Selective memory duplication control
Generally disclosed herein is an approach for securing data. The approach may include encountering a pointer to a first memory location and determining, based on the pointer, that the first memory location is storing sensitive data. The approach may further include automatically copying the sensitive data to a secure memory location in response to determining that the first memory location is storing sensitive data.
1 . A method for securing data, comprising:
receiving, by one or more processors, a pointer to a first memory location, wherein the pointer comprises a plurality of bits, wherein a first subset of the plurality of bits identifies an address of the first memory location and a second subset of the plurality of bits indicates that the first memory location stores sensitive data;
determining, by the one or more processors based on the pointer, that the first memory location is storing sensitive data;
copying, by one or more processors, the sensitive data;
storing a copy of the sensitive data to at least one second memory location; and
generating the pointer including a tag for the sensitive data at a time of hardware programming.
2 . The method of claim 1 , wherein the sensitive data includes security keys or permission access keys.
3 . The method of claim 1 , further comprising storing instructions pertaining to microarchitectural behaviors.
4 . The method of claim 1 , wherein the at least one second memory location is in Li or L2 cache.
5 . The method of claim 1 , wherein the tag is associated with instructions for a controller to take one or more actions.
6 . The method of claim 1 , wherein the at least one second memory location is in a memory region that is physically independent from the first memory location.
7 . The method of claim 1 , wherein the at least one second memory location is carved out from an existing cache structure.
8 . The method of claim 1 , further comprising:
accessing the sensitive data at the first memory location;
determining that the sensitive data at the first memory location is missing or corrupted; and
initiating a corrective action when the sensitive data at the first memory location is missing or corrupted.
9 . The method of claim 8 , wherein initiating a corrective action comprises loading the copy of the sensitive data from the second memory location.
10 . The method of claim 8 , wherein the corrective action comprises replacing contents of the first memory location with the copy of the sensitive data from the second memory location.
11 . The method of claim 1 , further comprises:
determining whether the sensitive data is stored in L1 cache;
when the sensitive data is stored in L1 cache, determining that the sensitive data is stored in a secure location; and
in response to determining that the sensitive data is stored in a secure location, taking no further action with respect to copying the sensitive data.
12 . A system for securing data, the system comprising:
one or more memories; and
one or more processors configured to:
receive a pointer to a first memory location, wherein the pointer comprises a plurality of bits, wherein a first subset of the plurality of bits identifies an address of the first memory location and a second subset of the plurality of bits indicates that the first memory location is storing sensitive data;
determine based on the pointer, that the first memory location is storing sensitive data;
copy the sensitive data;
store a copy of the sensitive data to at least one second memory location; and
generate the pointer including a tag for the sensitive data at a time of hardware programming.
13 . The system of claim 12 , wherein the one or more processors are further configured to:
access the sensitive data at the first memory location;
determine that the sensitive data at the first memory location is missing or corrupted; and
initiate a corrective action when the sensitive data at the first memory location is missing or corrupted.
14 . The system of claim 13 , wherein initiate a corrective action comprises loading the copy of the sensitive data from the second memory location.
15 . The system of claim 13 , wherein the corrective action comprises replacing contents of the first memory location with the copy of the sensitive data from the second memory location.
16 . The system of claim 13 , wherein the second memory location is in a memory region that is physically independent from the first memory location.
17 . The system of 14 , wherein the sensitive data comprises security keys or permission access keys.
18 . The system of claim 12 , wherein the second memory location is carved out from an existing cache structure.