This document discloses data security systems and methods of securing data. A cache memory can be connected between a decryption engine and a central processing unit (“CPU”) to increase security of encrypted data that is stored in a datastore. The decryption engine can retrieve the encrypted data from the datastore, decrypt the data, and store the decrypted data in the cache. In turn, the decrypted data can be accessed by the CPU. The data can be encrypted with a secret key, so that decryption can be performed with the secret key. The key can be varied based on a memory address associated with the data. The key can be protected by restricting direct access to the decryption engine by the CPU.
1. A data security system, comprising:
a first datastore storing encrypted data;
a second datastore connectable to an external processing unit;
a controller serially connected between the first datastore and the second datastore, the second datastore being serially connected between the controller and the external processing unit; and
a decryption engine coupled to the controller, the decryption engine including at least one processor and being configured to obtain at least a portion of the encrypted data from the controller and decrypt the portion of the encrypted data; the decryption engine being connected to the controller in a manner that prevents the external processing unit from accessing the decryption engine, wherein the controller is connected between the decryption engine and each of the first datastore and the second datastore, and wherein the controller is configured to:
receive data requests when data requested by the external processing unit are not stored in the second datastore,
obtain from the first datastore first data corresponding to the requested data,
determine whether the first data are encrypted based on whether the requested data are stored in a first memory window in the first datastore, and
if the first data are encrypted, provide the first data to the decryption engine obtain from the decryption engine decrypted data corresponding to the first data, and store the decrypted data in the second datastore to make the decrypted data directly accessible to the external processing unit, and
if the first data are not encrypted, store the first data in the second datastore without providing the first data to the decryption engine.
2. The data security system of claim 1 , further comprising a cipher management engine including at least one processor, the cipher management engine being configured to generate an encryption key for a memory sub-window based on an address of the memory sub-window and a secret key, wherein the cipher management engine is configured to generate a unique decryption key for each memory sub-window, the cipher management engine being connected to the controller in a manner that prevents the controller from directly accessing the cipher management engine.
3. The data security system of claim 1 , wherein: the second datastore is inaccessible by the decryption engine.
4. The data security system of claim 1 , wherein the controller is further configured to define a start address and an end address of the first memory window in the first datastore, the first memory window being a portion of memory in which the encrypted data are stored, and
determine whether the data obtained from the first datastore are encrypted based on whether an address of the requested data is between the start address and the end address of the memory window.
5. The data security system of claim 1 , wherein the first datastore, the decryption engine, and the second datastore are implemented on a Smart card.
6. The data security system of claim 1 , wherein the first data is contained in a data block, the controller being configured to perform the obtaining, determining, providing, decrypting, and storing operations on the entire data block containing the first data.
7. A method comprising:
storing encrypted data in a first datastore of a data security system;
receiving data requests when data requested by an external processing unit are not stored in a second datastore of the data security system, the second datastore being accessible to the external processing unit;
obtaining from the first datastore encrypted first data corresponding to the requested data;
determining whether the first data are encrypted based on whether the requested data are stored in a first memory window of the first datastore;
if the first data are encrypted, providing the first data to a decryption engine of the data security system, the decryption engine being inaccessible to the external processing unit, obtaining from the decryption engine decrypted data corresponding to the first data, and storing the decrypted data in the second datastore to make the decrypted data directly accessible to the external processing unit; and
if the first data are not encrypted, storing the first data in the second datastore without providing the first data to the decryption engine.
8. The method of claim 7 , wherein the first data are retrieved from a memory sub-window of the first memory window in the first datastore, the method further comprising:
generating by a cipher management engine, a decryption key for the memory sub-window based on a secret key and an address of the memory sub-window, and
using the decryption key by the decryption engine to decrypt the first data,
wherein the decryption key is unique for each memory sub-window of the first memory window, the cipher management engine including at least one processor and being accessible only to the decryption engine.
9. The method of claim 7 , wherein the first memory window is defined by a start and an end address, and determining whether the first data are encrypted comprises determining whether an address of the first data is between the start address and the end address of the first memory window.
10. The method of claim 7 , wherein data retrieved in the first datastore is identified as encrypted based on an address of the data.
11. The method of claim 7 , wherein the obtaining, determining, providing, decrypting, and storing operations are performed on the entire data block containing the first data.