Aggregate GHASH-based message authentication code (MAC) over multiple cachelines with incremental updates

Patent metadata

Field	Value
Publication number	US-11301344-B2
Application number	US-202016902755-A
Country	US
Kind code	B2
Filing date	Jun 16, 2020
Priority date	Jun 16, 2020
Publication date	Apr 12, 2022
Grant date	Apr 12, 2022

Abstract

Embodiments are directed to aggregate GHASH-based message authentication code (MAC) over multiple cachelines with incremental updates. An embodiment of a system includes a controller comprising circuitry, the controller to generate an error correction code for a memory line, the memory line comprising a plurality of first data blocks, generate a metadata block corresponding to the memory line, the metadata block comprising the error correction code for the memory line and at least one metadata bit, generate an aggregate GHASH corresponding to a region of memory comprising a cacheline set comprising at least the memory line, encode the first data blocks and the metadata block, encrypt the aggregate GHASH as an aggregate message authentication code (AMAC), provide the encoded first data blocks and the encoded metadata block for storage on a memory module comprising the memory line, and provide the AMAC for storage on a device separate from the memory module.

First claim

What is claimed is:

1. A system comprising:
a controller comprising circuitry, the controller to:
generate an error correction code for a memory line, the memory line comprising a plurality of first data blocks;
generate a metadata block corresponding to the memory line, the metadata block comprising the error correction code for the memory line and at least one metadata bit;
generate an aggregate GHASH corresponding to a region of memory comprising a cacheline set comprising at least the memory line;
encode the plurality of first data blocks as encoded first data blocks and encode the metadata block as an encoded metadata block;
encrypt the aggregate GHASH as an aggregate message authentication code (AMAC);
provide the encoded first data blocks and the encoded metadata block for storage on a memory module comprising the memory line; and
provide the AMAC for storage on the memory module or on a device separate from the memory module.

2. The system of claim 1 , wherein generating the aggregate GHASH comprises multiplication of the plurality of first data blocks in a Galois Field with secret constant factors specific to each of the plurality of first data blocks, and wherein the secret constant factors are generated from a random seed raised to a power based on positions of the plurality of first data blocks in the cacheline set.

3. The system of claim 1 , wherein the region of memory corresponds to an entire set of memory devices in the memory module.

4. The system of claim 1 , wherein the region of memory corresponds to an individual memory device in the memory module.

5. The system of claim 1 , wherein the cacheline set comprises a plurality of cachelines divided into a plurality of data blocks comprising at least the plurality of first data blocks.

6. The system of claim 1 , wherein the AMAC is used for integrity verification purposes in response to a full device failure of a memory device in the memory module, wherein the AMAC represents a total integrity of a number of memory lines and is used to re-total an associated set of memory lines of the memory module and to verify lost device data was correctly recovered.

7. The system of claim 1 , wherein the AMAC is used to support secure initialization vectors (IVs).

8. The system of claim 1 , wherein generating the aggregate GHASH further comprises:
recovering a previous aggregate GHASH from a previous AMAC;
retrieving previous data for the memory line;
multiplying previous data blocks corresponding to the previous data in a Galois Field with secret constant factors corresponding to the previous data blocks;
performing an exclusive-or of first resulting products of the multiplying the previous data blocks with the previous aggregate GHASH to generate an incremental GHASH;
multiplying the plurality of first data blocks in the Galois Field with the secret constant factors specific to each of the plurality of first data blocks; and
performing an exclusive-or of second resulting products of the multiplying the plurality of first data blocks with the incremental GHASH to generate the aggregate GHASH.

9. The system of claim 1 , wherein encrypting the aggregate GHASH comprising applying a block cipher and a secret blinding key.

10. The system of claim 1 , wherein the controller is further to:
identify a first plurality of AMAC values comprising at least the AMAC, wherein the first plurality of AMAC values computed on data blocks of a second plurality of memory regions;
determine that there is one failing integrity test in response to verifying an integrity of each of the second plurality of memory regions using the first plurality of AMAC values;
identify a target AMAC value of the first plurality of AMAC values and a memory region corresponding to the failing integrity test;
compute, for a third plurality of memory cache lines, a fourth plurality of encoded data blocks correction values;
perform an integrity test for each of the memory cache lines of the third plurality of memory cache lines using a corresponding encoded data block correction value from the fourth plurality of encoded data block correction values; and
determine whether there is a full device failure based on results of each of the integrity tests.

11. The system of claim 1 , wherein the controller is further to:
compute, for a first plurality of memory cache lines, a second plurality of encoded data block correction values;
perform a built-in self test (BIST) on devices of the memory module to check for device failures;
in response to the BIST determining that a failed device of the devices has failed, identify a target AMAC value and a memory region corresponding to the failed device;
perform full device recovery of the failed device using at least one encoded data block correction value from the second plurality of encoded data block correction values; and
verify integrity of corrected bit errors using the identified target AMAC value.

12. The system of claim 1 , wherein the controller is further to:
compute, for a first plurality of data bytes stored in the memory module, a second plurality of AMAC values comprising at least the AMAC, wherein each of the second plurality of AMAC values is computed on the first plurality of data bytes and is computed on a different set of secret parameters;
generate a hypothesis about the presence of bit errors in locations of encoded data blocks comprising the first plurality of data bytes;
generate bit-linear equations based on the generated hypothesis, wherein a number of unknowns in the bit-linear equations is equal to a number of the bit-linear equations;
solve the bit-linear equations to determine values of the unknowns;
perform an entropy test on the determined values of the unknowns; and
in response to determining that the values of the unknowns satisfies the entropy test, correct the bit errors and verify integrity of the corrected bit errors using the second plurality of AMAC values.

13. A non-transitory computer-readable storage medium having stored thereon executable computer program instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:
generating an error correction code for a memory line, the memory line comprising a plurality of first data blocks;
generating a metadata block corresponding to the memory line, the metadata block comprising the error correction code for the memory line and at least one metadata bit;
generating an aggregate GHASH corresponding to a region of memory comprising a cacheline set comprising at least the memory line;
encoding the plurality of first data blocks as encoded first data blocks and encoding the metadata block as an encoded metadata block;
encrypting the aggregate GHASH as an aggregate message authentication code (AMAC);
providing the encoded first data blocks and the encoded metadata block for storage on a memory module comprising the memory line; and
providing the AMAC for storage on a device separate from the memory module.

14. The non-transitory computer-readable storage medium of claim 13 , wherein generating the aggregate GHASH comprises multiplication of the plurality of first data blocks in a Galois Field with secret constant factors specific to each of the plurality of first data blocks.

15. The non-transitory computer-readable storage medium of claim 14 , wherein the secret constant factors are generated from a random seed raised to a power based on positions of the plurality of first data blocks in the cacheline set.

16. The non-transitory computer-readable storage medi

Assignees

• Intel Corp

Inventors

• Durham David M
• Grewal Karanvir S
• Deutsch Sergej
• Kounavis Michael E

Classifications

• H04L9/3242

  involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC · CPC title

• G06F11/3037

  where the computing system component is a memory, e.g. virtual memory, cache (accessing, addressing or allocating within memory systems or architectures G06F12/00; checking stores for correct operation G11C29/00) · CPC title

• H04L9/0643

  Hash functions, e.g. MD5, SHA, HMAC or f9 MAC · CPC title

• H04L9/085

  Secret sharing or secret splitting, e.g. threshold schemes · CPC title

• G06F11/1064

  in cache or content addressable memories · CPC title