Using ownership identifiers in metadata in a memory for protecting encrypted data stored in the memory
An electronic device includes a memory and controller circuitry. The controller circuitry, responsive to a read request to read encrypted data stored in the memory, acquires, from metadata stored with the encrypted data in the memory, an ownership identifier identifying a type of writing entity that stored the encrypted data in the memory. The controller circuitry uses the ownership identifier to control whether, when responding to the read request, data decrypted from the encrypted data is returned or substitute data is returned instead of data decrypted from the encrypted data.
1 . An electronic device, comprising:
a memory; and
controller circuitry, the controller circuitry being configured to:
acquire, from metadata stored with encrypted data in the memory, an ownership identifier;
return data decrypted from the encrypted data, responsive to a first read request for the encrypted data, based on the ownership identifier; and
return substitute data instead of the encrypted data, responsive to a second read request for the encrypted data, based on the ownership identifier, the substitute data including a specified pattern of bit values.
2 . The electronic device of claim 1 , wherein the controller circuitry is configured to return the substitute data when:
the ownership identifier indicates that a writing entity that stored the encrypted data in the memory is a supporting virtual machine; and
a reading entity identifier associated with the second read request indicates that a reading entity is not a supporting virtual machine.
3 . The electronic device of claim 2 , wherein:
the ownership identifier and the reading entity identifier are, or are generated from, key identifiers (IDs) from among a set of key IDs; and
the set of key IDs includes one or more key IDs allocated to a hypervisor, a first subset of key IDs to be allocated to supporting virtual machines, and a second subset of key IDs to be allocated to legacy virtual machines, the first subset being separate from the second subset.
4 . The electronic device of claim 1 , wherein the ownership identifier indicates that a writing entity that stored the encrypted data and a reading entity associated with the first read request are each one of:
a legacy virtual machine that does not support the controller circuitry returning the substitute data;
a supporting virtual machine that supports the controller circuitry returning the substitute data; or
a hypervisor.
5 . The electronic device of claim 1 , further comprising encryption circuitry configured to, when data decrypted from the encrypted data is returned responsive to the first read request:
acquire, based on the first read request, a decryption key associated with a reading entity; and
perform a decryption operation to decrypt the encrypted data using the decryption key, wherein the decryption operation:
results in properly decrypted data when the reading entity is an entity that stored the encrypted data in the memory or is permitted to access the encrypted data; and
results in improperly decrypted data when an entity other than the reading entity stored the encrypted data in the memory or is not permitted to access the encrypted data.
6 . The electronic device of claim 1 , further comprising encryption circuitry, wherein:
the encryption circuitry is configured to encrypt data using an encryption key associated with a writing entity, the encryption key being acquired based on a write request to store the data in the memory;
the controller circuitry is configured to generate, based on a writing entity identifier from the write request, the ownership identifier to identify a type of the writing entity; and
the controller circuitry is configured to store the encrypted data in the memory and the ownership identifier in the metadata stored with the encrypted data in the memory.
7 . The electronic device of claim 1 , wherein the ownership identifier identifies a type of a writing entity that stored the encrypted data in the memory, the type of the writing entity being one of a hypervisor, a legacy virtual machine, and a supporting guest virtual machine.
8 . The electronic device of claim 1 , wherein the metadata includes a plurality of error correction code (ECC) bits and at least some of the plurality of ECC bits are repurposed for storing the ownership identifier.
9 . A method for handling data in an electronic device, the method comprising:
acquiring, from metadata stored with encrypted data in a memory, an ownership identifier;
returning data decrypted from the encrypted data, responsive to a first read request for the encrypted data, based on the ownership identifier; and
returning substitute data instead of the encrypted data, responsive to a second read request for the encrypted data, based on the ownership identifier, the substitute data including a specified pattern of bit values.
10 . The method of claim 9 , wherein the ownership identifier indicates that a writing entity that stored the encrypted data in the memory is a supporting virtual machine and a reading entity identifier associated with the second read request indicates that a reading entity is not a supporting virtual machine.
11 . The method of claim 10 , wherein:
the ownership identifier and the reading entity identifier are, or are generated from, key identifiers (IDs) from among a set of key IDs; and
the set of key IDs includes one or more key IDs allocated to a hypervisor, a first subset of key IDs to be allocated to supporting virtual machines, and a second subset of key IDs to be allocated to legacy virtual machines, the first subset being separate from the second subset.
12 . The method of claim 9 , wherein the ownership identifier indicates that a writing entity that stored the encrypted data and a reading entity associated with the first read request are each one of:
a legacy virtual machine that does not support returning the substitute data;
a supporting virtual machine that supports returning the substitute data; or
a hypervisor.
13 . The method of claim 9 , further comprising, for returning the data decrypted from the encrypted data:
acquiring, based on the first read request, a decryption key associated with a reading entity associated with the first read request; and
decrypting the encrypted data using the decryption key, which:
results in properly decrypted data when the reading entity is an entity that stored the encrypted data in the memory or is permitted to access the encrypted data; and
results in improperly decrypted data when an entity other than the reading entity stored the encrypted data in the memory or is not permitted to access the encrypted data.
14 . The method of claim 9 , further comprising:
encrypting data using an encryption key associated with a writing entity, the encryption key being acquired based on a write request to store the data in the memory;
generating, based on a writing entity identifier from the write request, the ownership identifier to identify a type of the writing entity; and
storing the encrypted data in the memory and the ownership identifier in the metadata stored with the encrypted data in the memory.
15 . The method of claim 9 , wherein the ownership identifier identifies a type of a writing entity that stored the encrypted data in the memory, the type of the writing entity being one of a hypervisor, a legacy virtual machine, or a supporting guest virtual machine.
16 . The method of claim 9 , wherein the metadata includes a plurality of error correction code (ECC) bits and at least some of the plurality of ECC bits are repurposed for storing the ownership identifier.
17 . The method of claim 9 , wherein the substitute data comprises a specified pattern of bit values that each have a logical one value.
18 . The method of claim 9 , wherein the substitute data comprises a specified pattern of bit values that each have a logical zero value.
19 . The method of claim 9 , wherein the substitute data comprises a specified pattern of bit values comprising a mixture of zero values and one values.
20 . A non-transitory computer-readable storage medium storing instructions that are executable by at least one processing device to:
acquire, from metadata stored with encrypted data in a memory, an ownership identifier;
return data decrypted from the encrypted data, responsive to a first read request for the encrypted data, based on the ownership identifier; and
return substitute data instead of the encrypted data, responsive to a second read request for the encrypted data, based on the ownership identifier, the substitute data including a specified pattern of bit values.