Abstract: Data stored in a memory circuit may be encrypted using client keys that need to be available for high-speed data processing and yet held securely to avoid unauthorized access to the encrypted data. A secure processor circuit in a processor-based system obtains client keys associated with client applications and generates secure key-encryption keys that are used to encrypt the client keys so the client keys can be securely stored in the memory circuit. In some examples, data keys for encrypting data blocks associated with the client application may be generated from the client key, encrypted by a data key-encryption key generated in the secure processor circuit, and stored in the memory circuit. In such examples, because the client keys and data keys are encrypted while in memory, they are safer from software attacks on the memory circuit, which improves the security of the encrypted data blocks.

Abstract: Data stored in a memory circuit may be encrypted using client keys that need to be available for high-speed data processing and yet held securely to avoid unauthorized access to the encrypted data. A secure processor circuit in a processor-based system obtains client keys associated with client applications and generates secure key-encryption keys that are used to encrypt the client keys so the client keys can be securely stored in the memory circuit. In some examples, data keys for encrypting data blocks associated with the client application may be generated from the client key, encrypted by a data key-encryption key generated in the secure processor circuit, and stored in the memory circuit. In such examples, because the client keys and data keys are encrypted while in memory, they are safer from software attacks on the memory circuit, which improves the security of the encrypted data blocks.

Abstract: An exemplary memory interface circuit disclosed herein re-encrypts data in an encrypted data block in a memory circuit to further protect the data. In particular, the memory interface circuit reads an encrypted data block from the memory circuit and decrypts the encrypted data block using a first key that was previously used to encrypt the block of data. Then, the memory interface circuit encrypts the data again using a second key before storing the re-encrypted data back into the memory circuit. In some examples, the memory interface circuit includes a re-encryption circuit that includes secure configuration registers to control occasional re-encryption of the encrypted data in an effort to evade detection of the encryption key. In some examples, the time between re-encryptions may be adjusted in response to a frequency of memory accesses to the memory circuit.

Abstract: Data stored in a memory circuit may be encrypted using client keys that need to be available for high-speed data processing and yet held securely to avoid unauthorized access to the encrypted data. A secure processor circuit in a processor-based system obtains client keys associated with client applications and generates secure key-encryption keys that are used to encrypt the client keys so the client keys can be securely stored in the memory circuit. In some examples, data keys for encrypting data blocks associated with the client application may be generated from the client key, encrypted by a data key-encryption key generated in the secure processor circuit, and stored in the memory circuit. In such examples, because the client keys and data keys are encrypted while in memory, they are safer from software attacks on the memory circuit, which improves the security of the encrypted data blocks.

Abstract: Systems and methods for adaptive backtracking depth limit for non-deterministic finite automaton implementations are provided. A method includes, as part of a match attempt between a regular expression (regex) pattern and a payload, a non-deterministic finite automaton (NFA) instance executing instructions for an NFA graph having a plurality of nodes linked via arcs indicative of transitions among states of the NFA instance. The method further includes during execution of the instructions for the NFA graph, using a backtrack-depth counter counting a number of times a current state of the NFA graph has been previously visited during the match attempt between the regex pattern and the payload. The method further includes, upon the backtrack-depth counter for the NFA instance reaching or exceeding an adaptive backtracking depth limit for the NFA instance, terminating the match attempt between the regex pattern and the payload.