Protected data streaming between memories

Patent metadata

Field	Value
Publication number	US-11630723-B2
Application number	US-202117147110-A
Country	US
Kind code	B2
Filing date	Jan 12, 2021
Priority date	Jan 12, 2021
Publication date	Apr 18, 2023
Grant date	Apr 18, 2023

Abstract

Transferring data between memories may include reading data associated with a memory transfer transaction from a first memory, determining whether a bypass indication associated with the memory transfer transaction is asserted, and transferring the data from the first memory to a second memory. The transferring may include bypassing the first-processing if the bypass indication is asserted. The transferring may further include bypassing second-processing the data if the bypass indication is asserted. Following bypassing the second-processing, the data may be stored in the second memory.

First claim

What is claimed is:

1. A method for transferring data between memories, comprising:
generating a handle to a root key and key derivation information with a root of trust module;
sending the handle with the root of trust module to a processor;
the processor providing the handle to a first accelerator of a first memory and to a second accelerator of a second memory, the first memory comprising dynamic random access memory, the second memory comprising non-volatile random access memory;
sending the root key and key derivation information with the root of trust module to the first accelerator and the second accelerator;
the first and second accelerators deriving private keys based on the handle and root key for encrypting data in the first and second memories;
the processor reading data associated with a memory transfer transaction from the first memory;
the processor producing a bypass indication based on attribute information of a page table from the read data associated with the memory transaction from the first memory;
determining whether the bypass indication associated with the memory transfer transaction is asserted;
transferring the data from the first memory to a second memory, the transferring including bypassing first-processing the data if the bypass indication is asserted, the transferring further including bypassing second-processing the data if the bypass indication is asserted, both the bypassing first-processing the data and the bypassing second-processing the data avoid use of the private keys by the first and second accelerators; and
storing the data in the second memory.

2. The method of claim 1 , wherein transferring the data from the first memory to the second memory further comprises first-processing data read from the first memory if the bypass indication is not asserted and second-processing data resulting from the first-processing if the bypass indication is not asserted.

3. The method of claim 2 , wherein the second-processing comprises an inverse operation of the first-processing.

4. The method of claim 3 , wherein:
first-processing comprises at least one of decrypting, parity checking, and decompressing; and
second-processing comprises at least one of encrypting, generating parity, and compressing.

5. The method of claim 3 , wherein:
reading the data comprises reading the data from a first memory region;
first-processing the data read from the first memory comprises decrypting data read from the first memory region using one of the private keys;
second-processing comprises re-encrypting data resulting from the decrypting using one of the private keys;
storing the data comprises storing the data resulting from the decrypting in a second memory region; and
the bypass indication indicates at least one private key is common to the first memory region and the second memory region.

6. The method of claim 5 , wherein the bypass indication is associated with the first memory region.

7. The method of claim 1 , wherein the first memory stores encrypted kernel context data.

8. The method of claim 1 , further comprising: the processor determining to transition from an active mode to a hibernation mode.

9. A system for transferring data between memories, comprising:
a root of trust module generating a handle to a root key and key derivation information and sending the handle with the root of trust module to a processor;
the processor providing the handle to a first accelerator of a first memory and to a second accelerator of a second memory, the first memory comprising dynamic random access memory, the second memory comprising non-volatile random access memory;
the root of trust module sending the root key and key derivation information to the first accelerator and the second accelerator;
the first and second accelerators deriving private keys based on the handle and root key for encrypting data in the first and second memories; and
memory transfer control logic including first processing logic and second processing logic and the processor, the memory transfer control logic configured to:
have the processor read data associated with a memory transfer transaction from the first memory, the processor producing a bypass indication based on attribute information of a page table from the read data associated with the memory transaction from the first memory;
determine whether the bypass indication associated with the memory transfer transaction is asserted;
bypass applying the first processing logic to the data if the bypass indication is asserted;
bypass applying the second processing logic to an output of the first processing logic if the bypass indication is asserted, both the bypassing applying the first processing logic and bypassing applying the second processing logic avoid use of the private keys by the first and second accelerators; and
store the data in the second memory.

10. The system of claim 9 , wherein the memory transfer control logic is further configured to:
apply the first processing logic to the data read from the first memory if the bypass indication is not asserted; and
apply the second processing logic to an output of the first processing logic if the bypass indication is not asserted.

11. The system of claim 10 , wherein the first processing logic and the second processing logic are configured to perform inverse operations.

12. The system of claim 11 , wherein:
the first processing logic is configured to perform at least one of decrypting, parity checking, and decompressing; and
the second processing logic is configured to perform at least one of encrypting, generating parity, and compressing.

13. The system of claim 11 , wherein:
the first processing logic is configured to read the data from a first memory region and decrypt the data using one of the private keys;
the second processing logic is configured to re-encrypt data decrypted by the first processing logic using one of the private keys and store data re-encrypted by the second processing logic in a second memory region; and
the bypass indication indicates at least one private key is common to the first memory region and the second memory region.

14. The system of claim 13 , wherein the bypass indication is associated with the first memory region.

15. The system of claim 9 , wherein
the first memory stores encrypted kernel context data.

16. The system of claim 9 , wherein the processor determines whether to transition from an active mode to a hibernation mode.

17. The system of claim 9 , wherein:
the first processing logic comprises the first memory accelerator; and
the second processing logic comprises the second memory accelerator.

18. A system for transferring data between memories, comprising:
a root of trust module generating a handle to a root key and key derivation information and sending the handle with the root of trust module to a processor;
the processor providing the handle to a first accelerator of a first memory and to a second accelerator of a second memory, the first memory comprising dynamic random access memory, the second memory comprising non-volatile random access memory;
the root of trust module sending the root key and key derivation information to the first accelerator and the second accelerator;
the first and second accelerators deriving private keys based on the handle and root key for encrypting data in the first and second memories;
means for reading data associated with a memory transfer transaction from a first memory;
a processor for producing a bypass indication based on a pa

Assignees

• Qualcomm Inc

Inventors

• Li Yanru
• Chun Dexter Tamio

Classifications

• H04L9/0877

  using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM] · CPC title

• G06F13/1694 Primary

  Configuration of memory controller to different memory types · CPC title

• G06F11/1096

  Parity calculation or recalculation after configuration or reconfiguration of the system · CPC title

• G06F11/1044 Primary

  with specific ECC/EDC distribution · CPC title

• G06F16/907

  Retrieval characterised by using metadata, e.g. metadata not derived from the content or metadata generated manually · CPC title