With physical access, instructions and data are vulnerable to inspection and modification as they get loaded from external memory and storage. Physical attacks such as bus snooping, memory interposing, side channel analysis, and cold boot; which enable these vulnerabilities, have proliferated—to the point that hobbyists can now perform them using consumer-grade equipment. The authentication and encryption provided by HMG mitigates these physical attacks by ensuring that loaded instructions are authentic and that data remains confidential through its entire lifecycle.
Helios Memory Guard (HMG) is shimmed in between the processor and memory controller to provide just-in-time encryption, decryption, and authentication for all memory write and read requests. This is done per cache line—in hardware—using ephemeral keys that roll on every write. HMG also performs decryption and authentication of boot/load-time images that have been encrypted by the Helios Packager prior to deployment. The user maintains full ownership and management of the load-time keys.
