Improving Cost, Performance, and Security of Memory Encryption and Authentication

Abstract

Protection from hardware attacks such as snoopers and mod chips has been receiving increasing attention in computer architecture. This paper presents a new combined memory encryption/authentication scheme. Our new split counters for counter-mode encryption simultaneously eliminate counter overflow problems and reduce per-block counter size, and we also dramatically improve authentication performance and security by using the Galois/Counter Mode of operation (GCM), which leverages counter-mode encryption to reduce authentication latency and overlap it with memory accesses.Our results indicate that the split-counter scheme has a negligible overhead even with a small (32KB) counter cache and using only eight counter bits per data block. The combined encryption/authentication scheme has an IPC overhead of 5% on average across SPEC CPU 2000 benchmarks, which is a significant improvement over the 20% overhead of existing encryption/authentication schemes.

Dynamic Encryption Key Design and Its Security Evaluation for Memory Data Protection in Embedded Systems

“…Through the experiment, we conclude that the block cipher does generate unique keys for different inputs and the key values generated are random. With the given security evaluation Formulas (1) and (5), we evaluated the security of designs proposed in [3] (a COB design) and [6] (a RNCB design), based on the block cipher AES and 128-bit block size. Attack success probabilities of the two designs against the random and used-key attacks are summarized in Table 1.…”

“…Given such a design, for each k-bit key, m-bit memory address, only k − m-bit counter value needs to be saved. To further reduce the storage memory consumption, a design with two-level counters was proposed [3] (Figure 2(b)); it consumes less on-chip memory than the one-level counter design, but may incurs re-encryption when the second level counter is overflowed. An alternative solution for reducing the memory consumption is the design proposed in [6] (as shown in Figure 2(c)).…”

“…• a thorough investigation on how dynamic key should be structured for low on-chip memory cost and high security, • a novel quantitative security evaluation approach that is based on both the randomness and the uniqueness of key values, and • we compared two typical designs [3] and [6] and found that the design by [3] is more secure than that by [6] for a limit number of keys to be used; but when the number of keys used exceeds this limit, the design of [6] becomes better. The rest of the paper is arranged as follows.…”

Hardware-Enhanced Protection for the Runtime Data Security in Embedded Systems

“…However, their architecture assumes extensive operating system and compiler support. Yan [18] describes a sign-and-verify architecture using Galois/Counter Mode cryptography. They protect dynamic data using split sequence numbers to reduce memory overhead and reduce the probability of a sequence number rollover.…”

Protecting Sensitive Information in the Volatile Memory from Disclosure Attacks

“…The second category of the proposed solutions for memory encryption is based on hardware modifications. In particular, several publications [18][19][20][21][22][23] [40] for single processor systems propose the addition of an encryption unit to cipher and decipher data from and to the volatile memory. Moreover, for multiprocessor systems, [24] proposes a shared bus, containing a crypto engine, to coordinate and secure traffic between processors, while [25] [26] proposed the use of sequence numbers for the coordination between different processors.…”