Patent application EP20164111A (EP), filed 2020-03-19
Publication number: EP3757847A1
Title: PREVENTION OF TRUST DOMAIN ACCESS USING MEMORY OWNERSHIP BITS IN RELATION TO CACHE LINES
Abstract: A processor includes a processor core and a memory controller coupled to the processor core. The memory controller comprising a cryptographic engine to: detect, in a write request for a cache line, a key identifier (ID) within a physical address of a location in memory; determine that the key ID is a trust domain key ID of a plurality of key IDs; responsive to a determination that the key ID is the trust domain key ID, set an ownership bit of the cache line to indicate the cache line belongs to a trust domain; encrypt the cache line to generate encrypted data; determine a message authentication code (MAC) associated with the cache line; and write the encrypted data, the ownership bit, and the MAC of the cache line to the memory.
IPC codes: G06F  12/    14            A I
G06F  21/    64            A I
G06F  21/    72            A I
G06F  12/  0811            A I
G06F  12/  0817            A I
G06F  12/  1009            A I
Claims: number: 1
text: A processor comprising:
number: 2
text: The processor of claim 1, wherein the memory comprises a sequestered range to which is written the ownership bit in association with the cache line stored in the memory, the processor further comprising an on-die cache to cache the ownership bit for the processor core, and wherein, to determine the MAC, the cryptographic engine is further to apply a keyed hash algorithm over a combination of at least the encrypted data, an encrypted physical address, and the ownership bit.
number: 3
text: The processor of any of claims 1-2, wherein the ownership bit is encoded with error correction code (ECC) bits of the cache line, wherein the cryptographic engine is further to generate an ECC calculation in conjunction with the write of the cache line to the memory, and wherein the ownership bit is included within the ECC calculation.
number: 4
text: The processor of any of claims 1-3, wherein, in response to a read request for the cache line, the cryptographic engine is further to:
number: 5
text: The processor of claim 4, wherein the cryptographic engine is further to:
number: 6
text: The processor of claim 5, where the cryptographic engine is further to set a poison status bit in a key data structure of the cryptographic engine, the poison status bit being associated with the key ID, wherein the cryptographic engine is further to:
number: 7
text: A method comprising:
number: 8
text: The method of claim 7, wherein the memory comprises a sequestered range to which is written the ownership bit in association with the cache line stored in the memory, the method further comprising caching the ownership bit in on-die cache of the processor.
number: 9
text: The method of any of claims 7-8, wherein determining the MAC comprises applying a keyed hash algorithm over a combination of at least the encrypted data, an encrypted physical address, and the ownership bit.
number: 10
text: The method of any of claims 7-9, further comprising:
number: 11
text: The method of claim 10, further comprising:
number: 12
text: The method of any of claims 10-11, further comprising:
number: 13
text: A system comprising:
number: 14
text: The system of claim 13, wherein the cryptographic engine is further to:
number: 15
text: The system of claim 14, wherein, in response to a determination that the value of the access type bit matches that of the ownership bit, the cryptographic engine is further to:
Office action: search_report, dated 2020-12-30
Prior art cited: ref_id: US2019042402A1
ref_type: patent
severity: background
ref_id: US2018048470A1
ref_type: patent
severity: background
ref_id: US2019050283A1
ref_type: patent
severity: background
ref_id: US2018048470
ref_type: patent
severity: background
ref_id: US2019042402
ref_type: patent
severity: background
ref_id: US2019050283
ref_type: patent
severity: background
Final disposition: pending (2020-12-30)