Computer system for transparent key roll

1. A method of rolling a key within a memory region, the method comprising:

storing data in a first encrypted memory portion in the memory region, the data in the first encrypted memory portion being encrypted to a first runtime encryption key;

storing data in a second encrypted memory portion in the memory region, the data in the second encrypted memory portion being encrypted to a second runtime encryption key;

storing a pointer, the pointer defining a boundary between the first encrypted memory portion and the second encrypted memory portion;

wherein the first encrypted memory portion and second encrypted memory portion are both configured to be accessible together to entities external to the memory to provide data stored in the first encrypted memory portion and second encrypted memory portion; and

rolling the first encrypted memory portion into the second encrypted memory portion by iteratively:

reading data in one or more slots in the first encrypted memory portion using the first runtime encryption key;

writing the data to the one or more slots using the second runtime encryption key; and

moving the pointer such that the one or more slots are in the second encrypted memory portion; and

wherein rolling the first encrypted memory portion into the second encrypted memory portion is performed by performing each iteration based on a memory regions size and number of operations to wear out a key such that all slots in the first encrypted memory portion have been rolled to the second encrypted memory portion such that a quantity of memory operations performed on the first encrypted memory portion is no more than ½ of the number of memory operations to wear out the first key.

2. The method of claim 1 , further comprising implementing collision mitigation functionality whereby all transactions related to a given slot are allowed to complete and then all applications or other external entities are blocked from accessing the given slot until a key is rolled at the given slot.

3. The method of claim 1 , further comprising implementing collision mitigation functionality whereby external entities are blocked from accessing the first encrypted memory portion when a key roll at any slot in the first encrypted memory portion is occurring.

4. The method of claim 1 , further comprising implementing collision mitigation functionality whereby key rolling is prevented for a particular slot while applications are attempting to write to the slot.

5. The method of claim 1 , further comprising implementing collision mitigation functionality whereby key rolling is prevented for a particular slot while transactions are open for the slot.

6. The method of claim 1 , further comprising broadcasting a location of a slot for which a key roll is to occur.

7. A system for rolling encryption within a memory, the system comprising:

a first encrypted memory portion in the memory, the first encrypted memory portion encrypted with a first runtime encryption key;

a second encrypted memory portion in the memory, the second encrypted memory portion encrypted with a second runtime encryption key;

a pointer stored within a hardware device, the pointer defining a boundary between the first encrypted memory portion and the second encrypted memory portion

a key roll manager configured to roll the first encrypted memory portion into the second encrypted memory portion by iteratively:

reading data in one or more slots in the first encrypted memory portion using the first runtime encryption key;

writing the data to the one or more slots using the second runtime encryption key; and

moving the pointer such that the one or more slots are in the second encrypted memory portion; and

wherein rolling the first encrypted memory portion into the second encrypted memory portion is performed by performing each iteration based on a memory regions size and number of operations to wear out a key such that all slots in the first encrypted memory portion have been rolled to the second encrypted memory portion such that a quantity of memory operations performed on the first encrypted memory portion is no more than ½ of the number of memory operations to wear out the first key.

8. The system of claim 7 , further comprising a key roll manager and an app manager configured to implement collision mitigation functionality whereby all transactions related to a given slot are allowed to complete and then all applications or other external entities are blocked from accessing the given slot until a key is rolled at the given slot.

9. The system of claim 7 , further comprising a key roll manager and an app manager configured to implement collision mitigation functionality whereby external entities are blocked from accessing the first encrypted memory portion when a key roll at any slot in the first encrypted memory portion is occurring.

10. The system of claim 7 , further comprising a key roll manager and an app manager configured to implement collision mitigation functionality whereby key rolling is prevented for a particular slot while applications are attempting to write to the slot.

11. The system of claim 7 , further comprising a key roll manager and an app manager configured to implement collision mitigation functionality whereby key rolling is prevented for a particular slot while transactions are open for the slot.

12. The system of claim 7 , further comprising a key roll manager configured to broadcast a location of a slot for which a key roll is to occur.

13. The system of claim 7 , wherein the system is configured to use a same nonce value so long as a write occurs to a higher address value than a current write location and to increment the nonce when writes occur to a same or lower address value than a current write location.

14. The system of claim 7 , wherein the system is configured to use a same nonce value so long as a write occurs to a lower address value than a current write location and to increment the nonce when writes occur to a same or higher address value than a current write location.

15. A computing system comprising:

one or more processors; and

one or more computer-readable media devices having stored thereon instructions that are executable by the one or more processors to configure the computer system to roll a key within a memory region, including instructions that are executable to configure the computer system to perform at least the following:

store data in a first encrypted memory portion in the memory region, the data in the first encrypted memory portion being encrypted to a first runtime encryption key;

store data in a second encrypted memory portion in the memory region, the data in the second encrypted memory portion being encrypted to a second runtime encryption key;

store a pointer, the pointer defining a boundary between the first encrypted memory portion and the second encrypted memory portion; and

wherein the first encrypted memory portion and second encrypted memory portion are both configured to be accessible together to entities external to the memory to provide data stored in the first encrypted memory portion and second encrypted memory portion; and

roll the first encrypted memory portion into the second encrypted memory portion by iteratively:

reading data in one or more slots in the first encrypted memory portion using the first runtime encryption key;

writing the data to the one or more slots using the second runtime encryption key; and

moving the pointer such that the one or more slots are in the second encrypted memory portion; and

wherein rolling the first encrypted memory portion into the second encrypted memory portion is performed performing each iteration based on a memory regions size and number of operations to wear out a key such that all slots in the first encrypted memory portion have been rolled to the second encrypted memory portion such that a quantity of memory operations performed on the first encrypted memory portion is no more than ½ of the number of memory operations to wear out the first key.

16. The computing system of claim 15 , wherein the one or more computer-readable media devices further have stored thereon instructions that are executable by the one or more processors to configure the computer system to implement collision mitigation functionality whereby all transactions related to a given slot are allowed to complete and then all applications or other external entities are blocked from accessing the given slot until a key is rolled at the given slot.

17. The computing system of claim 15 , wherein the one or more computer-readable media devices further have stored thereon instructions that are executable by the one or more processors to configure the computer system to implement collision mitigation functionality whereby external entities are blocked from accessing the first encrypted memory portion when a key roll at any slot in the first encrypted memory portion is occurring.

18. The computing system of claim 15 , wherein the one or more computer-readable media devices further have stored thereon instructions that are executable by the one or more processors to configure the computer system to implement collision mitigation functionality whereby key rolling is prevented for a particular slot while applications are attempting to write to the slot.

19. The computing system of claim 15 , wherein the one or more computer-readable media devices further have stored thereon instructions that are executable by the one or more processors to configure the computer system to implement collision mitigation functionality whereby key rolling is prevented for a particular slot while transactions are open for the slot.

20. The computing system of claim 15 , wherein the one or more computer-readable media devices further have stored thereon instructions that are executable by the one or more processors to configure the computer system to broadcast a location of a slot for which a key roll is to occur.