Method for decrypting an encrypted instruction and system thereof
Methods of preventing private information, which is hidden within data of a private domain reserved by an application program, from being easily accessed by a CPU and other devices, both where the data of the private domain is decrypted and the access to said data are restricted are disclosed, where the mentioned other devices do not include a decryption module utilized in the methods. Therefore, as long as agreements related to encryptions and decryptions are made in advance between the application program and the decryption module, private information can be well protected.
1. A method for decrypting an encrypted instruction comprising:
receiving an encrypted instruction;
decrypting the encrypted instruction to a decrypted instruction by using a key included in a decryption information;
storing the decrypted instruction in a private domain of the memory;
submitting a request for shielding the private domain; and
transmitting the decrypted instruction into a processing unit;
wherein the decryption information further includes a range of the private domain indicating consecutive pages, blocks, or addresses occupied by said private domain and in the memory.
2. The method of claim 1 further comprising:
receiving the decryption information including an encrypted session key; and
generating the key by decrypting the encrypted session key.
3. The method of claim 2 further comprising:
verifying whether a digital signature included in the decryption information is valid; and
decrypting the encrypted session key included in the decryption information if the digital signature is valid.
4. The method of claim 2 wherein the encrypted session key is decrypted by using a private key.
5. The method of claim 1 wherein the request for shielding the private domain is received by the processing unit.
6. The method of claim 1 wherein the request for shielding the private domain is received by a memory controller.
7. The method of claim 1 further comprising:
storing the decrypted instructions in a shadow memory.
8. The method of claim 1 wherein the decryption information further includes a digital signature for identifying an origin of the application program.
9. The method of claim 8 further comprising:
verifying whether the digital signature is valid; and
decrypting the encrypted instructions by using the key included in the decryption information if the digital signature is valid.
10. The method of claim 1 further comprising:
executing the decrypted instruction by the processing unit.
11. The method of claim 1 , wherein decrypting the encrypted instructions by using a key included in the decryption information comprises:
generating a plurality of bits from the key; and
performing a logic operation on the encrypted instructions and the bits from the key to generate the decrypted instruction.
12. The method of claim 11 , wherein the logic operation is an exclusive-or operation.
13. A computer system comprising:
a processing unit;
a memory coupled to the processing unit and utilized for storing a key and an encrypted instruction;
a shadow memory coupled to the decryption module for storing the decrypted instruction;
a decryption module coupled to the memory and the processing unit, wherein the decryption module decrypts the encrypted instruction to a decrypted instruction by using the key, and transmits the decrypted instruction to the processing unit; and
a memory controller for controlling access of the memory and for shielding a private domain of the memory according to a request from the decryption module;
wherein the decryption information further includes a range of the private domain indicating consecutive pages, blocks, or addresses occupied by said private domain and in the memory.
14. The computer system of claim 13 wherein the key stored in the memory is an encrypted session key.
15. The computer system of claim 14 wherein the decryption module comprises:
a first logic unit for decrypting the encrypted session key by using a private key; and
a second logic unit for decrypting the encrypted instruction using the encrypted session key.
16. The computer system of claim 13 , wherein the decryption module comprises:
a core logic unit for generating a plurality of bits from the key; and
an exclusive-or logic unit for operating on both the encrypted instruction and the plurality of bits generated from the key.