Verification bit for one-way encrypted memory

Patent metadata

Field	Value
Publication number	US-10545883-B2
Application number	US-201715720799-A
Country	US
Kind code	B2
Filing date	Sep 29, 2017
Priority date	Sep 29, 2017
Publication date	Jan 28, 2020
Grant date	Jan 28, 2020

Abstract

An embodiment of a semiconductor package apparatus may include technology to identify a first encrypted memory alias corresponding to a first portion of memory based on a verification indicator, where the first portion is decryptable and readable by both a privileged component and an unprivileged component, and identify a second encrypted memory alias corresponding to a second portion of memory based on the verification indicator, where the second portion is accessible by only the unprivileged component. Other embodiments are disclosed and claimed.

First claim

We claim:

1. An electronic processing system, comprising:
a processor;
memory communicatively coupled to the processor; and
logic communicatively coupled to the memory to:
identify a first encrypted memory alias corresponding to a first portion of the memory based on a verification indicator, wherein the first portion is decryptable and readable by both a privileged component and an unprivileged component, and
identify a second encrypted memory alias corresponding to a second portion of the memory based on the verification indicator, wherein the second portion is accessible by only the unprivileged component.

2. The system of claim 1 , wherein the logic is further to:
decrypt and communicate privileged information from the unprivileged component to the privileged component with a first decryption key;
verify the privileged information from the unprivileged component; and
run the unprivileged component if the privileged information is verified.

3. The system of claim 2 , wherein the logic is further to:
determine the first decryption key based on one of the verification indicator used as a tweak to a tweakable cipher and a second decryption key.

4. The system of claim 2 , wherein the logic is further to:
read the verification indicator as a most significant bit of a physical memory address.

5. The system of claim 2 , wherein the privileged component comprises a virtual machine manager and wherein the unprivileged component comprises a guest virtual machine.

6. The system of claim 2 , wherein the privileged information includes one or more of a virtual machine control structure and an extended page table.

7. A semiconductor package apparatus, comprising:
a substrate; and
logic coupled to the substrate, wherein the logic is at least partly implemented in one or more of configurable logic and fixed-functionality hardware logic, the logic coupled to the substrate to:
identify a first encrypted memory alias corresponding to a first portion of memory based on a verification indicator, wherein the first portion is decryptable and readable by both a privileged component and an unprivileged component, and
identify a second encrypted memory alias corresponding to a second portion of memory based on the verification indicator, wherein the second portion is accessible by only the unprivileged component.

8. The apparatus of claim 7 , wherein the logic is further to:
decrypt and communicate privileged information from the unprivileged component to the privileged component with a first decryption key;
verify the privileged information from the unprivileged component; and
run the unprivileged component if the privileged information is verified.

9. The apparatus of claim 8 , wherein the logic is further to:
determine the first decryption key based on one of the verification indicator used as a tweak to a tweakable cipher and a second decryption key.

10. The apparatus of claim 8 , wherein the logic is further to:
read the verification indicator as a most significant bit of a physical memory address.

11. The apparatus of claim 8 , wherein the privileged component comprises a virtual machine manager and wherein the unprivileged component comprises a guest virtual machine.

12. The apparatus of claim 8 , wherein the privileged information includes one or more of a virtual machine control structure and an extended page table.

13. A method of managing a memory, comprising:
identifying a first encrypted memory alias corresponding to a first portion of memory based on a verification indicator, wherein the first portion is decryptable and readable by both a privileged component and an unprivileged component; and
identifying a second encrypted memory alias corresponding to a second portion of memory based on the verification indicator, wherein the second portion is accessible by only the unprivileged component.

14. The method of claim 13 , further comprising:
communicating privileged information from the unprivileged component to the privileged component with a first decryption key;
verifying the privileged information from the unprivileged component; and
running the unprivileged component if the privileged information is verified.

15. The method of claim 14 , further comprising:
determining the first decryption key based on one of the verification indicator used as a tweak to a tweakable cipher and a second decryption key.

16. The method of claim 14 , further comprising:
reading the verification indicator as a most significant bit of a memory address.

17. The method of claim 14 , wherein the privileged component comprises a virtual machine manager and wherein the unprivileged component comprises a guest virtual machine.

18. The method of claim 14 , wherein the privileged information includes one or more of a virtual machine control structure and an extended page table.

19. At least one non-transitory computer readable medium, comprising a set of instructions stored in memory, which when executed by a computing device, cause the computing device to:
identify a first encrypted memory alias corresponding to a first portion of memory based on a verification indicator, wherein the first portion is decryptable and readable by both a privileged component and an unprivileged component; and
identify a second encrypted memory alias corresponding to a second portion of memory based on the verification indicator, wherein the second portion is accessible by only the unprivileged component.

20. The at least one non-transitory computer readable medium of claim 19 , comprising a further set of instructions stored in memory, which when executed by the computing device, cause the computing device to:
communicate privileged information from the unprivileged component to the privileged component with a first decryption key;
verify the privileged information from the unprivileged component; and
run the unprivileged component if the privileged information is verified.

21. The at least one non-transitory computer readable medium of claim 20 , comprising a further set of instructions stored in memory, which when executed by the computing device, cause the computing device to:
determine the first decryption key based on one of the verification indicator used as a tweak to a tweakable cipher and a second decryption key.

22. The at least one non-transitory computer readable medium of claim 20 , comprising a further set of instructions stored in memory, which when executed by the computing device, cause the computing device to:
read the verification indicator as a most significant bit of a memory address.

23. The at least one non-transitory computer readable medium of claim 20 , wherein the privileged component comprises a virtual machine manager and wherein the unprivileged component comprises a guest virtual machine.

24. The at least one non-transitory computer readable medium of claim 20 , wherein the privileged information includes one or more of a virtual machine control structure and an extended page table.

Assignees

• Intel Corp

Inventors

• Durham David M
• Cong Kai
• Shanbhogue Vedvyas
• Huntley Barry E
• Brandt Jason W
• Chhabra Siddhartha
• Sahita Ravi L

Classifications

• G06F12/1009

  using page tables, e.g. page table structures · CPC title

• G06F12/1408 Primary

  by using cryptography (for digital transmission H04L9/00) · CPC title

• G06F2212/65

  Details of virtual memory and virtual address translation · CPC title

• G06F12/109

  for multiple virtual address spaces, e.g. segmentation (G06F12/1036 takes precedence) · CPC title

• G06F2212/151

  Emulated environment, e.g. virtual machine · CPC title