Patent ID: 7657756

Claim:
A method of handling secure data in a secure system, wherein the secure data is passed between a processor and memory external to the processor, comprising: maintaining, in an encrypted form in the external memory, a set of metadata used to encrypt and decrypt the secure data; maintaining, in a decrypted form in a cache internal to the processor, a limited subset of the metadata; receiving a request to access a block of the secure data; retrieving the block of secure data from the external memory in encrypted form; determining whether a first portion of metadata needed to decrypt the block of secure data is in the cache; when the first portion of metadata is not in the cache: retrieving the first portion of metadata from the external memory; determining whether a second portion of metadata is in the cache; and when the second portion is not in the cache, retrieving the second portion of metadata from the external memory and decrypting the second portion of metadata using a third portion of metadata maintained in the cache; decrypting the first portion of metadata using the second portion of metadata in the cache; and decrypting the block of secure data using the first portion of metadata.