Key management in computer processors
View Patent ↗Systems, apparatuses, and methods related to a computer system having a processor and a main memory storing scrambled data are described. The processor may have a secure zone configured to store keys and an unscrambled zone configured to operate on unscrambled data. The processor can convert the scrambled data into the unscrambled data in the unscrambled zone using the keys retrieved from the secure zone in response to execution of instructions configured to operate on the unscrambled data. Another processor may also be coupled with the memory, but can be prevented from accessing the unscrambled data in the unscrambled zone.
1 . A computing system, comprising:
an unscrambled zone, of a processor, having circuits configured to perform operations on unscrambled data;
a cache, of the processor, configured as a gateway to the unscrambled zone from outside of the processor and configured to store scrambled data;
a logic circuit, of the processor, coupled with the cache and with the circuits of the unscrambled zone and configured to unscramble scrambled data from the cache for transfer to the circuits of the unscrambled zone, and configured to scramble unscrambled data from the unscrambled zone for transfer to the cache; and
a secure zone, of the processor, coupled with the logic circuit and configured to communicate, to the logic circuit, keys for scrambling data and unscrambling data.
2 . The computing system of claim 1 , wherein the unscrambled zone includes at least one execution unit and at least one register.
3 . The computing system of claim 1 , wherein the processor further includes the secure zone having a key store.
4 . A method, comprising:
communicating, by a secure zone of a processor of a computing system, keys used in scrambling and unscrambling operations to a logic circuit of the processor;
storing, in a cache of the computing system, data in a scrambled form;
converting, by the logic circuit of the processor using the keys from the secure zone, the data from the scrambled form to an unscrambled form for transfer of the data to an unscrambled zone of the processor;
performing, in the unscrambled zone of the processor, computation operations on the data from the logic circuit in the unscrambled form; and
converting, by the logic circuit of the processor using the keys from the secure zone, results of the computation operations from the unscrambled form to the scrambled form for transfer of the results to the cache of the processor.
5 . The method of claim 4 , wherein the cache is configured as a gateway for data to enter the unscrambled zone for processing and for results of the processing to leave the unscrambled zone.
6 . The method of claim 4 , wherein the unscrambled zone includes at least one execution unit and at least one register.
7 . The method of claim 4 , wherein the processor further includes the secure zone having a key store.
8 . A device, comprising:
a processor having:
a cache configured to store scrambled data;
an unscrambled zone having circuits configured to perform operations on unscrambled data;
a secure zone configured to manage keys used in scrambling data for transfer to the cache and unscrambling data for transfer to the unscrambled zone; and
a logic circuit coupled with the secure zone, the unscrambled zone, the cache, the logic circuit configured to receive keys from the secure zone, use the keys to scramble unscrambled data from the unscrambled zone for transfer to the cache, and use the keys to unscramble data from the cache for transfer to the unscrambled zone.
9 . The device of claim 8 , wherein the cache is configured as a gateway to the unscrambled zone from outside of the processor.
10 . The device of claim 8 , wherein the unscrambled data is an instruction, an address, or an operand of an instruction.