Encrypted memory

• US 8,930,714 B2
• Filed: 07/29/2011
• Issued: 01/06/2015
• Est. Priority Date: 07/19/2011
• Status: Active Grant

• Current Assignee: RPX Corporation
• Original Assignee: Elwha LLC (Intellectual Ventures LLC)
• Inventors: Glew, Andrew F., Tegreene, Casey T., Gerrity, Daniel A.
• Primary Examiner(s): PYZOCHA, MICHAEL J
• Application Number:
  US13/136,400
• Publication Number:
  US 20130022201A1
• Time in Patent Office: 1,257 Days
• Field of Search: 713/190, 713/193
• US Class Current: 713/190
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 21/79 in semiconductor storage media, e.g. directly-addressable memories
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: G06F 21/87 by means of encapsulation, e.g. for integrated circuits

Abstract

A memory device is operable to perform channel encryption wherein for communication between devices, each includes cryptographic logic and performs cryptographic operations. In an illustrative embodiment, the memory device can comprise memory operable to store data communicated via a communication channel from a processor, and logic operable to perform channel encryption operations on the communication channel that communicates information between the processor and the memory.

Claims

1. A memory device comprising:

a memory operable to store data communicated via a communication channel from a processor; and

logic-in-memory at least partially integrated with the memory and operable to perform channel encryption operations on the communication channel that communicates information between the processor and the memory, the logic-in-memory further operable to dynamically modify one or more address mappings in the memory in a manner that enables the processor to reprogram one or more addresses to correspond to the modification.

2. The memory device according to claim 1 wherein:

the logic-in-memory at least partially integrated with the memory and operable to perform channel encryption operations is operable to decrypt information encrypted by the processor.

3. The memory device according to claim 1 wherein:

the logic-in-memory at least partially integrated with the memory and operable to perform channel encryption operations is operable to decrypt address and data information encrypted by the processor and store data at the address.

4. The memory device according to claim 1 wherein:

the logic-in-memory at least partially integrated with the memory and operable to perform channel encryption operations is operable to partially decrypt information encrypted by the processor.

5. The memory device according to claim 1 further comprising:

a pseudo-random number generator coupled to the memory and coupled to the logic-in-memory at least partially integrated with the memory and operable to perform channel encryption operations, the pseudo-random number generator operable to generate numbers for usage in encrypting information on the communication channel.

6. The memory device according to claim 1 wherein:

the logic-in-memory at least partially integrated with the memory and operable to perform channel encryption operations is operable to perform stream encryption of information communicated on the communication channel wherein processor and memory sides of the communication channel are assigned a key.

7. The memory device according to claim 1 wherein:

the logic-in-memory at least partially integrated with the memory and operable to perform channel encryption operations is operable to perform channel encryption operations on the communication channel for information that is storage encrypted wherein the storage-encrypted information is encrypted by the processor, stored in the memory, accessed from the memory, and decrypted by the processor.

8. The memory device according to claim 1 further comprising:

a tamper-handling device coupled to the memory and operable to handle physical intrusion to the memory.

9. The memory device according to claim 8 wherein:

the tamper-handling device is operable to perform at least one operation of tamper-proofing, tamper-resistance, and tamper-evidence.

10. The memory device according to claim 8 wherein:

the logic-in-memory at least partially integrated with the memory and operable to perform channel encryption operations and the tamper-handling device are operable to form at least one cryptographic and tamper-handling security perimeter enclosing at least one selected region of the memory.

11. The memory device according to claim 1 wherein:

the logic-in-memory at least partially integrated with the memory and operable to perform channel encryption operations is operable to perform time-varying encryption.

12. The memory device according to claim 1 wherein:

the logic-in-memory at least partially integrated with the memory and operable to perform encryption operations is operable to encrypt data communicated between the memory device and the processor according to an encryption model that is specified by a one-time pad that synchronizes encryption state between the memory device and the processor.

13. The memory device according to claim 1 wherein:

the logic-in-memory at least partially integrated with the memory and operable to perform encryption operations is operable to encrypt data communicated between the memory device and the processor according to an encryption model that is specified by a key schedule that synchronizes encryption state between the memory device and the processor.

14. The memory device according to claim 1 wherein:

the logic-in-memory at least partially integrated with the memory and operable to perform encryption operations is configured in combination with the processor according to an encryption model that is configured to synchronize encryption state between the memory device and the processor.

15. The memory device according to claim 1 wherein:

the logic-in-memory at least partially integrated with the memory and operable to perform encryption operations is configured in combination with the processor wherein the processor and the memory device are manufactured separately while upgraded in concert to specify an encryption model that is configured to synchronize encryption state between the memory device and the processor.

16. The memory device according to claim 1 wherein:

the logic-in-memory at least partially integrated with the memory and operable to perform encryption operations is configured in combination with the processor using one or more keys that are installed and assigned during manufacture for processors from one or more particular manufacturers and for memory devices from one or more memory suppliers to specify an encryption model that is configured to synchronize encryption state between the memory device and the processor.

17. The memory device according to claim 1 wherein:

the logic-in-memory at least partially integrated with the memory and operable to perform encryption operations is configured in combination with the processor using one or more keys that are installed and hard-wired during manufacture for processors from one or more particular manufacturers and for memory devices from one or more memory suppliers to specify an encryption model that is configured to synchronize encryption state between the memory device and the processor.

18. The memory device according to claim 1 wherein:

the logic-in-memory at least partially integrated with the memory and operable to perform encryption operations is configured in combination with the processor using one or more keys that are available at power-up to specify an encryption model that is configured to synchronize encryption state between the memory device and the processor.

19. The memory device according to claim 1 wherein:

the logic-in-memory at least partially integrated with the memory and operable to perform encryption operations is configured in combination with the processor according to an encryption model that is configured to synchronize encryption state between the memory device and the processor and protects against a man-in-the-middle attack in which an attacker has a logic analyzer connected between the processor and memory device to at least one of access, modify, or send data transmitted between the processor and the memory device.

20. The memory device according to claim 1 wherein:

the logic-in-memory at least partially integrated with the memory and operable to perform encryption operations is operable to receive a value E₁(A,D) encrypted from address A and data D using channel encryption, and modify the value E₁(A,D) into a value E₂(A,D) for reading by the processor that is indicative of an encryption state different from the encryption state of the value E₁(A,D) according to an encryption model that is configured to synchronize encryption state between the memory device and the processor.

21. A memory device comprising:

a hybrid memory comprising a plurality of memory segments characterized by a plurality of operating characteristics, the hybrid memory operable to store data communicated from a processor; and

logic-in-memory at least partially integrated with the hybrid memory and operable to perform encryption operations on the data during transfers between one or more of the plurality of memory segments, the logic-in-memory further operable to dynamically modify one or more address mappings in the memory in a manner that enables the processor to reprogram one or more addresses to correspond to the modification.

22. The memory device according to claim 21 wherein:

the logic-in-memory at least partially integrated with the hybrid memory and operable to perform encryption operations is operable to perform encryption operations on the data during transfers between the processor and the plurality of memory segments.

23. The memory device according to claim 21 wherein:

the plurality of memory segments includes a volatile main memory.

24. The memory device according to claim 21 wherein:

the plurality of memory segments includes a nonvolatile main memory.

25. The memory device according to claim 21 wherein:

the plurality of memory segments includes a volatile main memory and a nonvolatile main memory wherein the volatile main memory has faster operating characteristics than the nonvolatile main memory.

26. The memory device according to claim 21 wherein:

the plurality of memory segments includes a cache.

27. The memory device according to claim 21 wherein:

the logic-in-memory at least partially integrated with the hybrid memory and operable to perform encryption operations encrypts data on a communication channel that communicates information between the processor and the hybrid memory.

28. The memory device according to claim 21 wherein:

the logic-in-memory at least partially integrated with the hybrid memory and operable to perform encryption operations is operable to decrypt information encrypted by the processor.

29. The memory device according to claim 21 wherein:

the logic-in-memory at least partially integrated with the hybrid memory and operable to perform encryption operations is operable to decrypt address and data information encrypted by the processor and store data at the address in the hybrid memory.

30. The memory device according to claim 21 wherein:

the logic-in-memory at least partially integrated with the hybrid memory and operable to perform encryption operations is operable to partially decrypt information encrypted by the processor.

31. The memory device according to claim 21 further comprising:

a pseudo-random number generator coupled to the hybrid memory and coupled to the logic-in-memory at least partially integrated with the hybrid memory and operable to perform encryption operations, the pseudo-random number generator operable to generate numbers for usage in encrypting information.

32. The memory device according to claim 21 wherein:

the logic-in-memory at least partially integrated with the hybrid memory and operable to perform encryption operations is operable to perform stream encryption of communicated information wherein processor and memory sides are assigned a key.

33. The memory device according to claim 21 wherein:

the logic-in-memory at least partially integrated with the hybrid memory and operable to perform encryption operations is operable to encrypt information that is storage encrypted wherein the storage-encrypted information is encrypted by the processor, stored in the hybrid memory, accessed from the hybrid memory, and decrypted by the processor.

34. The memory device according to claim 21 further comprising:

a tamper-handling device coupled to the hybrid memory and operable to handle physical intrusion to the hybrid memory.

35. The memory device according to claim 34 wherein:

the tamper-handling device is operable to perform at least one operation of tamper-proofing, tamper-resistance, and tamper-evidence.

36. The memory device according to claim 34 wherein:

the logic-in-memory at least partially integrated with the hybrid memory and operable to perform encryption operations and the tamper-handling device are operable to form at least one cryptographic and tamper-handling security perimeter enclosing at least one selected region of the hybrid memory.

37. The memory device according to claim 21 wherein:

the logic-in-memory at least partially integrated with the hybrid memory and operable to perform encryption operations is operable to perform time-varying encryption.

38. A memory device comprising:

a memory stack operable to store data communicated from a processor, the memory stack comprising;

a storage structure including a plurality of memory elements operable to store data communicated via a communication channel from the processor; and

logic-in-memory at least partially integrated with the plurality of memory elements and operable to perform encryption operations on the data during transfers between the processor and the storage structure, the logic-in-memory further operable to dynamically modify one or more address mappings in the memory in a manner that enables the processor to reprogram one or more addresses to correspond to the modification.

39. The memory device according to claim 38 wherein:

the logic-in-memory at least partially integrated with the plurality of memory elements and operable to perform encryption operations is operable to perform channel encryption operations on a communication channel that communicates information between the processor and the memory stack.

40. The memory device according to claim 38 wherein:

the logic-in-memory at least partially integrated with the plurality of memory elements and operable to perform encryption operations is operable to decrypt information encrypted by the processor.

41. The memory device according to claim 38 wherein:

the logic-in-memory at least partially integrated with the plurality of memory elements and operable to perform encryption operations is operable to partially decrypt information encrypted by the processor.

42. The memory device according to claim 38 wherein:

the logic-in-memory at least partially integrated with the plurality of memory elements and operable to perform encryption operations is operable to perform stream encryption of information communicated on a communication channel wherein processor and memory sides of the communication channel are assigned a key.

43. The memory device according to claim 38 wherein:

the logic-in-memory at least partially integrated with the plurality of memory elements and operable to perform encryption operations is operable to perform channel encryption operations on a communication channel for information that is storage encrypted wherein the storage-encrypted information is encrypted by the processor, stored in the memory stack, accessed from the memory stack, and decrypted by the processor.

44. The memory device according to claim 38 wherein:

the logic-in-memory at least partially integrated with the plurality of memory elements and operable to perform encryption operations is operable to perform time-varying encryption.

45. A memory device comprising:

a memory operable to store data communicated via a communication channel from a processor; and

logic-in-memory at least partially integrated with the memory and operable to perform channel encryption operations on the communication channel that communicates information between the processor and the memory, the logic-in-memory further operable to communicate with the processor using channel encryption with both address and data encrypted into a single encrypted value;

wherein;

the logic-in-memory at least partially integrated with the memory and operable to perform encryption operations is operable to receive a value E₁(A,D) encrypted from address A and data D using channel encryption, and modify the value E₁(A,D) into a value E₂(A,D) for reading by the processor that is indicative of an encryption state different from the encryption state of the value E₁(A,D) according to an encryption model that is synchronized between the memory device and the processor.

46. The memory device according to claim 45 wherein:

the logic-in-memory at least partially integrated with the memory and operable to perform encryption operations is operable to receive a value E₁(A,D) encrypted from address A and data D using channel encryption, and modify the value E₁(A,D) into a value E₂(A,D) for reading by the processor that is indicative of an encryption state different from the encryption state of the value E₁(A,D) according to an encryption model that is specified by a key schedule synchronized between the memory device and the processor.

47. The memory device according to claim 45 wherein:

the logic-in-memory at least partially integrated with the memory and operable to perform encryption operations is operable to receive a value E₁(A,D) encrypted from address A and data D using channel encryption, and modify the value E₁(A,D) into a value E₂(A,D) for reading by the processor that is indicative of an encryption state different from the encryption state of the value E₁(A,D) according to an encryption model that is specified by a one-time pad synchronized between the memory device and the processor.