Diversified instruction set processing to enhance security

Patent metadata

Field	Value
Publication number	US-10237059-B2
Application number	US-201514946961-A
Country	US
Kind code	B2
Filing date	Nov 20, 2015
Priority date	Jun 28, 2013
Publication date	Mar 19, 2019
Grant date	Mar 19, 2019

Abstract

Disclosed are devices, systems, apparatus, methods, products, and other implementations, including a method that includes receiving a block of information from non-processor memory at an interface between the non-processor memory and processor memory comprising two or more processor memory levels, determining whether the block of information received from the non-processor memory at the interface corresponds to encrypted instruction code, and decrypting the block of information at the interface between the non-processor memory and the processor memory for storage in one of the two or more levels of the processor memory in response to a determination that the received block of information corresponds to the encrypted instruction code. The block of information is stored at the one of the two or more levels of the processor memory without being decrypted when the received block of information is determined to correspond to data.

First claim

What is claimed is:

1. A method comprising:
receiving a block of information from non-processor memory at an interface between the non-processor memory and processor memory comprising two or more processor memory levels;
determining whether the block of information received from the non-processor memory at the interface corresponds to encrypted instruction code; and
decrypting the block of information at the interface between the non-processor memory and the processor memory for storage in one of the two or more levels of the processor memory in response to a determination that the received block of information corresponds to the encrypted instruction code, wherein the block of information is stored at the one of the two or more levels of the processor memory without being decrypted when the received block of information is determined to correspond to data, wherein decrypting the block of information corresponding to the encrypted instruction code at the interface between the processor-memory and the non-processor memory comprises decrypting the block of information corresponding to the encrypted instruction code with one or more first keys assigned to a first controller device associated with a particular instruction set, the one or more first keys being different from at least one key assigned to a second controller device associated with the particular instruction set so as to emulate instruction set diversification between the first controller device and the second controller device.

2. The method of claim 1 , wherein the processor memory comprises cache memory of a central processing unit (CPU) organized in two or more cache memory levels, and wherein the non-processor memory comprises random access memory.

3. The method of claim 1 , wherein determining whether the block of information received from the non-processor memory at the interface corresponds to the encrypted instruction code comprises:
determining whether the block of information received from the non-processor memory at the interface corresponds to the encrypted instruction code based on a request sent for the block of information.

4. The method of claim 3 , wherein determining whether the block of information received from the non-processor memory corresponds to the encrypted instruction code comprises:
determining that the block of information received from the non-processor memory at the interface corresponds to the encrypted instruction code when the request for the block of information is associated with a portion of the processor-memory configured to store instructions.

5. The method of claim 3 , further comprising:
associating an identifier with the received block of information; and
setting the identifier to a value indicating one of instructions or data based on the determination of whether the block of information corresponds to the encrypted instruction code received from the non-processor memory.

6. The method of claim 5 , further comprising:
determining, in response to a fetch request made by an instruction portion of another level of the two or more levels of the processor memory for at least a portion of the block of information stored at the one of the two or more levels of the processor memory, whether the identifier associated with the block of information stored at the one of the two or more levels of the two or more levels of the processor memory corresponds to the instructions; and
performing one of:
transferring the at least the portion of the block of information stored at the one of the two or more levels of the processor memory to the instruction portion of the other of the two or more levels of the processor memory when the identifier associated with the block of information is determined to correspond to the instructions; or
removing the block of information from the processor memory when the identifier associated with the block of information is determined to correspond to the data, and causing the block of information to be retrieved again from the non-processor memory in order to perform a decryption operation on the block of information retrieved again.

7. The method of claim 5 , further comprising:
determining, in response to a fetch request made by a data portion of another level of the two or more levels of the processor memory for at least a portion of the block of information stored at the one of the two or more levels of the processor memory, whether the identifier associated with the block of information stored at the one of the two or more levels of the processor memory corresponds to the data; and
performing one of:
transferring the at least the portion of the block of information stored at the one of the two or more levels of the processor memory to the data portion of the other of the two or more levels of the processor memory when the identifier associated with the block of information indicates that the block of information corresponds to the data; or
removing the block of information from the processor memory when the identifier associated with the block of information indicates that the block of information corresponds to the instructions, and causing the block of information to be retrieved again from the non-processor memory in order to be transferred into the processor memory without being decrypted.

8. The method of claim 1 , wherein decrypting the block of information corresponding to the encrypted instruction code with the one or more first keys assigned to the first controller device comprises:
decrypting the encrypted instruction code with one or more first symmetric keys according to a counter mode encryption/decryption process, wherein the one or more first symmetric keys comprises one of: a single symmetric key used for any encrypted instruction code retrieved by the first controller device, or multiple symmetric keys with each of the multiple symmetric key used for respective encrypted instructions from a respective one of different memory pages stored in the non-processor memory coupled to the first controller device.

9. The method of claim 1 , wherein decrypting the block of information corresponding to the encrypted instruction code at the interface between the processor-memory and the non-processor memory comprises:
retrieving from the non-processor memory one or more symmetric keys, encrypted using a public key of a private-public key pair for a processor, associated with a code page; and
deriving the one or more symmetric keys from the encrypted one or more symmetric keys using a private key of the private-public key pair for the processor.

10. The method of claim 9 , wherein retrieving the one or more symmetric keys comprises:
retrieving the encrypted one or more symmetric keys during page-fault-processing to retrieve into the non-processor memory the code page.

11. The method of claim 9 , wherein deriving the one or more symmetric keys comprises:
deriving from the encrypted one or more symmetric keys one or more AES keys.

12. A system comprising:
a processor comprising processor memory with two or more processor memory levels; and
a decryption unit at an interface between non-processor memory and the processor memory, the decryption unit configured to:
receive a block of information from the non-processor memory;
determine whether the block of information received from the non-processor memory corresponds to encrypted instruction code; and
decrypt the block of information for storage in one of the two or more levels of the processor memory in response to a determination that the received block of information corresponds to the encrypted instruction code, wherein the block of information is stored at the one of the two

Assignees

• Sethumadhavan Lakshminarasimhan
• Sinha Kanad
• Keromytis Angelos
• Pappas Vasileios
• Kemerlis Vasileios
• Univ Columbia

Inventors

• Sethumadhavan Lakshminarasimhan
• Sinha Kanad
• Keromytis Angelos
• Pappas Vasileios
• Kemerlis Vasileios

Classifications

• H04L9/007

  involving hierarchical structures · CPC title

• G06F21/575

  Secure boot · CPC title

• H04L9/0825 Primary

  using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates · CPC title

• G06F21/123

  by using dedicated hardware, e.g. dongles, smart cards, cryptographic processors, global positioning systems [GPS] devices · CPC title

• G06F2212/1052

  Security improvement · CPC title