Accelerating Memory Decryption and Authentication With Frequent Value Prediction Weidong...

Accelerating Memory Decryption and Authentication With Frequent Value

Prediction

Weidong Shi Hsien-Hsin Sean LeeMotorola Labs Georgia Tech

2/26Shi and Lee, Accelerating Memory Decryption and Authentication (CF’07)

Security Frontier

Transistor Leaf Cell

Register/Unit Processor SoC

Embedded Secrets

Counterfeit Detection

Authentication/Secure Token

Isolation

Content Confidentiality

Circuit Camouflage/Obfuscation/Private Circuit

(Eurocrypt 02/06)

Secure MMU/Buses/Memory(CASES-04, ASPLOS-04,

PACT-06)

Secure Processor(e.g., IBM 06, MICRO-36/37/39,

ASPLOS 02/04, ISCA32/33)

Secure SoC

Chip De-liddingDie Analysis

Probing PCB

Side-channel

Clocking-Timing

Backdoor

Secure Processor Architecture

Encrypted Memory

[MICRO-36,37, 39, ASPLOS-02,04, ISCA-32,33, IBM SecureBlue]

Trusted Secure Processor

Processor Core

Memory Enc/Dec,Integrity

Verification Engine

Agenda• Counter Mode Cipher

• “Direct Memory” Block Ciphers

• Frequent Value Speculation

• Performance Analysis

• Conclusion

Counter Mode Encryption

Counter

Block Cipher(AES)

Plaintxt0

Ciphertxt0

Secret Key

One Time Pad

Nonce/IV

• Use Counter to generate a secret keystream that encrypts a memory block with a simple XOR

• Turn a block cipher into a stream cipher

Counter

Block Cipher(AES)

Plaintxt0

Ciphertxt0

Nonce Counter+1

Block Cipher(AES)

Plaintxt1

Ciphertxt1

Nonce Counter+N

Block Cipher(AES)

PlaintxtN

CiphertxtN

• Use Counter to generate a secret keystream that encrypts a memory block with a simple XOR

• Turn a block cipher into a stream cipher

Parallelization for Counter Mode Secure Arch

• OTP generation and Data fetch are done in parallel

• How to obtain Counter values– Counter Cache [MICRO36]– Prediction & Precomputation

[ISCA32]

Counter

Block Cipher(AES)

Plaintxt cache line X

Ciphertxt cache line X XORXOR

One Time Pad

Secure Processor

Memory

Block Cipher (ECB)

Block Cipher(AES)

Plaintxt0

Ciphertxt0

Secret Key

• “Direct” Memory Encryption• Electronic Code Book

Block Cipher (ECB)

Block Cipher(AES)

Plaintxt0

Ciphertxt0

Secret Key

Block Cipher(AES)

PlaintxtN

CiphertxtN

Secret Key

• “Direct” Memory Encryption• Electronic Code Book

Block Cipher (CBC)• Cipher-Block Chaining• A dependency with the neighboring ciphertext for

decrypting a target

Block Cipher(AES)

Plaintxt0

Ciphertxt0

Secret Key

XORInit. Vector

Block Cipher(AES)

Plaintxt1

Ciphertxt1

Secret Key

Block Cipher(AES)

Plaintxt2

Ciphertxt2

Secret Key

Authenticated Encryption• The same cipher protects

– Confidentiality (tamper-resistance)

– Message Integrity (tamper-evidence)

• Offset Code Block (OCB)– One of the authenticated encryption methods– Non-malleable under chosen-ciphertxt -- which

counter mode is vulnerable to– 802.11i currently specifies AES-OCB as an

alternative to CCM for confidentiality and integrity

Authenticated Encryption: OCB Encryption

Block Cipher(AES)

L pseudo random #

Secret Key

Nonce || mem addr

PlaintxtN

Block Cipher(AES)

Secret Key

XORaL+R

CiphertxtN

Authenticated Encryption: OCB Authentication

Plaintxt0 Plaintxt1 Plaintxt2 Plaintxt3

5L+R XOR

Block Cipher(AES)

Secret Key

Message Authentication Code(MAC)

OCB ─ Decryption and Integrity Verification

• Decryption can start after encrypted memory blocks are fetched.

• Decrypted blocks cannot be issued till its integrity is verified.

• MAC verification can take longer time than decryption.

Memory Fetch

E(B1) E(B2) E(B3)

Decryption

B0 B1 B2 B3

MAC Verification

Issue Issue Issue Issue

Speculations in Secure Processor

Examples of

Prediction

Applicable Cipher Scenario

What can be Predicted

Why Predicable?

Counter Prediction[ISCA-32]

Counter Values Coherence of Counter Values

Value Prediction[CF-07]

“Direct” Encryption mode

Encrypted Value Existence of Frequent Values

• Improve performance by taking advantage of – The nature of the data or,– Statistical property of the data.

• Do not compromise security as performed only

within the secure boundary.

Analysis of Frequent ValuesFrequent value - 256K L2

crafty

facerec

parser

vortex

average

8 16 32

Frequent value - 1M L2

crafty

facerec

parser

vortex

average

• 40 to 60% encrypted memory data are frequent values

• 8 to 32 frequent values account for over 40% encrypted data

Speculation Using Idle Pipelined Crypto Engine• Generate “encrypted” frequent values using

otherwise idle crypto engines

Encryption Pipeline

Memory Pipeline

Retrieving the Encrypted Cache Line Ek(X)

Frequent value Ek(A)

• Integrity verification can also be speculated. • Generate MAC for speculated frequent values

Ek(E) matches

Time Line

Value Prediction Based Decryption

WBBuffer

Pipelined Encryption Engine

Pipelined Decryption Engine

Scheduler

Returned Encrypted Data

Frequent Value Table

Secure processor

E(X)E(Y)E(Z)E(W)

Handle Large Block Size

64-bitblock

Freq Value

Non-Freq Value

128-bit Cipher

Four 64-bit frequent value blocks

• Under 128 bit cipher, is predictable. is not.

64-bitblock

Predictable Blocks of Freq Value Blocks (%), L2=256KB

crafty

facerec

galgel

parser

sixtrack

vortex

average

Block Re-ordering64-bitblock

64-bitblock

Predictable Freq Value Pair

Predictable Blocks of Frequent Values Blocks (%) L2=256KB

crafty

facerec

galgel

parser

sixtrack

vortex

average

without reorder with_reorder

64-bitblock

Freq Value

Non-Freq Value

1 0 0 0 0 1 0 10 1 0 1 0 1 1 0

0 1 0 0 0 0 1 1…

1 1 0 1 0 1 0 10 0 0 1 0 1 1 0

0 1 0 0 0 0 1 0

Frequent Value Map

• Speculation targeted only for frequent value blocks

• Overhead– 1 frequent value map bit

per encrypted block (128 bits)

– 8 bits per cache line (64B cache line size)

– 512 bits per page– Total 64K bits for 128-enry

• Can be shared for many other purposes – frequent value based cache

compression– power saving cache

Cache line FV bit map

Pages in TLB

Frequent Value Map for All TLB Pages

0 1 0 1 0 1 0 11 0 0 1 0 1 1 0

0 0 0 1 0 1 1 0

MAC Speculation Speculated

Encrypted Block

Memory FetchMACSpeculation

Comparison

SpeculatedEncrypted Block

MACSpeculation

Comparison Comparison Comparison

• Compute MAC for speculated frequent value blocks

• Compare

• fetched encrypted block with speculated encrypted block

• fetched MAC with speculated MAC

• If both match, issue the fetched instruction/data

Experimental Setup

Parameters Value

L1 I/D Cache DM, 16KB

L2 Cache 4way, unified, 256KB and 1MB

Memory Bus 8B wide, 1:4, 1:5, 1:6 Ratio

CPU Clock 1GHz

L1 Latency 1 cycle

L2 Latency 8 cycles (1MB), 4 cycles (256KB)

TDES Decryption Latency 96ns

AES Decryption Latency 65ns

Block Size 64-bit (Triple DES), 128-bit (AES)

Results – Value PredictionIPC Speedup L2=256KB

1.051.1

1.151.2

1.251.3

crafty

facerec

galgel

parser

sixtrack

vortex

average

IPC Speedup L2=1MB

1.151.2

crafty

facerec

galgel

parser

sixtrack

vortex

average

Performance ― Number of Frequent Values

• 64-bit block size

IPC Speedup L2=256KB

crafty

sixtrack

8_freq_values 16_freq_values 32_freq_values

Sensitivity to Memory SpeedIPC Speedup, L2=256KB, Ratio=1:4

1.11.15

1.21.25

1.31.35

crafty

sixtrack

IPC Speedup, L2=256KB, Ratio=1:6

1.11.15

1.21.25

1.31.35

crafty

sixtrack

Conclusion

• Frequent value speculation can hide both• Decryption latency• Integrity verification latency• For direct memory block ciphers

• Encrypted values demonstrate predictability.

• We propose block re-ordering to consolidate the predictability

• Memory-bound benchmark programs show 10%- 30% performance improvement.

Thank You!

Georgia TechECE MARS Labshttp://arch.ece.gatech.edu

Accelerating Memory Decryption and Authentication With Frequent Value Prediction Weidong...

Documents

An Integrated Framework for Dependable and Revivable Architecture Using Multicore Processors Weidong ShiMotorola Labs Hsien-Hsin “Sean” LeeGeorgia Tech

Data Decryption & Password Recovery

Mrinmoy Ghosh 1 CoolPression: A Hybrid Significance Compression Technique for Reducing Energy in Caches Mrinmoy Ghosh Weidong Shi Hsien-Hsin (Sean) Lee

Hsin Hsin Ming[1]

Basic Encryption and Decryption

Basic Encryption Decryption Chapter 2

Data Encryption Decryption

Succint Filterable Decryption

Wang Weidong

Secure Blind Decryption

128-bit AES decryption

Eslite hsin chu

Image encryption and decryption

Automating Malware Detection by Inferring Intent · Automating Malware Detection by Inferring Intent Weidong Cui ... Automating Malware Detection by Inferring Intent by Weidong Cui

Hsin - Hsin Ming - holybooks-lichtenbergpress.netdna … · The Hsin Hsin Ming ... even an attachment to enlightenment is to go astray. ... one instant is eternity. Not here, not

HRM_Jia Hsin

Encrption Decryption

Improving Object-Based Land Use/Cover Classification from ...gis.geog.uconn.edu/weidong/Publications/WangW_Land_2018.pdf · Wenjie Wang ID, Weidong Li ID, Chuanrong Zhang * ID and

Decryption Method: Times Cipher - Mathematicsms.uky.edu/~csima/ma111/CodesLecture8.pdf · Decryption Method: Times Cipher Deﬁnition (Decryption: Times Cipher) An English Language

148816 3041 Encryption Decryption Project