Improving Cost, Performance, and Security of Memory Encryption and Authentication

Abstract

Protection from hardware attacks such as snoopers and mod chips has been receiving increasing attention in computer architecture. This paper presents a new combined memory encryption/authentication scheme. Our new split counters for counter-mode encryption simultaneously eliminate counter overflow problems and reduce per-block counter size, and we also dramatically improve authentication performance and security by using the Galois/Counter Mode of operation (GCM), which leverages counter-mode encryption to reduce authentication latency and overlap it with memory accesses. Our results indicate that the split-counter scheme has a negligible overhead even with a small (32KB) counter cache and using only eight counter bits per data block. The combined encryption/authentication scheme has an IPC overhead of 5% on average across SPEC CPU 2000 benchmarks, which is a significant improvement over the 20% overhead of existing encryption/authentication schemes.

PoisonIvy: Safe speculation for secure memory

“…Haswell's AESDEC performs one round in 7 processor cycles and performs the 10-14 required rounds in 70-98 cycles, depending on key length [13]. Prior work assumes 80 cycles for decryption [48].…”

“…For confidentiality, the memory controller encrypts and decrypts data to and from memory. Best practices combine one-time pads and countermode encryption [12], [48].…”

“…Academic designs place metadata in the L2 cache along with the data [11], [25], [48], [49], while industry designs use a dedicated cache in the memory encryption engine [12]. Caches mitigate, but do not eliminate, overheads.…”

TEC-Tree: A Low-Cost, Parallelizable Tree for Efficient Defense Against Memory Replay Attacks

“…In [8,9], cryptographic hashes are computed over each data block composing the memory space being protected. We call these hashes Level 1 hashes.…”

“…Existing techniques allow for easy prevention of replay attacks but are very expensive in terms of on-chip memory overhead: some techniques store on-chip a hash value computed over each memory block written off-chip, while others store on-chip nonces used in MAC (Message Authentication Code) computations or in a block-level AREA (Added Redundancy Explicit Authentication [4]) scheme [5,6]. The well-known Merkle Tree technique [7,8,9] allows reducing the overhead of the countermeasure storing hashes on-chip to a single hash value. However, it comes at the cost of performance-killing characteristics for embedded systems -e.g.…”