Memory buffer devices with modal encryption
Technologies for modal encryption are described. One memory buffer device includes a compression block and an in-line memory encryption (IME) block. The compression block can output compressed data. The IME block can encrypt uncompressed data at a first granularity and encrypt the compressed data at a second granularity, wherein the second granularity is larger than the first granularity.
1. A memory buffer device comprising:
a compression block to output compressed data; and
an in-line memory encryption (IME) block coupled to the compression block, wherein the IME block is to encrypt uncompressed data at a first granularity and encrypt the compressed data at a second granularity, wherein the second granularity is larger than the first granularity.
2. The memory buffer device of claim 1 , wherein the first granularity is a single cache line, and wherein the second granularity is multiple cache lines.
3. The memory buffer device of claim 1 , wherein the IME block is to generate a message authentication code (MAC) at a granularity of compression.
4. The memory buffer device of claim 1 , wherein the IME block is to generate a message authentication code (MAC) at a granularity of encryption.
5. The memory buffer device of claim 4 , wherein the granularity of encryption and a length of the MAC are adjusted based on a device-private data structure.
6. The memory buffer device of claim 5 , wherein the device-private data structure is a page table.
7. The memory buffer device of claim 4 , wherein the IME block is to determine the granularity of encryption based on an address being accessed.
8. The memory buffer device of claim 4 , wherein the IME block is to receive an indication of the granularity of encryption from a host coupled to the memory buffer device.
9. The memory buffer device of claim 1 , wherein the IME block is to:
verify one or more message authentication codes (MACs) associated with the uncompressed data, the one or more MACs being generated at the first granularity; and
generate a MAC for the compressed data at the second granularity.
10. The memory buffer device of claim 9 , wherein:
the IME block is to decrypt the uncompressed data into decrypted data; and
the compression block is to generate the compressed data using the decrypted data.
11. The memory buffer device of claim 1 , wherein the IME block is to send or receive encrypted data, wherein the encrypted data comprises a message authentication code (MAC) with a length that varies based on a degree of compression of the encrypted data.
12. The memory buffer device of claim 11 , wherein the length of the MAC for a region of memory is stored in a device-private data structure.
13. The memory buffer device of claim 1 , wherein the IME block is to encrypt the compressed data with additional data to obscure a length of the compressed data.
14. The memory buffer device of claim 1 , further comprising:
a CXL controller coupled to the compression block and one or more hosts;
an error correction code (ECC) block to detect and correct errors in cache lines being read from a dynamic random access memory (DRAM) device; and
a memory controller coupled to the ECC block and the DRAM device.
15. A memory module that supports a remote memory protocol, the memory module comprising:
one or more volatile memory devices;
a compression circuit to output compressed data; and
an encryption circuit coupled to the compression circuit, wherein the encryption circuit is to encrypt uncompressed data at a first granularity and encrypt the compressed data at a second granularity, wherein the second granularity is larger than the first granularity.
16. The memory module of claim 15 , further comprising:
an error correction code (ECC) circuit coupled to the encryption circuit, wherein the ECC circuit is to generate and verify first ECC information to be stored with each cache line of the uncompressed data and generate and verify second ECC information to be stored with a set of cache lines of the compressed data.
17. The memory module of claim 16 , wherein the encryption circuit is to:
generate a first message authentication code (MAC) to be stored with each cache line of the uncompressed data and verify the respective first MAC when accessing the respective cache line; and
generate a second MAC to be stored with the set of cache lines of the compressed data and verify the second MAC when accessing the set of cache lines.
18. A method comprising:
receiving encrypted and uncompressed data;
decrypting the encrypted and uncompressed data to obtain decrypted data, wherein the encrypted and uncompressed data is encrypted at a first granularity;
compressing the decrypted data to obtain compressed data; and
encrypting the compressed data at a second granularity to obtain encrypted and compressed data, wherein the second granularity is larger than the first granularity.
19. The method of claim 18 , wherein the first granularity is a single cache line, and wherein the second granularity is multiple cache lines.
20. The method of claim 19 , further comprising:
generating a message authentication code (MAC) corresponding to at least one of a granularity of compression or a granularity of encryption; and
generating error correction code (ECC) information corresponding to the encrypted and compressed data, wherein the ECC information is to be stored with a set of multiple cache lines of the encrypted and compressed data.