System for protecting CPU core by identifying data and instructions
Hardware enforced CPU core protection by identification of digital blocks as instructions or data. A method includes, at a memory controller shim, receiving, from a CPU core, a memory read request. The memory read request comprises an address for a block. The block at the address is requested from a memory. The block is received from the memory. At least one of a decryption key or an authentication key is accessed. At least one of a decryption transformation or an authentication transformation is performed on the block using the decryption key or the authentication key. When the decryption transformation or authentication transformation is deemed valid, a plain text version of the block is returned to the CPU core for consumption. When the decryption transformation or authentication transformation is deemed invalid, the CPU core is prevented from consuming the plain text version of the block.
1. A method of hardware enforced CPU core protection by identification of digital blocks as instructions or data, the method comprising:
at a memory controller shim, receiving, from a CPU core, a memory read request, wherein the memory read request comprises an address for a block;
requesting the block at the address from a memory;
receiving the block from the memory;
accessing at least one of a decryption key or an authentication key;
performing at least one of a decryption transformation or an authentication transformation on the block using the decryption key or the authentication key; and
based on results of the decryption transformation or the authentication transformation, distinguishing whether the block comprises one of data, instructions, or is invalid.
2. The method of claim 1 , further comprising distinguishing that the block comprises instructions by performing the at least one of a decryption transformation or an authentication transformation on the block using a decryption key or an authentication key that is only suitable for instructions.
3. The method of claim 1 , further comprising distinguishing that the block comprises data by performing the at least one of a decryption transformation or an authentication transformation on the block using a decryption key or an authentication key that is only suitable for data.
4. The method of claim 1 , further comprising distinguishing that the block comprises data by performing the at least one of a decryption transformation or an authentication transformation on the block using a decryption key or an authentication key that is only suitable for instructions without identifying valid instructions and using a decryption key or an authentication key that is only suitable for data without identifying valid data.
5. The method of claim 1 , further comprising receiving an instruction/data flag from the CPU core indicating if the memory read request is for instructions or data.
6. The method of claim 1 , further comprising receiving a memory write request from the CPU core, and as a result, performing a transformation using at least one of the decryption key or the authentication key to create encrypted or authenticatable data.
7. One or more non-transitory computer readable media comprising computer executable instructions that when executed by one or more processors cause the one or more processors to perform the following:
at a memory controller shim, receiving, from a CPU core, a memory read request, wherein the memory read request comprises an address for a block;
requesting the block at the address from a memory;
receiving the block from the memory;
accessing at least one of a decryption key or an authentication key;
performing at least one of a decryption transformation or an authentication transformation on the block using the decryption key or the authentication key; and
based on results of the decryption transformation or the authentication transformation, distinguishing whether the block comprises one of data, instructions, or is invalid.
8. The one or more non-transitory computer readable media of claim 7 , further comprising computer executable instructions that when executed by the one or more processors cause the one or more processors to distinguish that the block comprises instructions by performing the at least one of a decryption transformation or an authentication transformation on the block using a decryption key or an authentication key that is only suitable for instructions.
9. The one or more non-transitory computer readable media of claim 7 , further comprising computer executable instructions that when executed by the one or more processors cause the one or more processors to distinguish that the block comprises data by performing the at least one of a decryption transformation or an authentication transformation on the block using a decryption key or an authentication key that is only suitable for data.
10. The one or more non-transitory computer readable media of claim 7 , further comprising computer executable instructions that when executed by the one or more processors cause the one or more processors to distinguish that the block comprises data by performing the at least one of a decryption transformation or an authentication transformation on the block using a decryption key or an authentication key that is only suitable for instructions without identifying valid instructions and using a decryption key or an authentication key that is only suitable for data without identifying valid data.
11. The one or more non-transitory computer readable media of claim 7 , further comprising computer executable instructions that when executed by the one or more processors cause the one or more processors to receive an instruction/data flag from the CPU core indicating if the memory read request is for instructions or data.
12. The one or more non-transitory computer readable media of claim 7 , further comprising computer executable instructions that when executed by the one or more processors cause the one or more processors to receive a memory write request from the CPU core, and as a result, perform a transformation using at least one of the decryption key or the authentication key to create encrypted or authenticatable data.
13. A computer system comprising:
one or more processors; and
one or more computer-readable media having stored thereon instructions that are executable by the one or more processors to configure the computer system to perform hardware enforced CPU core protection by identification of digital blocks as instructions or data, including instructions that are executable to configure the computer system to perform at least the following:
at a memory controller shim, receive, from a CPU core, a memory read request, wherein the memory read request comprises an address for a block;
request the block at the address from a memory;
receive the block from the memory;
access at least one of a decryption key or an authentication key;
perform at least one of a decryption transformation or an authentication transformation on the block using the decryption key or the authentication key; and
based on results of the decryption transformation or the authentication transformation, distinguish whether the block comprises one of data, instructions, or is invalid.
14. The computer system of claim 13 , wherein the one or more computer-readable media further have stored thereon instructions that are executable by the one or more processors to configure the computer system to distinguish that the block comprises instructions by performing the at least one of a decryption transformation or an authentication transformation on the block using a decryption key or an authentication key that is only suitable for instructions.
15. The computer system of claim 13 , wherein the one or more computer-readable media further have stored thereon instructions that are executable by the one or more processors to configure the computer system to distinguish that the block comprises data by performing the at least one of a decryption transformation or an authentication transformation on the block using a decryption key or an authentication key that is only suitable for data.
16. The computer system of claim 13 , wherein the one or more computer-readable media further have stored thereon instructions that are executable by the one or more processors to configure the computer system to distinguish that the block comprises data by performing the at least one of a decryption transformation or an authentication transformation on the block using a decryption key or an authentication key that is only suitable for instructions without identifying valid instructions and using a decryption key or an authentication key that is only suitable for data without identifying valid data.
17. The computer system of claim 13 , wherein the one or more computer-readable media further have stored thereon instructions that are executable by the one or more processors to configure the computer system to receive an instruction/data flag from the CPU core indicating if the memory read request is for instructions or data.
18. The computer system of claim 13 , wherein the one or more computer-readable media further have stored thereon instructions that are executable by the one or more processors to configure the computer system to receive a memory write request from the CPU core, and as a result, perform a transformation using at least one of the decryption key or the authentication key to create encrypted or authenticatable data.