Patent Description:
Existing security techniques force users to choose between security (e.g., memory integrity) on one hand and robustness features (e.g., error correction in platforms) on the other hand. For example, using all error correction code (ECC) memory for reliability, availability, and serviceability (RAS) to provide complete single device data correction (SDDC) capabilities or stealing some of the ECC bits to provide memory integrity against Row Hammer attacks with reduced reliability, availability, and serviceability, or instead using those bits for performance optimization features. Accordingly, techniques to implement security with limited memory resources may find utility. <CIT> discloses a memory subsystem which includes multiple memory resources connected in parallel, including a first memory resource and a second memory resource. The memory subsystem can split a portion of data into multiple sub-portions. Split into smaller portions, the system needs fewer ECC (error checking and correction) bits to provide the same level of ECC protection.

The invention provides an apparatus, a method, and a computer-readable medium as claimed hereinafter.

Described herein are exemplary systems and methods to implement algebraic and deterministic memory authentication and correction with coupled cacheline metadata. In the following description, numerous specific details are set forth to provide a thorough understanding of various examples. However, it will be understood by those skilled in the art that the various examples may be practiced without the specific details. In other instances, well-known methods, procedures, components, and circuits have not been illustrated or described in detail so as not to obscure the examples.

The disclosed embodiments may be implemented, in some cases, in hardware, firmware, software, or any combination thereof. The disclosed embodiments may also be implemented as instructions carried by or stored on a transitory or non-transitory machine-readable (e.g., computer-readable) storage medium, which may be read and executed by one or more processors. A machine-readable storage medium may be embodied as any storage device, mechanism, or other physical structure for storing or transmitting information in a form readable by a machine (e.g., a volatile or non-volatile memory, a media disc, or other media device).

As described briefly above, existing security techniques force users to choose between security (e.g., memory integrity) on one hand and robustness features (e.g. error correction in platforms) on the other hand. Additionally, other usages related to performance or features may require additional metadata. Single-device data correction (SDDC) is an important reliability, availability, and serviceability (RAS) feature in server products. However, single-device data correction (SDDC) solutions in 10x4 dynamic random access memory (DRAM) dual in-line memory modules (DIMMs) leave no free bits for encoding security and functional metadata, such as multi-key total memory encryption (MKTME) keys, trust domain (TD) bits, two-level memory (2LM) bits, poison, etc..

To address these and other issues, described herein are systems and methods to implement Message Authentication Galois Integrity and Correction (MAGIC) to support single-device data correction (SDDC) and implicit metadata storage, while still providing cryptographic integrity. Single-device data correction is a crucial reliability, availability, and serviceability (RAS) feature for server random access memory (RAM).

Existing implementations do not provide deterministic correction of a failed device if there was additional metadata (per cacheline) stored as part of ECC bits. Rather, error correction is probabilistic, i.e., for certain error bit patterns it is not possible to locate and correct a failed device. Existing implementations use conventional ECC and sequestered memory to store additional ECC bits for correcting data in case of a full-device failure. However, these solutions need to reserve memory for overflow ECC and have bandwidth overhead due to additional accesses to sequestered memory on every write.

In some examples described herein, a certain type of metadata may be embedded into memory authentication and correction single device data correction capability (e.g., using Reed-Solomon codes). The metadata may be shared between pairs of cachelines (e.g., per-page encryption key IDs, per-page trust domain (TD) bit, two-level memory (2LM) bits) and encoded into the error-correcting code for both cachelines. Error-free reads can recover the metadata. In a rare case of error, the metadata may be recovered from the coupled cachelines from a different dynamic random access memory (DRAM) rank (or a different DIMM) and then used to correct the error in the first cacheline. This enables single-device data correction (SDDC) and metadata storage, while still providing cryptographic integrity with no significant additional memory overhead nor performance impact. Further structural and methodological details are relating to implementing algebraic and deterministic memory authentication and correction with coupled cacheline metadata are described below with reference to <FIG>, below.

<FIG> is a schematic, block diagram illustration of components of apparatus to implement algebraic and deterministic memory authentication and correction with coupled cacheline metadata in accordance with some examples. Referring to <FIG>, in some examples a processor <NUM> may comprise one or more processors <NUM> coupled to a control unit <NUM> and a local memory <NUM>. Control unit <NUM> comprises a memory controller <NUM> and a memory interface <NUM>.

Memory interface <NUM> is coupled to one or more remote memory devices <NUM> by a communication bus <NUM>. Memory device <NUM> may comprise a controller <NUM> and one or more memory devices <NUM>. In various examples, at least some of the memory banks <NUM> may be implemented using nonvolatile memory, e.g., phase change memory, ferroelectric random-access memory (FeTRAM), nanowire-based non-volatile memory, memory that incorporates memristor technology, a static random access memory (SRAM), three dimensional (3D) cross point memory such as phase change memory (PCM), spin-transfer torque memory (STT-RAM) or NAND memory. In some examples the memory device(s) <NUM> may comprise one or more nonvolatile direct in-line memory modules (NVDIMMs) coupled to a memory channel <NUM> which provides a communication link to controller <NUM>. The specific configuration of the memory device(s) <NUM> in the memory device(s) <NUM> is not critical. In some examples the techniques relating to implementing algebraic and deterministic memory authentication and correction with coupled cacheline metadata may be implemented in the memory controller <NUM>, alone or in combination with the memory controller <NUM> an/or the processor(s) <NUM>.

<FIG> is a schematic illustration of a memory device <NUM> in an implementation of algebraic and deterministic memory authentication and correction with coupled cacheline metadata in accordance with some examples. Referring to <FIG>, it will be evident that all cachelines can be split into clusters of at least two cachelines such that every cacheline of the group has the same metadata. For instance, each pair of cachelines with address <NUM>*i and <NUM>*i+<NUM> share the same metadata. This condition is satisfied for any per-page metadata such as multi-key total memory encryption (MKTME) key IDs, TD bit. It is also satisfied for 2LM bits, as three-dimensional cross point (3DXP) memory stores data in blocks equal <NUM> cachelines.

There is at least one pair of cachelines within a cluster that are written into a different set of devices. From the example depicted in <FIG>, cachelines with address <NUM>*i are written to Rank <NUM> and cachelines with addresses <NUM> are written into Rank <NUM> of the DIMM. Alternatively, the cacheline pairs may be split across two DIMMs. Note that each cacheline is still fully contained within one Rank.

<FIG> is a flowchart illustrating operations in a method <NUM> to implement algebraic and deterministic memory authentication and correction with coupled cacheline metadata in accordance with some examples. Referring to <FIG>, at operation <NUM> a memory authentication and correction algorithm generates two tags for each cacheline using the cacheline data (e.g., <NUM> x 64b blocks) and metadata (e.g., <NUM> × 64b block). The metadata M is the same for both cachelines, whereas the data blocks C are independent. In some examples, the tags may be generated using multiplication and addition in GF(<NUM>^<NUM>). The addition in GF is equivalent to XOR. <MAT> <MAT> <MAT> <MAT>.

Where H is a multiplication parameter derived from a secret (i.e., cryptographic key, which is generated or programmed on the hardware. At operation <NUM> the data blocks C and the tags T are blinded via encryption and at operation <NUM> the resulting blocks are stored in memory, as illustrated in <FIG>. Cacheline L and cacheline R are stored in a different set of devices on the DIMM, e.g., in different ranks. With this split, a device failure will only affect one cacheline from the cacheline pair L+R.

The tags stored in cache may be used in subsequent error correction operations. <FIG> is a flowchart illustrating operations in a method to implement algebraic and deterministic memory authentication and correction with coupled cacheline metadata in accordance with some examples. Referring to <FIG>, at operation <NUM> a cacheline read is performed. On the cacheline read (L or R), the values received from the DRAM are decrypted at operation <NUM> to obtain blocks C<NUM>. Cn, and tags T<NUM> and T<NUM>. The following example shows data authentication and correction for cacheline L depicted in <FIG>. This process is identical for cacheline R (replace all indices with "R"). At operation <NUM> the metadata for cacheline L, is recovered and verified using the following equations derived from (<NUM>) and (<NUM>): <MAT> <MAT>.

At operation <NUM> it is determined whether there is an error in the recovered metadata. If there was no error, (i.e., M* and M** are equal to the original metadata M) then operation <NUM> is implemented and the cacheline data and the metadata can be returned to the entity that requested the cacheline data (e.g., a CPU or other host device). By contrast, if at operation <NUM> an error pattern occurred in one of the blocks (either Ci or T<NUM> or T<NUM>), then M* and M** will be different, indicating a read error in cacheline L. Assuming an error E in device i, error correction may be performed in multiple steps.

In a first step, at operation <NUM>, the correct value of M is obtained from the coupled cacheline. In some examples, this may be done by performing a normal read from the cacheline R and recovering M as described in Equations (<NUM>) and (<NUM>), above. It is assumed that the coupled cacheline R is error-free, since it resides in different DRAM devices (e.g., rank). In the event that the cacheline R is also corrupted, e.g., due to a multiple-device failure, a notification of detectable but uncorrectable error may be returned.

Using the recovered value of M, the failed device may be located and corrected. There will be three possible scenarios. In a first scenario, at operation <NUM>, it is determined whether the value of M is equal to M*. If, at operation <NUM>, the value of M is equal to M* then data blocks C<NUM>. Cn and tag T<NUM> are correct, and the error is in T<NUM>. Thus, at operation <NUM> the data is associated with data blocks C<NUM>. Cn is returned to the requestor without modifications and the tag T<NUM> is recalculated and updated in memory.

In a second scenario, at operation <NUM>, it is determined whether the value of M is equal to M**. If, at operation <NUM>, M is equal to M**, then data blocks C<NUM>. Cn, and tag T<NUM> are correct, and the error is in T<NUM>. Thus, at operation <NUM>, the data associated with data blocks C<NUM>. Cn is returned to the requestor without modifications and the tag T<NUM> is recalculated and updated in memory.

In a third scenario, M is equal to neither M* nor M**. In this scenario, the error is assumed to be in one of the data blocks C<NUM>. Suppose the error E occurred in device i. To determine i and E, a operation <NUM> syndromes S* and S** are generated by XORing M* with M and T<NUM>,L, as well as XORing M** with M and T<NUM>,L. This simplifies to: <MAT> <MAT>.

Note that syndromes S* and S** depend only on the error pattern and the error location. To determine the location, the products of S* with H-j, where j = <NUM>. n, as well as products of S** with H-2j are generated at operation <NUM>, as follows: <MAT> <MAT>.

Only for i=j these two values will be equal, and namely equal the error pattern. This provides the memory location of the error i and the error pattern E. At operation <NUM>, to correct the erroneous data block i, the value that was read from the memory is XORed with the error pattern E, which will undo the error.

Some DIMM configurations require metadata that is unique per cacheline. The technique described above can be applied to such configurations with minor adjustments. First, the metadata block is split to hold metadata from both cachelines, i.e., the metadata block is a concatenation of metadata bits of cacheline L and metadata bits of cacheline R: M={ML∥MR}. This is shown in <FIG>, which is a schematic illustration of a memory device <NUM> in an implementation of algebraic and deterministic memory authentication and correction with coupled cacheline metadata in accordance with some examples.

Writes to cacheline L require reading the coupled cacheline R, updating the tags T<NUM>,R, T<NUM>,R (since they depend on ML) and writing the updated cacheline R to memory. The authentication and the correction algorithms for this variation are the same as described above.

When used in conjunction with memory integrity, a tweakable block cipher may be used to encrypt Reed Solomon symbols and inputs to the error correction codes. The size of correction symbol is determined by the encryption block size. Encrypting the data inputs and symbols is an effective solution to row hammer style attacks on DRAM, while maintaining error correction capabilities. This is because the block cipher prevents an adversary from knowing the data inputs and symbols or error correction code/parity values. But since Reed Solomon and similar codes operate on a symbol granularity, with full correction of an integer number of symbols, encrypting a symbol with a block cipher equal to the symbol size maintains the error correction characteristics while also hiding the original symbol value from an adversary as decrypting the symbol cipher text using a secret key is required to determine the corresponding symbol used for error correction. Thus, an adversary, for example, by tampering with the physical memory, cannot deterministically set a symbol to cause undetected data corruption. Similarly, the tweakable block cipher may include additional information such as the symbol location and/or memory address to modify the resulting cipher text, and thus, making the symbols position dependent and preventing symbol relocation and translation (for example, using XEX-based tweaked-codebook mode with ciphertext stealing XTS mode). In this way, a variety of correction modes are possible with memory integrity.

<FIG> illustrates an embodiment of an exemplary computing architecture that may be suitable for implementing various embodiments as previously described. In various embodiments, the computing architecture <NUM> may comprise or be implemented as part of an electronic device. In some embodiments, the computing architecture <NUM> may be representative, for example of a computer system that implements one or more components of the operating environments described above. In some embodiments, computing architecture <NUM> may be representative of one or more portions or components of a digital signature signing system that implement one or more techniques described herein.

As used in this application, the terms "system" and "component" and "module" are intended to refer to a computer-related entity, either hardware, a combination of hardware and software, software, or software in execution, examples of which are provided by the exemplary computing architecture <NUM>. For example, a component can be, but is not limited to being, a process running on a processor, a processor, a hard disk drive, multiple storage drives (of optical and/or magnetic storage medium), an object, an executable, a thread of execution, a program, and/or a computer. By way of illustration, both an application running on a server and the server can be a component. One or more components can reside within a process and/or thread of execution, and a component can be localized on one computer and/or distributed between two or more computers. Further, components may be communicatively coupled to each other by various types of communications media to coordinate operations. The coordination may involve the uni-directional or bi-directional exchange of information. For instance, the components may communicate information in the form of signals communicated over the communications media. The information can be implemented as signals allocated to various signal lines. In such allocations, each message is a signal. Further embodiments, however, may alternatively employ data messages. Such data messages may be sent across various connections. Exemplary connections include parallel interfaces, serial interfaces, and bus interfaces.

As shown in <FIG>, the computing architecture <NUM> includes one or more processors <NUM> and one or more graphics processors <NUM>, and may be a single processor desktop system, a multiprocessor workstation system, or a server system having a large number of processors <NUM> or processor cores <NUM>. In on embodiment, the system <NUM> is a processing platform incorporated within a system-on-a-chip (SoC or SOC) integrated circuit for use in mobile, handheld, or embedded devices.

An embodiment of system <NUM> can include, or be incorporated within, a server-based gaming platform, a game console, including a game and media console, a mobile gaming console, a handheld game console, or an online game console. In some embodiments system <NUM> is a mobile phone, smart phone, tablet computing device or mobile Internet device. Data processing system <NUM> can also include, couple with, or be integrated within a wearable device, such as a smart watch wearable device, smart eyewear device, augmented reality device, or virtual reality device. In some embodiments, data processing system <NUM> is a television or set top box device having one or more processors <NUM> and a graphical interface generated by one or more graphics processors <NUM>.

In some embodiments, one or more processor(s) <NUM> are coupled with one or more interface bus(es) <NUM> to transmit communication signals such as address, data, or control signals between processor <NUM> and other components in the system. The interface bus <NUM>, in one embodiment, can be a processor bus, such as a version of the Direct Media Interface (DMI) bus. However, processor busses are not limited to the DMI bus, and may include one or more Peripheral Component Interconnect buses (e.g., PCI, PCI Express), memory busses, or other types of interface busses. In one embodiment the processor(s) <NUM> include an integrated memory controller <NUM> and a platform controller hub <NUM>. The memory controller <NUM> facilitates communication between a memory device and other components of the system <NUM>, while the platform controller hub (PCH) <NUM> provides connections to I/O devices via a local I/O bus.

Memory device <NUM> can be a dynamic random-access memory (DRAM) device, a static random-access memory (SRAM) device, flash memory device, phase-change memory device, or some other memory device having suitable performance to serve as process memory. In one embodiment the memory device <NUM> can operate as system memory for the system <NUM>, to store data <NUM> and instructions <NUM> for use when the one or more processors <NUM> executes an application or process. Memory controller hub <NUM> also couples with an optional external graphics processor <NUM>, which may communicate with the one or more graphics processors <NUM> in processors <NUM> to perform graphics and media operations. In some embodiments a display device <NUM> can connect to the processor(s) <NUM>. The display device <NUM> can be one or more of an internal display device, as in a mobile electronic device or a laptop device or an external display device attached via a display interface (e.g., DisplayPort, etc.). In one embodiment the display device <NUM> can be a head mounted display (HMD) such as a stereoscopic display device for use in virtual reality (VR) applications or augmented reality (AR) applications.

In some embodiments the platform controller hub <NUM> enables peripherals to connect to memory device <NUM> and processor <NUM> via a high-speed I/O bus. The I/O peripherals include, but are not limited to, an audio controller <NUM>, a network controller <NUM>, a firmware interface <NUM>, a wireless transceiver <NUM>, touch sensors <NUM>, a data storage device <NUM> (e.g., hard disk drive, flash memory, etc.). The data storage device <NUM> can connect via a storage interface (e.g., SATA) or via a peripheral bus, such as a Peripheral Component Interconnect bus (e.g., PCI, PCI Express). The touch sensors <NUM> can include touch screen sensors, pressure sensors, or fingerprint sensors. The wireless transceiver <NUM> can be a Wi-Fi transceiver, a Bluetooth transceiver, or a mobile network transceiver such as a <NUM>, <NUM>, or Long Term Evolution (LTE) transceiver. The firmware interface <NUM> enables communication with system firmware, and can be, for example, a unified extensible firmware interface (UEFI). The network controller <NUM> can enable a network connection to a wired network. In some embodiments, a high-performance network controller (not shown) couples with the interface bus <NUM>. The audio controller <NUM>, in one embodiment, is a multi-channel high definition audio controller. In one embodiment the system <NUM> includes an optional legacy I/O controller <NUM> for coupling legacy (e.g., Personal System <NUM> (PS/<NUM>)) devices to the system. The platform controller hub <NUM> can also connect to one or more Universal Serial Bus (USB) controllers <NUM> connect input devices, such as keyboard and mouse <NUM> combinations, a camera <NUM>, or other USB input devices.

The above Detailed Description includes references to the accompanying drawings, which form a part of the Detailed Description. The drawings show, by way of illustration, specific embodiments that may be practiced. " Such examples may include elements in addition to those shown or described. However, also contemplated are examples that include the elements shown or described. Moreover, also contemplated are examples using any combination or permutation of those elements shown or described (or one or more aspects thereof), either with respect to a particular example (or one or more aspects thereof), or with respect to other examples (or one or more aspects thereof) shown or described herein.

" In addition "a set of" includes one or more elements. In this document, the term "or" is used to refer to a nonexclusive or, such that "A or B" includes "A but not B," "B but not A," and "A and B," unless otherwise indicated. In the appended claims, the terms "including" and "in which" are used as the plain-English equivalents of the respective terms "comprising" and "wherein. " Also, in the following claims, the terms "including" and "comprising" are open-ended; that is, a system, device, article, or process that includes elements in addition to those listed after such a term in a claim are still deemed to fall within the scope of that claim. Moreover, in the following claims, the terms "first," "second," "third," etc. are used merely as labels, and are not intended to suggest a numerical order for their objects.

The terms "logic instructions" as referred to herein relates to expressions which may be understood by one or more machines for performing one or more logical operations. For example, logic instructions may comprise instructions which are interpretable by a processor compiler for executing one or more operations on one or more data objects. However, this is merely an example of machine-readable instructions and examples are not limited in this respect.

The terms "computer readable medium" as referred to herein relates to media capable of maintaining expressions which are perceivable by one or more machines. For example, a computer readable medium may comprise one or more storage devices for storing computer readable instructions or data. Such storage devices may comprise storage media such as, for example, optical, magnetic or semiconductor storage media. However, this is merely an example of a computer readable medium and examples are not limited in this respect.

The term "logic" as referred to herein relates to structure for performing one or more logical operations. For example, logic may comprise circuitry which provides one or more output signals based upon one or more input signals. Such circuitry may comprise a finite state machine which receives a digital input and provides a digital output, or circuitry which provides one or more analog output signals in response to one or more analog input signals. Such circuitry may be provided in an application specific integrated circuit (ASIC) or field programmable gate array (FPGA). Also, logic may comprise machine-readable instructions stored in a memory in combination with processing circuitry to execute such machine-readable instructions. However, these are merely examples of structures which may provide logic and examples are not limited in this respect.

Some of the methods described herein may be embodied as logic instructions on a computer-readable medium. When executed on a processor, the logic instructions cause a processor to be programmed as a special-purpose machine that implements the described methods. The processor, when configured by the logic instructions to execute the methods described herein, constitutes structure for performing the described methods. Alternatively, the methods described herein may be reduced to logic on, e.g., a field programmable gate array (FPGA), an application specific integrated circuit (ASIC) or the like.

In the description and claims, the terms coupled and connected, along with their derivatives, may be used. In particular examples, connected may be used to indicate that two or more elements are in direct physical or electrical contact with each other. Coupled may mean that two or more elements are in direct physical or electrical contact. However, coupled may also mean that two or more elements may not be in direct contact with each other, but yet may still cooperate or interact with each other.

Reference in the specification to "one example" or "some examples" means that a particular feature, structure, or characteristic described in connection with the example is included in at least an implementation. The appearances of the phrase "in one example" in various places in the specification may or may not be all referring to the same example.

The above description is intended to be illustrative, and not restrictive. For example, the above-described examples (or one or more aspects thereof) may be used in combination with others. Other embodiments may be used, such as by one of ordinary skill in the art upon reviewing the above description. The Abstract is to allow the reader to quickly ascertain the nature of the technical disclosure. It is submitted with the understanding that it will not be used to interpret or limit the scope or meaning of the claims. Also, in the above Detailed Description, various features may be grouped together to streamline the disclosure. However, the claims may not set forth every feature disclosed herein as embodiments may feature a subset of said features. Further, embodiments may include fewer features than those disclosed in a particular example. Thus, the following claims are hereby incorporated into the Detailed Description, with each claim standing on its own as a separate embodiment. The scope of the embodiments disclosed herein is to be determined with reference to the appended claims, along with the full scope of equivalents to which such claims are entitled.

Claim 1:
An apparatus, comprising processing circuitry to:
generate (<NUM>), for a cacheline, a first tag and a second tag, the first tag and the second tag generated as a function of user data stored and metadata in the cacheline stored in a first memory device, and a multiplication parameter derived from a secret key;
store (<NUM>) the user data, the metadata, the first tag and the second tag in the first cacheline of the first memory device;
generate (<NUM>), for the cacheline, a third tag and a fourth tag, the third tag and the fourth tag generated as a function of the user data stored and metadata in the cacheline stored in a second memory device, and the multiplication parameter;
store (<NUM>) the user data, the metadata, the third tag and the fourth tag in the corresponding cacheline of the second memory device;
receive, from a requesting device, a read operation directed to the cacheline;
use the first tag, the second tag, the third tag, and the fourth tag to determine (<NUM>) whether a read error occurred during the read operation, wherein determining whether a read error occurred comprises determining that a read error did occur (<NUM> - YES) if the metadata retrieved from the cacheline in the first memory device does not match the metadata retrieved from the corresponding cacheline in the second memory device, or determining that a read error did not occur (<NUM> - NO) if the metadata retrieved from the cacheline in the first memory device matches the metadata retrieved from the corresponding cacheline in the second memory device;
in response to the read request:
return (<NUM>) the user data to the requesting device in response to a determination that a read error did not occur (<NUM> - NO); or
obtain (<NUM>) a correct value of the metadata in response to a determination that a read error did occur (<NUM> - YES), wherein the correct value of the metadata is obtained from the coupled cacheline; and
return (<NUM>), to the requesting device, the user data stored in the first memory device in response to a determination (<NUM> - YES) that the metadata retrieved from the cacheline in the first memory device matches a correct value of the metadata; or
return (<NUM>), to the requesting device, the user data stored in the second memory device in response to a determination (<NUM> - YES) that the metadata retrieved from the corresponding cacheline in the second memory device matches a correct value of the metadata.