Trusted computing system with enhanced memory

1. A system comprising:

a secure processor configured to perform encryption and decryption; and

an enhanced memory unit in communication with the secure processor,

wherein the enhanced memory unit comprises a plurality of layers of semiconductor material,

wherein the secure processor is further configured to transmit a request packet to the enhanced memory unit,

wherein a logic layer of the plurality of layers of semiconductor material includes circuits configured to:

receive the request packet from the secure processor,

decrypt the contents of the request packet, and

transmit a response packet to the secure processor, and

wherein a storage layer of the plurality of layers of semiconductor material includes circuits configured as dynamic random access memory (DRAM).

2. The system of claim 1 , wherein the secure processor and the enhanced memory unit are mounted on a circuit board.

3. The system of claim 1 , wherein (i) the semiconductor material is silicon, and (ii) the logic layer and the storage layer are connected by through-silicon vias.

4. The system of claim 1 , wherein the secure processor is connected to the enhanced memory unit by a serial communications bus.

5. The system of claim 1 , wherein:

the request packet is a read request packet,

the read request packet includes an encrypted address, and

the encrypted address defines a location in the storage layer.

6. The system of claim 5 , wherein the circuits in the logic layer are further configured to:

decrypt the encrypted address included in the read request packet into a read address,

retrieve data stored in the storage layer at the read address, and

encrypt the retrieved data,

wherein the response packet includes the encrypted retrieved data.

7. The system of claim 6 , wherein (i) the data stored in the storage layer at the read address is encrypted data and (ii) encrypting the retrieved data includes encrypting the encrypted data.

8. The system of claim 1 , wherein:

the request packet is a write request packet,

the write request packet includes (i) an encrypted address and (ii) encrypted data, and

the encrypted address defines a location in the storage layer.

9. The system of claim 8 , wherein the circuits in the logic layer are further configured to:

decrypt, the encrypted address included in the write request packet into a write address, and

store the encrypted data included in the write request packet in the storage layer at the write address.

10. The system of claim 1 , wherein:

the secure processor is further configured to transmit a plurality of request packets to the enhanced memory unit over a first period of time;

the first period of time is divided into a first set of intervals;

the circuits in the logic layer are further configured to transmit a plurality of response packets to the secure processor over a second period of time; and

the second period of time is divided into a second set of intervals.

11. The system of claim 10 , wherein transmitting a plurality of request packets to the enhanced memory unit over a first period of time includes:

for each interval in the first set of intervals:

determining whether a read or write operation is pending;

in response to having determined a read operation is pending, transmitting a read request packet to the enhanced memory unit, wherein the read request packet includes:

an encrypted read address, and

first encrypted dummy data;

in response to having determined a write operation is pending, transmitting a write request packet to the enhanced memory unit, wherein the write request packet includes:

an encrypted write address, and

encrypted data to be written to memory; and

in response to having determined that neither a read operation nor a write operation are pending, transmitting a dummy request packet to the enhanced memory unit, wherein the dummy request packet includes:

a first encrypted dummy address, and

second encrypted dummy data.

12. The system of claim 11 , wherein transmitting a plurality of response packets to the secure processor over a second period of time includes:

for each interval in the second set of intervals:

determining whether the read request packet or the write request packet has been received;

in response to having determined that the read request packet has been received:

decrypting the address included in the read request packet into a read address,

retrieving the data stored at the read address,

encrypting the retrieved data, and

transmitting a read response packet to the secure processor, wherein the response packet includes the encrypted retrieved data;

in response to having determined that the write request packet has been received:

decrypting the encrypted address included in the write request packet into a write address,

storing the encrypted data included in the write request packet at the write address, and

transmitting a write response packet to the secure processor; and

in response to having determined that neither a read request packet nor a write request packet has been received, sending a dummy response packet to the secure processor.

13. The system of claim 12 , wherein the read request packet, the write request packet, and the dummy request packet are equal in size.

14. The system of claim 12 , wherein the read response packet, the write response packet, and the dummy response packet are equal in size.

15. The system of claim 1 , wherein:

the secure processor comprises:

a first address timestamp register,

a first data timestamp register, and

a second data timestamp register;

the enhanced memory unit further comprises:

a second address timestamp register,

a third data timestamp register, and

a fourth data timestamp register;

the secure processor is further configured to:

store a first value in the first address timestamp register,

store a second value in the first data timestamp register,

store a third value in the second data timestamp register, and

transmit instructions to the enhanced memory unit to (i) store the first value in the second address timestamp register, (ii) store the second value in the third data timestamp register, and (iii) store the third value in the fourth data timestamp register; and

in response to sending the request packet:

increment the first address timestamp register by one, and

increment the first data timestamp register by one; and

the circuits of the logic layer are further configured to:

receive instructions to (i) store the first value in the second address timestamp register, (ii) store the second value in the third data timestamp register, and (iii) store the third value in the fourth data timestamp register, and

in response to receiving the instructions:

store the first value in the second address timestamp register,

store the second value in the third data timestamp register, and store the third value in the fourth data timestamp register.

16. The system of claim 15 , wherein:

the request packet is a read request packet that includes an encrypted read address, and

the circuits in the logic layer are further configured to, in response to receiving the read request packet:

determine whether the read request packet is authentic and

in response to determining that the read request packet is authentic:

decrypt the encrypted read address,

increment the second address timestamp register by one,

increment the third data timestamp register by one,

retrieve data and associated timestamp data stored at the decrypted encrypted read address,

verify the integrity of the retrieved data,

encrypt the retrieved data and associated timestamp data,

increment the fourth data timestamp register by one, and

transmit a read response packet to the secure processor,

wherein the read response packet includes the encrypted retrieved data and the encrypted associated timestamp data.

17. The system of claim 16 , wherein decrypting the encrypted read address is based on advanced encryption standard (AES) encryption and the second address timestamp register.

18. The system of claim 16 , wherein the secure processor is further configured to:

receive the read response packet,

in response to receiving the read response packet, determine if the read response packet is authentic, and

in response to determining that the read response packet is authentic:

decrypt the encrypted retrieved data and the encrypted associated timestamp data contained in the read response packet, and

increment the fourth data timestamp register by one.

19. The system of claim 15 , wherein:

the request packet is a write request packet that includes (i) encrypted data and (ii) an encrypted write address, and

the circuits in the logic layer are further configured to, in response to receiving the write request packet:

determine whether the write request packet is authentic, and

in response to determining that the write request packet is authentic:

decrypt the encrypted write address,

increment the second address timestamp register by one,

increment the third data timestamp register by one,

store the encrypted data at the decrypted encrypted write address, and

transmit a write response packet to the secure processor.

20. The system of claim 19 , wherein decrypting the encrypted write address is based on AES encryption and the second address timestamp register.

21. The system of claim 1 , wherein decrypting the contents of the request packet includes performing authenticated encryption.

22. A system comprising:

a secure processor configured to perform encryption and decryption; and

an enhanced memory unit in communication with the secure processor,

wherein:

the secure processor is further configured to transmit a request packet to the enhanced memory unit,

the enhanced memory unit includes a plurality of layers of semiconductor material,

a logic layer of the plurality of layers of semiconductor material includes circuits configured to:

receive the request packet from the secure processor,

decrypt contents of the request packet, and

transmit a response packet to the secure processor,

the request packet includes an encrypted address, and

a storage layer of the plurality of layers of semiconductor material includes circuits configured as dynamic random access memory (DRAM).