Filed: 08/11/1992
• Issued: 06/29/1993
• Est. Priority Date: 08/11/1992
• Status: Expired due to Term

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Hartman, Robert C. Jr.
• Primary Examiner(s): Gregory, Bernarr E.
• Application Number:
  US07/928,850
• Time in Patent Office: 322 Days
• Field of Search: 380/4, 380/21, 380/23, 380/25, 380/30, 380/43, 380/49, 380/50, 380/52
• US Class Current: 713/190
• CPC Class Codes: G06F 12/0802 Addressing of a memory level in which the access to the desired data or data block requires associative addressing means, e.g. caches
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 21/71 to assure secure computing or processing of information

Abstract

A data processing system includes an internal cache memory in a secure physical region that is not accessible to a user of the system. An external memory is positioned outside of the secure physical region and stores encrypted and non-encrypted (i.e., plaintext) data and instructions. An instruction enables access of a private key contained within the secure physical region which is used to decrypt an encrypted master key that accompanies encrypted data and instructions. An interface circuit in the secure physical region decrypts each encrypted master key through the use of the private key and also decrypts encrypted data and instructions associated with each decrypted master key. A central processor accesses segments of both non-encrypted and encrypted data and instructions from the external memory and causes the interface circuit to employ a decrypted master key to decrypt data and instructions and to store the decrypted information in the internal memory cache. Non-encrypted data and instructions are directly stored in the internal memory cache.

Claims

1. A data processing ssytem for processing both encrypted and non-encrypted data and instructions, said system including a secure physical region in accessible to a user of said system, said system comprising:

internal memory means positioned internally within said secure physical region, for storing decrypted and non-encrypted digital information;

external memory means positioned external to said secure physical region, for storing an instruction to access a private key within said secure physical region for use in decrypting an encrypted master key;

interface means in said secure physical region for decrypting said encrypted master key through the use of an accessed private key and for decrypting information encrypted with a said master key;

segment register means in said secure physical region for maintaining a record of active memory segments and for associating decrypted master keys therewith; and

a central processor within said secure physical region for accessing segments of both non-encrypted and encrypted information stored in addresses in said external memroy means and for causing said interface means to employ a said decrypted master key, that is associated in said segment register means with an address that has been accessed, to decrypt information from said address and to store decrypted information in said itnernal memory means and, in the case of non-encrypted information from said external memory means, to directly store said information in said internal memory means.

2. The data processing system as recited in claim 1 wherein said information may be either data or instructions or both.

3. The data processing system as recited in claim 2 wherein said segment register means includes a flag which indicates whether information within a said data segment are encrypted or not, said interface means being responsive to a said flag in its processing of information from said external means.

4. The data processing system as recited in claim 3 wherein said interface means is responsive to a said flag to enable encryption of information that is being transferred from said internal memory means to said external memory means, if said flag indicates said segment includes encrypted information.

5. The data processing system as recited in claim 2 further comprising:

encryption control means for preventing a non-encrypted instruction from accessing any memory segment that contains encrypted information.

6. The data processing system as recited in claim 5 wherein said segment register means includes a flag associated with each active memory segment, said flag indicating an encrypted status, said encryption control means responsive to a state of said flag in performing its function.

7. The data processing system as recited in claim 1 wherein said segment register means comprises a plurality of registers, each said register including a segment address and length or end address field, a flag field, and a field for holding a decrypted media master key, each said register employed by said CPU in its accessing of data addresses within a said segment.

8. The data processing system as recited in claim 7 further comprising:

read only memories within said secure physical region for storing both a public key and a private key.

9. The data processing system as recited in claim 8, wherein said external memory means includes an instruction to return said public key from said public key read only memory for storage in said external memory means, whereby said public key may be transmitted to a secure locale where it is stored in association with said private key, said private key thereby being accessible for use in encrypting a media master key.

10. The data processing system as recited in claim 1 wherein all instructions and data transferred between said central processor and said interface means occur within said secure physical region and are thereby inaccessible to a user.

11. The data processing system as recited in claim 1 wherein said segment register means tores a plurality of decrypted media master keys for decrypting data and instructions contained in media encrypted through the use of said media master keys, said decrypted data and instructions employed by said central processor.

12. In a data processing system that processes both encrypted and non-encrypted data and instructions, said system including a secure physical region inaccessible to a user of said system, a method for assuring seamless processing of both encrypted and non-encrypted digital information comprising:

storing in said secure physical region decrypted and non-encrypted digital information;

storing in external memory means external to said secure physical region, an instruction to access a private key within said secure physical region for use in decrypting an encrypted master key;

decrypting in an interface means in said secure physical region, said encrypted master key through the use of an accessed private key and decrypting information encrypted with a said master key;

maintaining in a segment register means in said secure physical region, a record of active memory segments and associated decrypted master keys;

accessing within said secure physical region segments of both non-encrypted and encrypted information stored in addresses in said external memory means;

causing said interface means to employ a said decrypted master key that is associated in said segment register means with an address that has been accessed, to decrypt information from a said address; and

storing said decyrpted information in said internal memory means and, in the case of non-encrypted information from said external memory means, storing said information in said internal memory means.

13. The method as recited in claim 12 wherein said segment register means includes a flag which indicates whether information within a said data segment are encrypted or not, said interface means being responsive to a said flag in its processing of information from said external means.

14. The method as recited in claim 13 wherein said interface means is responsive to a said flag to encrypt information that is being transferred from said internal memory means to said external memory means, if said flag indicates said segment includes encrypted information.

15. The method as recited in claim 12 further comprising the step of:

preventing a non-encrypted instruction from accessing any memory segment that contains encrypted information.