Security perimeter

• US 9,575,903 B2
• Filed: 08/04/2011
• Issued: 02/21/2017
• Est. Priority Date: 08/04/2011
• Status: Active Grant

• Current Assignee: RPX Corporation
• Original Assignee: Elwha LLC (Intellectual Ventures LLC)
• Inventors: Tegreene, Clarence T., Gerrity, Daniel A., Glew, Andrew F.
• Primary Examiner(s): Pham, Luu
• Assistant Examiner(s): Baum, Ronald
• Application Number:
  US13/136,666
• Publication Number:
  US 20130036314A1
• Time in Patent Office: 2,028 Days
• Field of Search: 713/194
• US Class Current: 1/1
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/71 to assure secure computing or processing of information
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 21/79 in semiconductor storage media, e.g. directly-addressable memories
• CPC Class Codes: G06F 21/86 Secure or tamper-resistant housings
• CPC Class Codes: G06F 2221/2149 Restricted operating environment

Abstract

Embodiments of memory devices, computer systems, security apparatus, data handling systems, and the like, and associated methods facilitate security in a system incorporating the concept of a security perimeter which combines cryptographic and physical security. The memory device can comprise a memory operable to store information communicated with a processor, and a logic operable to create at least one cryptographic security perimeter enclosing at least one selected region of the memory and operable to manage information communication between the processor and the at least one selected region of the memory.

Claims

1. A memory device comprising:

a memory integrated circuit including at least;

memory including a plurality of memory regions configured to store information communicated with at least one processor; and

logic-in-memory at least partially integrated with the memory, the logic-in-memory including at least

encryption logic configured to create at least one cryptographic security perimeter internal to the memory integrated circuit enclosing at least one selected memory region of the plurality of memory regions wherein data inside the at least one cryptographic security perimeter has a different cryptographic state than information outside the at least one cryptographic security perimeter, and at least one of encryption or decryption of data is performed during a direct memory-to-memory transfer across the at least one cryptographic security perimeter wherein the data is at least one of encrypted or decrypted during transfer from a first memory region to a second memory region internal to the memory integrated circuit; and

tamper-handling logic configured to create at least one physical tamper handling security perimeter internal to the memory integrated circuit enclosing at least one selected memory region of the plurality of memory regions wherein at least one physical tamper-handling function is performed in association with the at least one selected memory region within the at least one physical tamper handling security perimeter.

2. The memory device according to claim 1 further comprising:

a tamper-handling device coupled to the memory and configured to handle physical intrusion to the memory wherein the tamper-handling device and the encryption logic are configured to create at least one cryptographic security perimeter operable in combination to create a cryptographic and physical tamper-handling security perimeter; and

at least one sensor coupled to the tamper-handling logic configured to create at least one physical tamper handling security perimeter internal to the memory integrated circuit enclosing at least one selected memory region of the plurality of memory regions, the at least one sensor including at least one of;

at least one electrical characteristic sensor, wherein the tamper-handling device is configured to create at least one physical tamper handling security perimeter internal to the memory integrated circuit enclosing at least one selected memory region of the plurality of memory regions is further configured to detect intrusion in response to one or more signals from the at least one electrical characteristic sensor and to respond by erasing information stored in the at least one selected region of the memory;

or

at least one temperature sensor, wherein the tamper-handling device is configured to create at least one physical tamper handling security perimeter internal to the memory integrated circuit enclosing at least one selected memory region of the plurality of memory regions is further configured to detect a liquid nitrogen freeze in response to one or more signals from the at least one temperature sensor and to respond by erasing information stored in the at least one selected region of the memory.

3. The memory device according to claim 2 wherein:

the tamper-handling device is configured to perform at least one operation of tamper-proofing, tamper-resistance, and tamper-evidence.

4. The memory device according to claim 2 wherein the tamper-handling device includes:

circuitry configured to erase or destroy data in at least one portion of the memory device coupled to the memory integrated circuit, wherein the tamper-handling device is configured to create at least one physical tamper handling security perimeter internal to the memory integrated circuit enclosing at least one selected memory region of the plurality of memory regions and further configured to detect intrusion in response to one or more signals from the at least one electrical characteristic sensor and to respond by erasing or destroying data in at least one portion of the memory device.

5. The memory device according to claim 1 wherein:

the memory includes a plurality of memory types characterized by a corresponding plurality of operating characteristics; and

the encryption logic configured to create at least one cryptographic security perimeter internal to the memory integrated circuit is configured to create a plurality of cryptographic security perimeters internal to the memory integrated circuit allocated to selected memory types of the plurality of memory types wherein memory with a first memory speed is placed inside the at least one cryptographic security perimeter and memory with a second speed slower than the first speed is placed outside the at least one cryptographic security perimeter.

6. The memory device according to claim 1 wherein:

the encryption logic configured to create at least one cryptographic security perimeter internal to the memory integrated circuit is configured to create a plurality of nested cryptographic security perimeters including an innermost cryptographic security perimeter enclosing memory operating with unencrypted information and an outermost cryptographic security perimeter enclosing memory outside the innermost cryptographic security perimeter operating with information encrypted with a first encryption strength, the memory outside the outermost cryptographic security perimeter enclosing memory operating with information encrypted with a second encryption strength greater than the first encryption strength.

7. The memory device according to claim 1 wherein:

the memory is configured to store data communicated via a communication channel with the at least one processor; and

the encryption logic configured to create at least one cryptographic security perimeter internal to the memory integrated circuit is configured to perform channel encryption operations on the communication channel that communicates information between the at least one processor and the memory wherein an address A and data D are encrypted into an encrypted value E₁(A,D) and the at least one processor is configured to read back a different encrypted value E₂(A,D) as encryption state changes according to a predetermined scheme between the memory and the at least one processor.

8. The memory device according to claim 1 wherein:

the encryption logic configured to create at least one cryptographic security perimeter internal to the memory integrated circuit is configured to perform channel encryption operations on the communication channel for information that is storage encrypted wherein storage-encrypted information is encrypted by the at least one processor, stored in the memory, accessed from the memory, and decrypted by the at least one processor.

9. The memory device according to claim 1 wherein:

the encryption logic configured to create at least one cryptographic security perimeter internal to the memory integrated circuit is configured to perform time-varying channel encryption wherein the encryption logic is configured to change addresses at which data is stored in the memory over time independently of direction by the at least one processor.

10. The memory device according to claim 1 wherein:

the memory is configured to store data communicated via a communication channel with the at least one processor; and

the encryption logic configured to create at least one cryptographic security perimeter internal to the memory integrated circuit is configured to perform channel encryption of information communicated on the communication channel wherein an address A and data D are encrypted into an encrypted value E₁(A,D) and at least one processor is configured to read back a different encrypted value E₂(A,D) as encryption state changes according to a predetermined scheme between the memory and the at least one processor and wherein the at least one processor and memory sides of the communication channel are assigned a key.

11. The memory device according to claim 1 wherein the encryption logic configured to create at least one cryptographic and tamper-handling security perimeter internal to the memory integrated circuit includes:

at least one of

encryption logic configured to create at least one cryptographic security perimeter internal to the memory integrated circuit including logic-configured to decrypt information encrypted by the at least one processor;

encryption logic configured to create at least one cryptographic and tamper-handling security perimeter internal to the memory integrated circuit including logic configured to decrypt address and data information encrypted by the at least one processor and store data at the decrypted address;

or

encryption logic configured to create at least one cryptographic and tamper-handling security perimeter internal to the memory integrated circuit including logic configured to partially decrypt information encrypted by the at least one processor.

12. The memory device according to claim 1 wherein the tamper-handling logic configured to create at least one physical tamper handling security perimeter internal to the memory integrated circuit enclosing at least one selected memory region of the plurality of memory regions includes:

tamper-handling logic configured to perform at least one of tamper-proofing, tamper-resistance, or tamper-evidence operation directed to the at least one selected memory region.

13. The memory device according to claim 1 wherein the tamper-handling logic configured to create at least one physical tamper handling security perimeter internal to the memory integrated circuit enclosing at least one selected memory region of the plurality of memory regions includes:

tamper-handling logic configured to monitor integrated circuit temperature, analyze the integrated circuit temperature to determine whether a temperature-specific attack has been applied to the integrated circuit, and upon detecting the temperature-specific attack erasing data to prevent data access or manipulation.

14. The memory device according to claim 1 wherein:

the encryption logic configured to create at least one cryptographic security perimeter internal to the memory integrated circuit is configured to receive in a memory write operation by the at least one processor into the at least one cryptographic security perimeter a first value including an encrypted address and encrypted data, the at least one processor subsequently reading a second value in a memory read by the at least one processor from the at least one cryptographic security perimeter, the encryption logic modifying the second value from the first value indicative of the different cryptographic state according to a key schedule.

15. The memory device according to claim 1 wherein:

the encryption logic configured to create at least one cryptographic security perimeter internal to the memory integrated circuit is configured to receive in a memory write operation by the at least one processor into the at least one cryptographic security perimeter data written to a first address, the at least one processor subsequently reading the data from a second address in the at least one cryptographic security perimeter, the encryption logic modifying address mapping indicative of the different cryptographic state.

16. The memory device according to claim 1 wherein:

the encryption logic configured to create at least one cryptographic security perimeter internal to the memory integrated circuit is configured to receive from the at least one processor a pointer that identifies a lower bound, an upper bound and permissions specifying the location and cryptographic state of the at least one cryptographic perimeter.

17. The memory device according to claim 1 wherein:

the encryption logic configured to create at least one cryptographic security perimeter internal to the memory integrated circuit is configured wherein at least one aspect of cryptographic security is storage encryption with encryption operations performed by the at least one processor and encrypted information written to memory and at least one aspect of cryptographic security is channel encryption with encryption operations performed by the at least one processor and the encryption logic configured to create at least one cryptographic security perimeter internal to the memory integrated circuit.

18. The memory device according to claim 1 wherein:

the encryption logic configured to create at least one cryptographic security perimeter internal to the memory integrated circuit is configured to receive in a memory write operation by the at least one processor into the at least one cryptographic security perimeter encrypted information that is written to a selected location within the at least one cryptographic security perimeter in the memory, and configured to decrypt the encrypted information during transfer to registers of the at least one processor in a memory read operation by the at least one processor.

19. The memory device according to claim 1 wherein the encryption logic configured to create at least one cryptographic security perimeter internal to the memory integrated circuit includes at least:

at least one of;

encryption logic configured to receive an address from the at least one processor and execute instructions within the at least one cryptographic security perimeter in the memory;

encryption logic configured to receive a message from the at least one processor and load the message to fill at least one portion in a template in the memory within the at least one cryptographic security perimeter and execute one or more instructions formed by the filled template;

or

encryption logic configured to receive metadata specifying at least one location and at least one cryptographic operation from the at least one processor and create the at least one cryptographic security perimeter at the at least one location to perform the at least one cryptographic operation.

20. The memory device according to claim 1 wherein:

the encryption logic configured to create at least one cryptographic security perimeter internal to the memory integrated circuit is configured to perform encryption operations including dynamically modifying one or more address mappings in the memory, and wherein the at least one processor is configured to read back from the modified address mappings according to a predetermined scheme between the memory and the at least one processor.

21. The memory device according to claim 1 wherein:

the encryption logic configured to create at least one cryptographic security perimeter internal to the memory integrated circuit is configured to perform encryption operations including encrypting data communicated between the memory and the at least one processor that modifies encryption according to an encryption model wherein the at least one processor is configured to decrypt the data according to a one-time pad that synchronizes encryption state between the memory and the at least one processor.

22. The memory device according to claim 1 wherein:

the encryption logic configured to create at least one cryptographic security perimeter internal to the memory integrated circuit is configured to perform encryption operations including encrypting data communicated between the memory and the at least one processor that modifies encryption according to an encryption model wherein the at least one processor is configured to decrypt the data according to a key schedule that synchronizes encryption state between the memory and the at least one processor.

23. The memory device according to claim 1 wherein:

the memory includes at least one cache, at least one random access memory (RAM), and at least one non-volatile memory characterized by a transfer speed slower than a RAM transfer speed; and

the encryption logic is configured to transfer information directly between the cache and the RAM without encryption and includes at least encryption logic configured to perform at least one of encryption or decryption of data transferred in a direct memory-to-memory transfer between the RAM and the non-volatile memory.

24. The memory device according to claim 1 wherein:

the memory includes at least one random access memory (RAM) and at least one phase change memory (PCM); and

the encryption logic includes at least encryption logic configured to perform at least one of encryption or decryption of data transferred in a direct memory-to-memory transfer between the RAM and the PCM.

45. The memory device according to claim 1 wherein:

the tamper-handling logic configured to create at least one physical tamper handling security perimeter internal to the memory integrated circuit enclosing at least one selected memory region of the plurality of memory regions is configured to perform at least one operation of tamper-proofing, tamper-resistance, and tamper-evidence including detecting and responding to at least one physical attack of physical attacks including at least one of;

a physical attack based on remanence or remanent magnetization;

a physical attack based on remanence or remanent magnetization wherein magnetic field of the at least one selected memory region is detected and analyzed by spraying the at least one selected memory region with liquid nitrogen and moving data from the attacked at least one selected memory region to another memory;

a physical attack based on temperature;

a physical attack based on temperature wherein temperature of the at least one selected memory region is analyzed to determine whether a liquid nitrogen freeze has been applied to the at least one selected memory region;

a physical attack based on temperature wherein temperature of the at least one selected memory region is monitored and upon detection of a predetermined threshold reduction in temperature data in the at least one selected memory region is erased prior to unauthorized reading or manipulation;

a physical attack based on exposure to acid;

a physical attack based on exposure to radio frequency signals;

a physical attack based on exposure to radio frequency signals wherein one or more sensors for detecting electrical characteristics interior to the at least one selected memory region indicate the physical attack;

a physical attack based on electrical characteristics interior to the at least one selected memory region;

a physical attack based on electrical characteristics interior to the at least one selected memory region wherein a short circuit condition indicate the physical attack;

or

a physical attack based on electrical characteristics interior to the at least one selected memory region wherein data stored in the at least one selected memory region is erased and stored in another memory before unauthorized reading is possible.

47. The security apparatus according to claim 16 wherein:

the encryption logic is configured to dynamically modify one or more address mappings in the memory in a manner that enables the at least one processor to reprogram one or more addresses to correspond to the modification; and

the encryption logic is configured to perform encryption operations including encrypting data communicated between the memory and the at least one processor that modifies encryption according to an encryption model wherein the at least one processor is configured to decrypt the data according to a one-time pad that synchronizes encryption state between the memory and the at least one processor.

25. A computer system comprising:

at least one processor; and

a memory integrated circuit at least communicatively coupled to the at least one processor, the memory integrated circuit including at least;

a memory device communicatively coupled to the at least one processor and including at least;

memory including a plurality of memory regions, the memory configured to store information communicated with the at least one processor; and

logic-in-memory at least partially integrated with the memory, the logic-in-memory including at least

encryption logic configured to create at least one cryptographic security perimeter internal to the memory integrated circuit enclosing at least one selected memory region of the plurality of memory regions wherein data inside the at least one cryptographic security perimeter has a different cryptographic state than information outside the at least one cryptographic security perimeter, and at least one of encryption or decryption of data is performed during a direct memory-to-memory transfer across the at least one cryptographic security perimeter wherein the data is at least one of encrypted or decrypted during transfer from a first memory region to a second memory region internal to the memory integrated circuit; and

tamper-handling logic configured to create at least one physical tamper handling security perimeter internal to the memory integrated circuit enclosing at least one selected memory region of the plurality of memory regions wherein at least one physical tamper-handling function is performed in association with the at least one selected memory region within the at least one physical tamper handling security perimeter.

26. The computer system according to claim 25 further comprising:

a tamper-handling device coupled to the memory and configured to handle physical intrusion to the memory wherein the tamper-handling device and the encryption logic configured to create at least one cryptographic security perimeter internal to the memory integrated circuit are configured in combination to create a cryptographic and physical tamper-handling security perimeter; and

at least sensor coupled to the tamper-handling logic configured to create at least one physical tamper handling security perimeter internal to the memory integrated circuit enclosing at least one selected memory region of the plurality of memory regions, the at least one sensor including at least one of

at least one electrical characteristic sensor, wherein the tamper-handling device configured to create at least one physical tamper handling security perimeter internal to the memory integrated circuit enclosing at least one selected memory region of the plurality of memory regions is further configured to detect intrusion in response to one or more signals from the at least one electrical characteristic sensor and to respond by erasing information stored in the at least one selected region of the memory;

or

at least one temperature sensor, wherein the tamper-handling device is configured to create at least one physical tamper handling security perimeter internal to the memory integrated circuit enclosing at least one selected memory region of the plurality of memory regions further configured to detect a liquid nitrogen freeze in response to one or more signals from the at least one temperature sensor and to respond by erasing information stored in the at least one selected region of the memory.

27. The computer system according to claim 26 wherein:

the tamper-handling device is configured to perform at least one operation of tamper-proofing, tamper-resistance, and tamper-evidence.

28. The computer system according to claim 26 wherein:

the encryption logic configured to create at least one cryptographic security perimeter internal to the memory integrated circuit and the tamper-handling device are configured to form at least one cryptographic and physical tamper-handling security perimeter enclosing the at least one selected region of the memory;

the memory device further comprising;

a module configured to erase or destroy data in at least one portion of the memory device, wherein the tamper-handling logic is configured to detect intrusion in response to one or more signals from the at least one electrical characteristic sensor and to respond by erasing or destroying data in at least one portion of the memory device.

29. The computer system according to claim 25 wherein:

the memory includes a plurality of memory types characterized by a plurality of operating characteristics including phase change memory; and

the encryption logic configured to create at least one cryptographic security perimeter internal to the memory integrated circuit is configured to receive a plurality of pointers and metadata associated with the plurality of pointers to select a plurality of regions in the memory for operation as the a plurality of cryptographic perimeters to create the create a plurality of cryptographic security perimeters allocated to selected memory types of the plurality of memory types wherein one or more of the at least one cryptographic security perimeter encloses the memory and only information flow between the memory and phase change memory is encrypted.

30. The computer system according to claim 25 wherein:

the encryption logic configured to create at least one cryptographic security perimeter internal to the memory integrated circuit is configured to create a plurality of nested cryptographic security perimeters including an innermost cryptographic security perimeter enclosing memory operating with unencrypted information and an outermost cryptographic security perimeter enclosing memory outside the innermost cryptographic security perimeter operating with information encrypted with a first encryption strength, the memory outside the outermost cryptographic security perimeter enclosing memory operating with information encrypted with a second encryption strength greater than the first encryption strength.

31. The computer system according to claim 25 wherein:

the memory is configured to store data communicated via a communication channel with the at least one processor; and

the encryption logic configured to create at least one cryptographic security perimeter internal to the memory integrated circuit is configured to perform channel encryption operations on the communication channel that communicates information between the at least one processor and the memory wherein an address A and data D are encrypted into an encrypted value E₁(A,D) and the at least one processor is configured to read back a different encrypted value E₂(A,D) as encryption state changes according to a predetermined scheme between the memory and the at least one processor.

32. The computer system according to claim 31 further comprising:

the encryption logic configured to create at least one cryptographic security perimeter internal to the memory integrated circuit is configured to perform channel encryption operations on the communication channel for information that is storage encrypted wherein storage-encrypted information is encrypted by the at least one processor, stored in the memory, accessed from the memory, and decrypted by the at least one processor.

33. The computer system according to claim 31 further comprising:

the encryption logic configured to create at least one cryptographic security perimeter internal to the memory integrated circuit is configured to perform time-varying channel encryption wherein the encryption logic is configured to change addresses at which data is stored in the memory over time independently of direction by the at least one processor.

34. The computer system according to claim 25 wherein:

the memory is configured to store data communicated via a communication channel with the at least one processor; and

the encryption logic configured to create at least one cryptographic security perimeter internal to the memory integrated circuit is configured to perform stream encryption of information communicated on the communication channel wherein an address A and data D are encrypted into an encrypted value E₁(A,D) and the at least one processor is configured to read back a different encrypted value E₂(A,D) as encryption state changes according to a predetermined scheme between the memory and the at least one processor and wherein the at least one processor and memory sides of the communication channel are assigned a key.

35. The computer system according to claim 25 wherein the encryption logic configured to create at least one cryptographic and tamper-handling security perimeter internal to the memory integrated circuit includes:

at least one of

encryption logic configured to create at least one cryptographic security perimeter internal to the memory integrated circuit including logic configured to decrypt information encrypted by the at least one processor;

encryption logic configured to create at least one cryptographic security perimeter internal to the memory integrated circuit including logic configured to decrypt address and data information encrypted by the at least one processor and store data at the decrypted address;

or

encryption logic configured to create at least one cryptographic security perimeter internal to the memory integrated circuit including logic configured to partially decrypt information encrypted by the at least one processor.

36. The computer system according to claim 25 wherein the tamper-handling logic configured to create at least one physical tamper handling security perimeter internal to the memory integrated circuit enclosing at least one selected memory region of the plurality of memory regions includes:

tamper-handling logic configured to perform at least one of tamper-proofing, tamper-resistance, or tamper-evidence operation directed to the at least one selected memory region.

37. The computer system according to claim 25 wherein the tamper-handling logic configured to create at least one physical tamper handling security perimeter internal to the memory integrated circuit enclosing at least one selected memory region of the plurality of memory regions includes:

tamper-handling logic configured to monitor integrated circuit temperature, analyze the integrated circuit temperature to determine whether a temperature-specific attack has been applied to the integrated circuit, and upon detecting the temperature-specific attack erasing data to prevent data access or manipulation.

38. The computer system according to claim 25 wherein:

the encryption logic configured to create at least one cryptographic security perimeter internal to the memory integrated circuit is configured to create at least one cryptographic security perimeter in a video gaming server application.

39. The computer system according to claim 25 wherein:

the encryption logic configured to create at least one cryptographic security perimeter internal to the memory integrated circuit is configured to create at least one cryptographic security perimeter in a video gaming client application.

40. The computer system according to claim 25 wherein:

the encryption logic configured to create at least one cryptographic security perimeter internal to the memory integrated circuit is configured to create at least one cryptographic security perimeter in a copyrighted content anti-piracy application.

41. The computer system according to claim 25 wherein:

the encryption logic configured to create at least one cryptographic security perimeter internal to the memory integrated circuit is configured to create at least one cryptographic security perimeter in an information technology server application.

42. The computer system according to claim 25 wherein:

the encryption logic configured to create at least one cryptographic security perimeter internal to the memory integrated circuit is configured to create at least one cryptographic security perimeter in an information technology client application.

43. A security apparatus comprising:

a memory integrated circuit including at least;

a memory including a plurality of memory regions; and

logic-in-memory at least partially integrated with the memory, the logic-in-memory including at least

encryption logic configured to create at least one cryptographic security perimeter internal to the memory integrated circuit enclosing at least one selected region of memory wherein data inside and outside the at least one cryptographic security perimeter have different encryption characteristics, and at least one of encryption or decryption of data is performed during a direct memory-to-memory transfer across the at least one cryptographic security perimeter wherein the data is at least one of encrypted or decrypted during transfer from a first memory region to a second memory region internal to the memory integrated circuit; and

tamper-handling logic configured to create at least one physical tamper handling security perimeter internal to the memory integrated circuit enclosing at least one selected memory region of the plurality of memory regions wherein at least one physical tamper-handling function is performed in association with the at least one selected memory region within the at least one physical tamper handling security perimeter; and

a tamper-handling device coupled to the encryption logic configured to create at least one cryptographic security perimeter internal to the memory integrated circuit and configured to handle physical intrusion to the memory wherein the tamper-handling device and the encryption logic configured to create at least one cryptographic security perimeter internal to the memory integrated circuit are configured in combination to create a cryptographic and physical tamper-handling security perimeter.

44. The security apparatus according to claim 43 wherein:

the encryption logic configured to create at least one cryptographic security perimeter internal to the memory integrated circuit and the tamper-handling device are configured to form at least one cryptographic and physical tamper-handling security perimeter enclosing the at least one selected region of the memory.

46. A security apparatus comprising:

a memory integrated circuit including at least;

a memory including a plurality of memory regions; and

logic-in-memory at least partially integrated with the memory, the logic-in-memory including at least

encryption logic configured to create at least one cryptographic security perimeter internal to the memory integrated circuit enclosing at least one selected region of a memory wherein data inside and outside the at least one cryptographic security perimeter have different levels of cryptographic strength, and at least one of encryption or decryption of data is performed during a direct memory-to-memory transfer across the at least one cryptographic security perimeter wherein the data is at least one of encrypted or decrypted during transfer from a first memory region to a second memory region internal to the memory integrated circuit; and

the encryption logic is configured to (1) perform channel encryption operations on a communication channel that communicates information between at least one processor and the memory, (2) dynamically modify one or more address mappings in the memory, and (3) enable the at least one processor to read back from the modified address mappings according to a predetermined scheme between the memory and the at least one processor; and

tamper-handling logic configured to create at least one physical tamper handling security perimeter internal to the memory integrated circuit enclosing at least one selected memory region of the plurality of memory regions wherein at least one physical tamper-handling function is performed in association with the at least one selected memory region within the at least one physical tamper handling security perimeter.

48. The security apparatus according to claim 46 wherein:

the encryption logic is configured to dynamically modify one or more address mappings in the memory in a manner that enables the at least one processor to reprogram one or more addresses to correspond to the modification; and

the encryption logic is configured to perform encryption operations including encrypting data communicated between the memory and the at least one processor that modifies encryption according to an encryption model wherein the at least one processor is configured to decrypt the data according to a key schedule that synchronizes encryption state between the memory and the at least one processor.