Encryption method for execute-in-place memories
Encryption/decryption techniques for external memory are described herein. In an example embodiment, a device comprises an internal memory and an external memory controller. The internal memory is configured to store a key. The external memory controller is configured to encrypt, with the key, an address for an access operation to an external memory device to obtain an encrypted address, and to encrypt or decrypt a block of data for the access operation based on the encrypted address.
1. A device comprising:
an internal memory configured to store a key; and
a controller configured to communicate with an external memory device over a serial interface, wherein the controller is configured at least to:
transfer, to the external memory device, an address for an access operation to the external memory device over the serial interface;
encrypt, with the key, the address for the access operation to obtain an encrypted address concurrently with transferring the address to the external memory device over the serial interface; and
encrypt or decrypt a block of data for the access operation with the encrypted address.
2. The device of claim 1 , wherein the access operation is a read operation and the controller is configured to encrypt the address for the read operation during multiple clock cycles after the controller receives the read operation and before the controller receives the block of data from the external memory device.
3. The device of claim 2 , wherein the controller is configured to decrypt the block of data without using any clock cycles in addition to the multiple clock cycles.
4. The device of claim 1 , wherein the access operation is a write operation and the controller is configured to encrypt the address for the write operation during multiple clock cycles after the controller receives the write operation and before the controller transfers the block of data to the external memory device.
5. The device of claim 4 , wherein the controller is configured to encrypt the block of data without using any clock cycles in addition to the multiple clock cycles.
6. The device of claim 1 , wherein the controller is configured to encrypt the address for the access operation and to encrypt or decrypt the block of data without increasing the latency of the access operation.
7. A system comprising:
an external memory device that stores an image encrypted with a key; and
a controller coupled to the external memory device over a serial interface, the controller configured at least to:
transfer, to the external memory device, an address for a read operation to the external memory device over the serial interface;
encrypt, with the key, the address for the read operation to obtain an encrypted address, the address specifying a block of data in the image, wherein the address is encrypted with the key concurrently with transferring the address to the external memory device over the serial interface;
receive an encrypted copy of the block of data from the external memory device;
decrypt the encrypted copy of the block of data with the encrypted address.
8. The system of claim 7 , wherein the controller is configured to receive and store the key in internal memory when the system is activated.
9. The system of claim 7 , wherein the controller is coupled to multiple external memory devices.
10. A method comprising:
receiving, by a controller, a read operation for a block of data from a memory device, wherein the memory device is coupled to the controller over a serial interface;
transferring, by the controller to the memory device, an address for the read operation to the memory device over the serial interface;
encrypting, by the controller with a key, the address for the read operation to obtain an encrypted address concurrently with transferring the address for the read operation to the memory device over the serial interface;
receiving, by the controller, an encrypted copy of the block of data from the memory device;
decrypting, by the controller, the encrypted copy of the block of data with the encrypted address, to obtain the block of data.
11. The method of claim 10 , wherein the memory device is an external memory device and the method further comprises the controller returning the block of data in response to the read operation.
12. The method of claim 10 , further comprising:
prior to receiving the read operation, the controller receiving a write operation to write the block of data to the memory device;
transferring, by the controller to the memory device, an address for the write operation to the memory device over the serial interface;
encrypting, by the controller, the address for the write operation with the key, to obtain the encrypted address concurrently with transferring the address for the write operation to the memory device over the serial interface;
encrypting, by the controller, the block of data with the encrypted address, to obtain the encrypted copy of the block of data; and
storing, by the controller, the encrypted copy of the block of data in the memory device.
13. The method of claim 10 , wherein the address for the read operation is encrypted with an encryption algorithm having a latency that is less than or equal to a latency of a transfer operation, by the controller, that transfers the block of data from the memory device.