System and method for secure loading data in a cache memory

Patent metadata

Field	Value
Publication number	US-9563769-B2
Application number	US-201514735825-A
Country	US
Kind code	B2
Filing date	Jun 10, 2015
Priority date	Jun 12, 2014
Publication date	Feb 7, 2017
Grant date	Feb 7, 2017

Abstract

A system and method for securely loading data in a cache memory associated with at least one secure processor that performs data processing by using at least one untrusted external memory storing data to be processed, at least one secure internal cache memory to load or store data, and at least one secure cache translator operating as a memory management unit. The secure cache translator stores, into a secure cache digest table, parameters arranged on persistent and variable data pages. The parameters comprise at least a root digest based on node digests calculated on at least one persistent data page according to a Merkle tree structure. The integrity of the data pages is verified during transfers between the secure internal cache memory and the external memory by comparing a calculated root digest with the root digest stored in the secure cache digest table.

First claim

The invention claimed is:

1. A system for processing digital data comprising:
at least one untrusted external memory for storing data to be processed;
a one time programmable memory;
at least one secure processor connected to the one time programmable memory and the at least one external memory and configured to perform data processing by using the at least one untrusted external memory;
at least one secure internal cache memory connected to the at least one secure processor to load or store data; and
at least one secure cache translator connected to the at least one secure internal cache memory and the at least one untrusted external memory operating as a memory management unit configured by a secure cache digest table stored in the secure internal cache memory:
wherein the secure cache translator is configured to:
a) store into the secure cache digest table, during an initialization phase, parameters related to current processes, the parameters, being arranged on persistent and variable data pages, comprise at least a process identifier and a root digest based on node digests calculated on at least one persistent data page according to a Merkle tree structure;
b) verify integrity of data pages during transfer of data pages from the secure internal cache memory to the external memory, the verification being performed by comparing a calculated root digest of persistent pages stored in the external memory with a corresponding root digest stored in the secure cache digest table and in response to a successful comparison to calculate a new root digest with node digests of variable pages combined with node digests of persistent pages and to store the obtained new root digest in the secure cache digest table and into the external memory; and
c) verify integrity of data pages during transfer of data pages from the external memory to the secure internal cache memory, the verification being performed by comparison of a calculated root digest of at least one page to transfer with a corresponding digest stored in the secure cache digest table and in response to the comparison being successful, allowing the page to be used by the secure processor;

wherein a versioning mechanism is used during root digest calculating, the secure processor being configured to access in a read/write mode a monotonic counter generating a version reference value in the one time programmable memory, and to load a persistent data page by verifying, in addition to the root digest, that the version reference value stored in the secure cache digest table is equal or higher than a corresponding value stored in the one time programmable memory.

2. The system according to claim 1 wherein the root digest is obtained by applying a one-way, collision free cryptographically strong hash function on each data pages forming node hashes according to the Merkle tree structure, the hash function being of type SHA-2, SHA-3, BLAKE or of a any other proprietary type.

3. The system according to claim 1 wherein the secure cache digest table contains, in addition to the process identifier and the root digest, at least a total number of data pages used in the process, a number of persistent data pages, an offset of the first page used to determine the address of the first page in the external memory and a flag indicating an access condition defining a mode according which the processor respectively the secure cache translator accesses to the data pages.

4. The system according to claim 1 wherein the secure cache translator or the secure processor is further configured to transfer, during the initialization phase, the secure cache digest table from the external memory to the internal cache memory by carrying out a strong authentication based on a cryptographic algorithm using asymmetric cryptography.

5. The system according to claim 1 wherein the secure cache translator is further configured to perform repeated calculations in case of an unsuccessful comparison between a calculated root digest and the root digest stored in the secure cache digest table, the secure processor being configured to block loading the data pages into the secure cache memory if errors still remain.

6. The system according to claim 1 wherein the secure cache translator is configured to re-compute a new root digest by calculating node digests of modified data pages and to use previously calculated digests of persistent data pages previously stored in the external memory.

7. The system according to claim 1 wherein the untrusted external memory comprises either, a local memory, or a remote memory in form of a cloud data store.

8. A method for processing digital data by at least one secure processor configured to perform data processing by using at least one untrusted external memory storing data to be processed, at least one secure internal cache memory to load or store data, and at least one secure cache translator operating as a memory management unit configured by a secure cache digest table stored in the secure internal cache memory, the method comprising:
a) during an initialization phase on request of the secure processor, storing, by the secure cache translator, into the secure cache digest table, parameters related to current processes, the parameters, being arranged on persistent and variable data pages, and comprising at least a process identifier and a root digest based on node digests calculated on at least one persistent data page according to a Merkle tree structure;
b) during transfer of data pages from the secure internal cache memory to the external memory, verifying, by the secure cache translator, integrity of data pages by comparing a calculated root digest of persistent pages stored in the external memory with a corresponding root digest stored in the secure cache digest table and in response to a successful comparison, calculating a new root digest with node digests of variable pages combined with node digests of persistent pages and to store the obtained new root digest into the secure cache digest table and into the external memory; and
c) during transfer of data pages from the external memory to the secure internal cache memory, verifying integrity of the data pages by performing a comparison of a calculated root digest of at least one page to be transferred with a corresponding digest stored in the secure cache digest table and in response to the comparison being successful, allowing use of the page by the secure processor;

wherein during root digest calculating, a versioning mechanism is used comprising accessing, by the secure processor, in a read/write mode, a monotonic counter generating a version reference value in a one time programmable memory, and loading a persistent data page by verifying, in addition to the root digest, that the version reference value stored in the secure cache digest table is equal or higher than a corresponding value stored in the one time programmable memory.

9. The method according to claim 8 wherein the root digest is obtained by applying a one-way, collision free cryptographically strong hash function on each data pages forming node hashes according to the Merkle tree structure, the hash function being of type SHA-2, SHA-3, BLAKE or of a any other proprietary type.

10. The method according to claim 8 wherein the secure cache digest table contains, in addition to the process identifier and the root digest, at least a total number of data pages used in the process, a number of persistent data pages, an offset of the first page used to determine the address of the first page in the external memory and a flag indicating an access condition defining a mode according which the processor respectively the secure cache translator access

Assignees

• Nagravision Sa
• Nagravision Sa

Inventors

• Hunacek Didier
• Macchetti Marco
• Servet Patrick

Classifications

• H04L9/32

  including means for verifying the identity or authority of a user of the system {or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials} · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G06F21/64

  Protecting data integrity, e.g. using checksums, certificates or signatures · CPC title

• H04L9/0643

  Hash functions, e.g. MD5, SHA, HMAC or f9 MAC · CPC title

• G06F21/51 Primary

  at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability · CPC title