Server RAS leveraging multi-key encryption

Patent metadata

Field	Value
Publication number	US-10725849-B2
Application number	US-201816047638-A
Country	US
Kind code	B2
Filing date	Jul 27, 2018
Priority date	Jul 27, 2018
Publication date	Jul 28, 2020
Grant date	Jul 28, 2020

Abstract

An embodiment of a semiconductor package apparatus may include technology to determine if an access request (e.g., a read or write request) to a memory location would result in an integrity failure and, if so determined, read previous data from the memory location, set an indicator to indicate the integrity failure, and store the previous data together with the indicator and previous authentication information. Other embodiments are disclosed and claimed.

First claim

We claim:

1. An electronic processing system, comprising:
a processor;
memory communicatively coupled to the processor; and
logic communicatively coupled to the processor and the memory to:
determine if an access request to a memory location of the memory would result in an integrity failure and, if so determined,
read previous data from the memory location,
set an indicator to indicate the integrity failure, and
store the previous data together with the indicator and previous authentication information.

2. The system of claim 1 , wherein the logic is further to:
set a bit in the stored previous data as the indicator to indicate the integrity failure.

3. The system of claim 1 , wherein the previous authentication information includes a cryptographic message authentication code associated with the previous data.

4. The system of claim 3 , wherein the logic is further to:
determine if an availability bypass mode is set;
bypass encryption, decryption, and integrity checks if the availability bypass mode is set; and
clear indicators of integrity failure for data sent to the processor if the availability bypass mode is set.

5. The system of claim 4 , wherein the logic is further to:
restore data to the memory location in the availability bypass mode based on the previous data and the cryptographic message authentication code associated with the previous data.

6. The system of claim 1 , wherein the logic is further to:
identify a request to change a key assignment if the indicator is set to indicate the integrity failure and a pre-determined value is stored along with the indicator; and
change the key assignment corresponding to the identified request.

7. A semiconductor package apparatus, comprising:
one or more substrates; and
logic coupled to the one or more substrates, wherein the logic is at least partly implemented in one or more of configurable logic and fixed-functionality hardware logic, the logic coupled to the one or more substrates to:
determine if an access request to a memory location would result in an integrity failure and, if so determined,
read previous data from the memory location,
set an indicator to indicate the integrity failure, and
store the previous data together with the indicator and previous authentication information.

8. The apparatus of claim 7 , wherein the logic is further to:
set a bit in the stored previous data as the indicator to indicate the integrity failure.

9. The apparatus of claim 7 , wherein the previous authentication information includes a cryptographic message authentication code associated with the previous data.

10. The apparatus of claim 9 , wherein the logic is further to:
determine if an availability bypass mode is set;
bypass encryption, decryption, and integrity checks if the availability bypass mode is set; and
clear indicators of integrity failure for data sent to a processor if the availability bypass mode is set.

11. The apparatus of claim 10 , wherein the logic is further to:
restore data to the memory location in the availability bypass mode based on the previous data and the cryptographic message authentication code associated with the previous data.

12. The apparatus of claim 7 , wherein the logic is further to:
identify a request to change a key assignment if the indicator is set to indicate the integrity failure and a pre-determined value is stored along with the indicator; and
change the key assignment corresponding to the identified request.

13. The apparatus of claim 7 , wherein the logic coupled to the one or more substrates includes transistor channel regions that are positioned within the one or more substrates.

14. A method of controlling memory, comprising:
determining if an access request to a memory location would result in an integrity failure and, if so determined:
reading previous data from the memory location;
setting an indicator to indicate the integrity failure; and
storing the previous data together with the indicator and previous authentication information.

15. The method of claim 14 , further comprising:
setting a bit in the stored previous data as the indicator to indicate the integrity failure.

16. The method of claim 14 , wherein the previous authentication information includes a cryptographic message authentication code associated with the previous data.

17. The method of claim 16 , further comprising:
determining if an availability bypass mode is set;
bypassing encryption, decryption, and integrity checks if the availability bypass mode is set; and
clearing indicators of integrity failure for data sent to a processor if the availability bypass mode is set.

18. The method of claim 17 , further comprising:
restoring data to the memory location in the availability bypass mode based on the previous data and the cryptographic message authentication code associated with the previous data.

19. The method of claim 14 , further comprising:
identifying a request to change a key assignment if the indicator is set to indicate the integrity failure and a pre-determined value is stored along with the indicator; and
changing the key assignment corresponding to the identified request.

20. At least one computer readable storage medium, comprising a set of instructions, which when executed by a computing device, cause the computing device to:
determine if an access request to a memory location would result in an integrity failure and, if so determined:
read previous data from the memory location;
set an indicator to indicate the integrity failure; and
store the previous data together with the indicator and previous authentication information.

21. The at least one computer readable storage medium of claim 20 , comprising a further set of instructions, which when executed by the computing device, cause the computing device to:
set a bit in the stored previous data as the indicator to indicate the integrity failure.

22. The at least one computer readable storage medium of claim 21 , wherein the previous authentication information includes a cryptographic message authentication code associated with the previous data.

23. The at least one computer readable storage medium of claim 22 , comprising a further set of instructions, which when executed by the computing device, cause the computing device to:
determine if an availability bypass mode is set;
bypass encryption, decryption, and integrity checks if the availability bypass mode is set; and
clear indicators of integrity failure for data sent to a processor if the availability bypass mode is set.

24. The at least one computer readable storage medium of claim 23 , comprising a further set of instructions, which when executed by the computing device, cause the computing device to:
restore data to the memory location in the availability bypass mode based on the previous data and the cryptographic message authentication code associated with the previous data.

25. The at least one computer readable storage medium of claim 20 , comprising a further set of instructions, which when executed by the computing device, cause the computing device to:
identify a request to change a key assignment if the indicator is set to indicate the integrity failure and a pre-determined value is stored along with the indicator; and
change the key assignment corresponding to the identified request.

Assignees

• Intel Corp

Inventors

• Durham David
• Chhabra Siddhartha
• Cong Kai
• Gabor Ron

Classifications

• G06F21/602 Primary

  Providing cryptographic facilities or services · CPC title

• G06F2221/2107

  File encryption · CPC title

• G06F21/64

  Protecting data integrity, e.g. using checksums, certificates or signatures · CPC title

• G06F2221/2113

  Multi-level security, e.g. mandatory access control · CPC title

• G06F11/073

  in a memory management context, e.g. virtual memory or cache management (memory management G06F12/00; testing of static memory units G11C29/00) · CPC title