草榴社区

Safeguard Your Memory Interfaces by Design

Memory and storage security protects storage resources and the data stored in them, both in on-premise and external cloud data centers. As the need for higher capacity, faster access, and accelerated processing increases, designers are turning to high-performance, low-latency memory encryption solutions to preserve performance while protecting data over the latest generations of DDR, LPDDR, GDDR, and HBM memory interfaces.

Error correction code (ECC) used to be a popular protection mitigation strategy, but it only provides a limited level of resilience. ECC does not provide security as it leaves more vulnerabilities to undetected corruption, making it a naive approach to integrity protection for memories. Designers would often use ECC as a stop gap before adopting proper cryptographic algorithms.

The best approach to safeguard memory interfaces is to address the confidentiality and integrity of the data by design, with standards-based cryptography. For example, using AES-XTS encryption for data confidentiality, Rowhammer attacks can be prevented. While parity/ECC can catch 1- or 2-bit flips, encryption covers all the bits. With encryption, the data written to memories looks more like random data, and it will be nearly impossible to create Rowhammer patterns. Memory encryption and proper refresh of keys also protect against RAMBleed and cold-boot attacks. In addition to data confidentiality, security can be augmented with data authenticity that can be addressed by using strategies such as cryptographic hashing algorithms to ensure that data has not been modified by malicious actors.

Making security part of your DDR interface design from the get-go is not without its challenges. Security needs to be done right because one weak link can compromise the overall system and its data. For example, it is critical for keys to be generated and managed in a trusted/secure area of the SoC and distributed via dedicated channels to the encryption module. Readback protection of keys and control configuration also need to be part of the overall security architecture.

Another challenge is that memory encryption comes with a cost, including overhead that will impact power, performance, area (PPA), and latency. Your challenge is to make your DDR interface design secure and standards-compliant, but also highly optimal.

We’ve witnessed a rapid adoption of integrity and data encryption (IDE) security for PCI Express? (PCIe?) and Compute Express Link (CXL) interfaces, and now we are seeing a similar trajectory in memory interfaces, such as DDR and LPDDR. Since technology is ever-changing—criminals get smarter in their approaches, as the engineers design smarter solutions—whatever security strategy you choose, should enable ongoing adaptation to an evolving threat ecosystem.

Strategies for Securing DDR Interfaces in Your SoC

Here are some strategies to help you get started to secure the DDR interfaces in your SoC:

1. Design a secure infrastructure foundation, including the control plane for authentication and key management, and the data plane for data encryption and integrity.
2. Comply with Standards. For memory, data confidentiality leverages standards-based cryptographic algorithms, like AES-XTS with all key sizes, as defined by NIST SP800-38E.
3. Implement highly optimal solutions that can scale efficiently to support the latest bandwidths required for memory interfaces. Leverage pipelined architectures, with efficient tweak calculation, key refresh, and low latency. Consider optimization options, such as running multiple AES rounds in a cycle and using specific AES S-box implementations for more optimal area or maximum frequency.
4. Support per-region encryption/decryption to provide flexibility for various use cases.
5. Employ key generation and management in a secure environment. Memory encryption solutions require the control plane component for authentication and management. Typically, this is addressed by a secure enclave with root of trust. It needs to be adaptable via firmware updates to help future proof your key management strategy, including potential changes in algorithms.

One solution you might employ to secure DRAM data is to key encrypt the data prior to sending it to the DDR controller, but this is not ideal as the encryption block must manage a lot of actions to ensure that the packets are properly sized. For example, an application writes one byte of memory – the encryption block will need to read that memory location, merge in the newly written byte, and finally write it back to the memory. The farther away the encryption from the memory, the more you must manage. This will not only impact your performance budget—a costly proposition for your memory bandwidth—but you must also watch out for degradation because you are moving the data across the SoC.

The optimal solution is to tightly couple the encryption/decryption inside your DDR or LPDDR controller, allowing for maximum efficiency of the memory and lowest overall latency. The controller is as close to the memory as you can get.