System and method providing region-granular, hardware-controlled memory encryption

• US 8,135,962 B2
• Filed: 03/27/2002
• Issued: 03/13/2012
• Est. Priority Date: 03/27/2002
• Status: Active Grant

• Current Assignee: MediaTek, Inc.
• Original Assignee: GlobalFoundries, Inc.
• Inventors: Strongin, Geoffrey S., Barnes, Brian C., Schmidt, Rodney
• Primary Examiner(s): Laforgia, Christian
• Assistant Examiner(s): Tolentino, Roderick
• Application Number:
  US10/108,253
• Publication Number:
  US 20030188178A1
• Time in Patent Office: 3,639 Days
• Field of Search: 711/163, 711/164, 713/160, 713/189, 713/190, 709/232, 710/4, 726/1, 726/2, 726/22, 726/26
• US Class Current: 713/190
• CPC Class Codes: G06F 12/1009 using page tables, e.g. page table structures
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 12/1441 for a range
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen

Abstract

A memory, system, and method for providing security for data stored within a memory and arranged within a plurality of memory regions. The method includes receiving an address within a selected memory region and using the address to access an encryption indicator. The encryption indicator indicates whether data stored in the selected memory page are encrypted. The method also includes receiving a block of data from the selected memory region and the encryption indicator and decrypting the block of data dependent upon the encryption indicator.

Claims

1. A computing apparatus, comprising:

at least one storage location coupled to receive a block of data from a memory and a corresponding encryption indicator for the block of data, wherein the block of data corresponds to a selected memory region of the memory, and wherein the encryption indicator indicates whether the data corresponding to the selected memory region is encrypted in the memory; and

an encryption/decryption unit configured to decrypt the block of data dependent upon the encryption indicator before the block of data is stored in the storage location.

2. The computing apparatus as recited in claim 1, wherein the block of data comprises a plurality of data units stored within contiguous locations of the memory.

3. The computing apparatus as recited in claim 2, wherein the selected memory region corresponds to a memory page, a memory segment, or a base-band pair.

4. The computing apparatus as recited in claim 1, wherein the encryption indicator is an encrypt memory bit.

5. The computing apparatus as recited in claim 4, wherein the encrypt memory bit is obtained by accessing a security attribute data structure stored within the memory.

6. The computing apparatus as recited in claim 1, wherein the storage location comprises a cache coupled to receive the block of data and the corresponding encryption indicator from the selected memory region in the memory.

7. The computing apparatus as recited in claim 6, wherein the cache includes a plurality of cache memory entries for storing blocks of data and a plurality of cache directory entries for storing data needed to access the blocks of data, and wherein each of the cache directory entries corresponds to a different one of the cache memory entries and includes an encrypt data bit indicating whether a block of data stored in the corresponding cache memory entry is to be encrypted before being stored in the memory.

8. The computing apparatus as recited in claim 7, wherein when a block of data stored in a given cache memory entry is to be stored in the memory, the cache unit is configured to use the encryption/decryption unit to encrypt the block of data dependent upon the encrypt data bit in the cache directory entry corresponding to the given cache memory entry before storing the block of data in the memory.

9. A system, comprising:

a memory management unit configured to manage a memory such that the memory stores data arranged within a plurality of memory regions;

a security check unit coupled to receive a physical address within a selected one of the memory regions and configured to use the physical address to access a security attribute data structure located in the memory in order to obtain an encryption indicator indicating whether data stored in the selected memory region is encrypted in the memory; and

a cache unit coupled to receive a block of data obtained from the selected memory region and to receive the encryption indicator from the security check unit, the cache unit comprising;

an encryption/decryption unit configured to decrypt the received block of data dependent upon the encryption indicator before the received block of data is stored in the cache unit.

10. The system as recited in claim 9, wherein the received block of data comprises a plurality of data units stored within contiguous locations of the memory.

11. The memory as recited in claim 10, wherein the selected memory region corresponds to a memory page, a memory segment, or a base-band pair.

12. The system as recited in claim 9, wherein the security attribute data structure comprises a security attribute table directory and a security attribute table, the security attribute table comprising a security attribute table entry, and wherein the encryption indicator is an encrypt memory bit in the security attribute table entry.

13. The system as recited in claim 9, wherein the cache unit includes a plurality of cache memory entries for storing blocks of data and a plurality of cache directory entries for storing data needed to access the blocks of data, and wherein each of the cache directory entries corresponds to a different one of the cache memory entries, and wherein each of the cache directory entries includes an encrypt data bit indicating whether a block of data stored in the corresponding cache memory entry is to be encrypted before being stored in the memory.

14. The system as recited in claim 13, wherein when a block of data stored in a given cache memory entry is to be stored in the memory, and the cache unit is configured to use the encryption/decryption unit to encrypt the block of data dependent upon the encrypt data bit in the cache directory entry corresponding to the given cache memory entry before storing the encrypted block of data in the memory.

15. The system as recited in claim 9, wherein the security check unit is configured to use the physical address to access the at least one security attribute data structure located in the memory to obtain an additional security attribute of the selected memory region and the encryption indicator and to generate a fault signal dependent upon the security attributes of selected memory region and the additional security attribute of the selected memory region.

16. The system as recited in claim 15, wherein the security attributes of the selected memory region comprise a user/supervisor bit and a read/write bit as defined by the x86 processor architecture.

17. The system as recited in claim 15, wherein the additional security attribute comprises a secure page bit, and wherein the secure page bit indicates whether the selected memory region is a secure region.

18. The system as recited in claim 15, wherein the fault signal is a general protection fault signal as defined by the x86 processor architecture.

19. The system as recited in claim 9, wherein the security check unit is comprised within the memory management unit.

20. The system as recited in claim 9, wherein the memory management unit, the security check unit, and the cache unit are comprised within a processor.

21. A computer system, comprising:

a memory for storing data, wherein the data includes instructions;

a memory management unit operably coupled to the a memory and configurable to manage the memory such that the memory stores data arranged within a plurality of memory regions;

a security check unit coupled to receive a physical address within a selected one of the memory regions and configured to use the physical address to access at least one security attribute data structure located in the memory in order to obtain an encryption indicator indicating whether data stored in the selected memory region is encrypted in the memory; and

a cache unit coupled to receive a block of data obtained from the selected memory region and to receive the encryption indicator from the security check unit, the cache unit comprising;

an encryption/decryption unit configured to decrypt the received block of data dependent upon the encryption indicator before the received block of data is stored in the cache unit.

22. The computer system as recited in claim 21, wherein the received block of data comprises a plurality of data units stored within contiguous locations of the memory.

23. The memory as recited in claim 22, wherein the selected memory region corresponds to a memory page, a memory segment, or a base-band pair.

24. The computer system as recited in claim 21, wherein the security attribute data structure comprises a security attribute table directory and a security attribute table, the security attribute table including a security attribute table entry, and wherein the encryption indicator is an encrypt memory bit in the security attribute table entry.

25. A method for providing security for data stored within a memory, wherein the data are arranged within a plurality of memory regions, the method comprising:

receiving an address within a selected one of the memory regions;

using the address to access an encryption indicator indicating whether data stored in the selected memory region is encrypted in the memory;

receiving a block of data from the selected memory region and the encryption indicator; and

decrypting the received block of data dependent upon the encryption indicator.

26. The method as recited in claim 25, further comprising storing the received block of data.

27. The method as recited in claim 25, wherein receiving the block of data from the selected memory region and the encryption indicator comprises receiving a plurality of data units stored within contiguous locations from the selected memory region and the encryption indicator, and wherein decrypting the block of data dependent upon the encryption indicator further comprises decrypting the plurality of data units stored within contiguous locations dependent upon the encryption indicator.

28. The method as recited in claim 25, wherein receiving the address within the selected memory region comprises receiving a physical address within the selected memory region, and wherein using the address to access the encryption indicator comprises using the physical address to access the encryption indicator.

29. The method as recited in claim 28, wherein using the physical address to access an encryption indicator further comprises using the physical address to access at least one security attribute data structure located in the memory to obtain the encryption indicator.

30. The method as recited in claim 29, wherein comprises using the physical address to access at least one security attribute data structure located in the memory to obtain the encryption indicator further comprises using the physical address to access a security attribute table entry comprising an encrypted memory bit.

31. A non-transitory machine readable medium encoded with instructions that, when executed by a computer system, perform a method for providing security for data stored within a memory and arranged within a plurality of memory regions, the method comprising:

receiving an address within a selected memory region;

using the address to access an encryption indicator indicating whether data stored in the selected memory region is encrypted in the memory;

receiving a block of data from the selected memory region and the encryption indicator; and

decrypting the received block of data dependent upon the encryption indicator.

32. The non-transitory machine readable medium as recited in claim 31, the method further comprising storing the received block of data.

33. The non-transitory machine readable medium as recited in claim 31, wherein receiving the block of data from the selected memory region and the encryption indicator comprises receiving a plurality of data units stored within contiguous locations from the selected memory region and the encryption indicator, and wherein decrypting the block of data dependent upon the encryption indicator further comprises decrypting the plurality of data units stored within contiguous locations dependent upon the encryption indicator.

34. The non-transitory machine readable medium as recited in claim 31, wherein receiving the address within the selected memory region comprises receiving a physical address within the selected memory region, and wherein using the address to access the encryption indicator comprises using the physical address to access the encryption indicator.

35. The non-transitory machine readable medium as recited in claim 34, wherein using the physical address to access an encryption indicator further comprises using the physical address to access at least one security attribute data structure located in the memory to obtain the encryption indicator.

36. The non-transitory machine readable medium as recited in claim 35, wherein using the physical address to access at least one security attribute data structure located in the memory to obtain the encryption indicator further comprises using the physical address to access a security attribute table entry comprising an encrypted memory bit.

37. A system, comprising:

means for receiving an address within a selected memory region in a memory;

means for using the received address to access an encryption indicator indicating whether

data stored in the selected memory region is encrypted in the memory;

means for receiving a block of data from the selected memory region and the encryption indicator; and

means for decrypting the received block of data dependent upon the encryption indicator; and

means for storing the received block of data.

38. The system as recited in claim 37, wherein the means for receiving the block of data from the selected memory region and the encryption indicator comprises means for receiving a plurality of data units stored within contiguous locations from the selected memory region and the encryption indicator, and wherein the means for decrypting the block of data dependent upon the encryption indicator further comprises means for decrypting the plurality of data units stored within contiguous locations dependent upon the encryption indicator.

39. The system as recited in claim 37, wherein the means for receiving the address within the selected memory region comprises means for receiving a physical address within the selected memory region, and wherein the means for using the address to access the encryption indicator comprises means for using the physical address to access the encryption indicator.

40. The system as recited in claim 39, wherein the means for using the physical address to access an encryption indicator further comprises means for using the physical address to access at least one security attribute data structure located in the memory to obtain the encryption indicator.

41. The system as recited in claim 40, wherein the means for using the physical address to access at least one security attribute data structure located in the memory to obtain the encryption indicator further comprises means for using the physical address to access a security attribute table entry comprising an encrypted memory bit.