Memory controller cryptographic data quantization using a cache
Some examples described herein provide for an encrypted data quantization apparatus and method, for example a memory controller to quantize encrypted data using a cache. One or more embodiments includes obtaining a first set of plaintext data bits to be stored in a memory device using an encryption scheme. A memory address for encrypted data bits to be stored in the memory device is identified for a first subset of plaintext data bits. A second set of plaintext data bits associated with the memory address is obtained from a cache, if present. The second set of plaintext data bits are modified according to the first set of plaintext data bits to be stored in the memory device to generate a third set of plaintext data bits that are then encoded according to the encryption scheme for storage in the memory device.
1 . A method of writing to a memory device of an integrated circuit (IC), the method comprising:
obtaining a first set of plaintext data bits to be stored in the memory device, the memory device utilizing an encryption scheme;
identifying, for a first subset of bits of the first set of plaintext data bits, a memory address for encrypted data bits in the memory device;
retrieving, from a partial-write cache, a second set of plaintext data bits corresponding to the memory address of the first subset of bits based at least in part on the second set of plaintext data bits being present in the partial-write cache;
modifying the second set of plaintext data bits stored in the partial-write-cache according to the first set of plaintext data bits to be stored in the memory device to generate a third set of plaintext data bits corresponding to the memory address of the first subset of bits; and
encrypting, using an encryption circuit, the third set of plaintext data bits according to the encryption scheme to generate a set of encrypted data bits to be stored in the memory device at the memory address, wherein the encryption circuit encrypts the modified second set of plaintext data bits using data from the partial-write cache to avoid a full read-modify-write cycle.
2 . The method of claim 1 , further comprising:
checking a cache address memory to determine whether the second set of plaintext data bits associated with the memory address are present in the cache, wherein the second set of plaintext data bits are obtained from the cache based at least in part on an indication obtained from the cache address memory that the second set of plaintext data bits are present in the cache.
3 . The method of claim 1 , further comprising:
tracking an age associated with each set of plaintext data bits stored in the cache.
4 . The method of claim 1 , further comprising:
storing the third set of plaintext data bits in the cache;
identifying that the third set of plaintext data bits in the cache is to be evicted based at least in part on the cache being full, wherein the third set of plaintext data bits are encoded according to the encryption scheme to generate the set of encrypted data bits based at least in part on identifying that the third set of plaintext data bits in the cache are to be evicted; and
outputting the set of encrypted data bits for storage in the memory device.
5 . The method of claim 4 , further comprising:
tracking an age associated with each set of plaintext data bits stored in the cache, wherein the third set of plaintext data bits are identified based at least in part on the age associated with the third set of plaintext data bits as indicated by the tracking.
6 . The method of claim 4 , queueing the third set of plaintext data bits in a first in first out buffer prior to encoding.
7 . The method of claim 1 , wherein the encryption scheme comprises an advanced encryption standard (AES), a Galois/counter mode (GCM) encryption, or a xor-encrypt-xor (XEX)-based tweaked-codebook mode with ciphertext stealing (XTS) encryption.
8 . An apparatus, comprising:
a partial-write cache;
a partial-write cache controller configured to:
identify, for a first subset of bits of a first set of plaintext data bits to be stored in a memory device that utilizes an encryption scheme, a memory address for encrypted data bits in a memory device, and
direct the partial-write cache to provide a second set of plaintext data bits corresponding to the memory address of the first subset of bits based at least in part on the second set of plaintext data bits being present in the partial-write cache; and
an encryption circuit to:
modify the second set of plaintext data bits stored in the partial-write-cache according to the first set of plaintext data bits to be stored in the memory device to generate a third set of plaintext data bits corresponding to the memory address of the first subset of bits,
encrypt the third set of plaintext data bits according to the encryption scheme using data from the partial-write cache to avoid a full read-modify-write cycle to generate a set of encrypted data bits, and
provide, to the memory device, the set of encrypted data bits to be stored at the memory address.
9 . The apparatus of claim 8 , further comprising:
a cache address memory to store a mapping between memory addresses of the memory device and plaintext data bits stored in the cache, wherein the cache controller is configured to check the cache address memory to determine whether the second set of plaintext data bits associated with the memory address are present in the cache.
10 . The apparatus of claim 8 , further comprising:
an age tracking matrix to track an age associated with each set of plaintext data bits stored in the cache.
11 . The apparatus of claim 8 , wherein:
the cache controller is further configured to store the third set of plaintext data bits in the cache and identify that the third set of plaintext data bits in the cache is to be evicted based at least in part on the cache being full, wherein the third set of plaintext data bits are encoded according to the encryption scheme to generate the set of encrypted data bits based at least in part on identifying that the third set of plaintext data bits in the cache are to be evicted; and
the encryption circuit is further configured to output the set of encrypted data bits for storage in the memory device.
12 . The apparatus of claim 11 , further comprising:
an age tracking matrix to track an age associated with each set of plaintext data bits stored in the cache, wherein the third set of plaintext data bits are identified based at least in part on the age associated with the third set of plaintext data bits as indicated by the tracking.
13 . The apparatus of claim 11 , further comprising:
a first in first out buffer to queue the third set of plaintext data bits prior to encoding.
14 . A computing system, comprising:
a memory device; and
an integrated circuit coupled with the memory device, wherein the integrated circuit comprises a partial-write cache, a partial-write cache controller, and an encryption circuit, wherein:
the partial-write cache controller is configured to identify, for a first subset of bits of a first set of plaintext data bits to be stored in a memory device that utilizes an encryption scheme, a memory address for encrypted data bits in the memory device, and to direct the partial-write cache to provide a second set of plaintext data bits corresponding to the memory address of the first subset of bits based at least in part on the second set of plaintext data bits being present in the partial-write cache; and
the encryption circuit is configured to modify the second set of plaintext data bits stored in the partial-write-cache according to the first set of plaintext data bits to be stored in the memory device to generate a third set of plaintext data bits corresponding to the memory address of the first subset of bits, to encrypt the third set of plaintext data bits according to the encryption scheme using data from the partial-write cache to avoid a full read-modify-write cycle to generate a set of encrypted data bits, and to provide, to the memory device, the set of encrypted data bits to be stored at the memory address.
15 . The computing system of claim 14 , wherein the integrated circuit further comprises:
a cache address memory to store a mapping between memory addresses of the memory device and plaintext data bits stored in the cache, wherein the cache controller is configured to check the cache address memory to determine whether the second set of plaintext data bits associated with the memory address are present in the cache.
16 . The computing system of claim 14 , wherein the integrated circuit further comprises:
an age tracking matrix to track an age associated with each set of plaintext data bits stored in the cache.
17 . The computing system of claim 14 , wherein:
the cache controller is further configured to store the third set of plaintext data bits in the cache and identify that the third set of plaintext data bits in the cache is to be evicted based at least in part on the cache being full, wherein the third set of plaintext data bits are encoded according to the encryption scheme to generate the set of encrypted data bits based at least in part on identifying that the third set of plaintext data bits in the cache are to be evicted; and
the encryption circuit is further configured to output the set of encrypted data bits for storage in the memory device.
18 . The computing system of claim 17 , wherein the integrated circuit further comprises:
an age tracking matrix to track an age associated with each set of plaintext data bits stored in the cache, wherein the third set of plaintext data bits are identified based at least in part on the age associated with the third set of plaintext data bits as indicated by the tracking.
19 . The computing system of claim 17 , wherein the integrated circuit further comprises:
a first in first out buffer to queue the third set of plaintext data bits prior to encoding.