Key rotating trees with split counters for efficient hardware replay protection

1. An apparatus, comprising:

a processor comprising an on-die memory;

a memory comprising a protected region; and

a memory encryption engine comprising processing circuitry to:

encrypt data stored in the protected region using a message authentication code (MAC) having a first value determined using a first key during a first period of time;

generate a replay integrity tree structure comprising security metadata for the data stored in the protected region using the first value of the MAC; and

at the end of the first period of time:

re-key the MAC to have a second value determined using a second key at the end of the first period of time;

decrypt the data stored in the protected region using the first value for the MAC;

re-encrypt the data stored in the protected region using the second value for the MAC; and

update the replay integrity tree using the second value for the MAC.

2. The apparatus of claim 1 , wherein a root of the replay integrity tree is stored in the on-die memory.

3. The apparatus of claim 1 , the memory encryption engine to:

the security metadata in the replay integrity tree comprises a version seed to be encrypted for use in generated a cipherext version of plaintext data page to be store in the protected region.

4. The apparatus of claim 3 , the memory encryption engine to:

encrypt the ciphertext version using counter mode encryption.

5. The apparatus of claim 4 , the memory encryption engine to:

receive, from a requestor, a read request directed to access a cache memory address within the protected region of the memory;

perform a walk of the replay integrity tree to verify all levels of the replay integrity tree; and

return decrypted data to the requestor in response to a determination that all levels of the replay integrity tree are verified.

6. The apparatus of claim 4 , the memory encryption engine to:

receive, from a requestor, a read request directed to access a cache memory address within the protected region of the memory;

perform a walk of the replay integrity tree to verify all levels of the replay integrity tree; and

return a security exception in response to a determination that all levels of the replay integrity tree are not verified.

7. The apparatus of claim 4 , the memory encryption engine to:

receive, from a requestor, a write request directed to access a cache memory address within the protected region of the memory; and

perform a walk of the replay integrity tree to verify all levels of the replay integrity tree and increment one or more counters in the tree.

8. A computer-implemented method, comprising:

encrypting data to be stored in a protected region of a memory using a message authentication code (MAC) having a first value determined using a first key during a first period of time;

generating a replay integrity tree structure comprising security metadata for the data stored in the protected region of the memory using the first value of the MAC; and

at the end of the first period of time:

re-keying the MAC to have a second value determined using a second key at the end of the first period of time;

decrypting the data stored in the protected region using the first value for the MAC;

re-encrypting the data stored in the protected region using the second value for the MAC; and

updating the replay integrity tree using the second value for the MAC.

9. The computer-implemented method of claim 8 , wherein a root of the replay integrity tree is stored in the on-die memory.

10. The computer-implemented method of claim 8 , wherein:

the security metadata in the replay integrity tree comprises a version seed to be encrypted for use in generated a cipherext version of plaintext data page to be store in the protected region.

11. The computer-implemented method of claim 10 , further comprising:

encrypting the ciphertext version using counter mode encryption.

12. The computer-implemented method of claim 11 , further comprising:

receiving, from a requestor, a read request directed to access a cache memory address within the protected region of the memory;

performing a walk of the replay integrity tree to verify all levels of the replay integrity tree; and

returning decrypted data to the requestor in response to a determination that all levels of the replay integrity tree are verified.

13. The computer-implemented method of claim 11 , further comprising:

receiving, from a requestor, a read request directed to access a cache memory address within the protected region of the memory;

performing a walk of the replay integrity tree to verify all levels of the replay integrity tree; and

returning a security exception in response to a determination that all levels of the replay integrity tree are not verified.

14. The computer-implemented method of claim 11 , further comprising:

receive, from a requestor, a write request directed to access a cache memory address within the protected region of the memory;

perform a walk of the replay integrity tree to verify all levels of the replay integrity tree and increment one or more counters in the tree.

15. A non-transitory computer-readable medium comprising instructions which, when executed by a processor, configure the processor to:

encrypt data to be stored in a protected region of a memory using a message authentication code (MAC) having a first value determined using a first key during a first period of time;

generate a replay integrity tree structure comprising security metadata for the data stored in the protected region of the memory using the first value of the MAC; and

at the end of the first period of time:

re-key the MAC to have a second value determined using a second key at the end of the first period of time;

decrypt the data stored in the protected region using the first value for the MAC;

re-encrypt the data stored in the protected region using the second value for the MAC; and

update the replay integrity tree using the second value for the MAC.

16. The non-transitory computer-readable medium of claim 15 , wherein a root of the replay integrity tree is stored in the on-die memory.

17. The non-transitory computer-readable medium of claim 15 , wherein:

the security metadata in the replay integrity tree comprises a version seed to be encrypted for use in generated a cipherext version of plaintext data page to be store in the protected region.

18. The non-transitory computer-readable medium of claim 17 , further comprising instructions which, when executed by the processor, configure the processor to:

encrypting the ciphertext version using counter mode encryption.

19. The non-transitory computer-readable medium of claim 11 , further comprising instructions which, when executed by the processor, configure the processor to:

receiving, from a requestor, a read request directed to access a cache memory address within the protected region of the memory;

performing a walk of the replay integrity tree to verify all levels of the replay integrity tree; and

returning decrypted data to the requestor in response to a determination that all levels of the replay integrity tree are verified.

20. The non-transitory computer-readable medium of claim 12 , further comprising instructions which, when executed by the processor, configure the processor to:

receiving, from a requestor, a read request directed to access a cache memory address within the protected region of the memory;

performing a walk of the replay integrity tree to verify all levels of the replay integrity tree; and

returning a security exception in response to a determination that all levels of the replay integrity tree are not verified.

21. The non-transitory computer-readable medium of claim 13 , further comprising instructions which, when executed by the processor, configure the processor to:

receive, from a requestor, a write request directed to access a cache memory address within the protected region of the memory; and

perform a walk of the replay integrity tree to verify all levels of the replay integrity tree and increment one or more counters in the tree.