Address-Based Memory Encryption Using Region-Specific Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer systems face significant security vulnerabilities due to the potential for hackers to access and exploit data stored in system memory, particularly in non-volatile random access memory (NVRAM), which retains data even when power is interrupted.
Innovation Solution
A memory encryption and decryption technology (MET) is implemented in processors, where keys for encryption and decryption are selected based on the system memory's address, using multiple keys to alternately encrypt and decrypt data, ensuring that the keys are securely stored within the hardware and not exposed to software.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If plaintext is stored in system memory for easy access and operation, then ease of operation is improved, but security is worsened due to potential hacker attacks
Solution Approach 1:
The system memory is divided into multiple memory regions, each associated with a different key. This segmentation allows different encryption keys to be applied to different portions of memory, enabling selective encryption that maintains accessibility for authorized operations while protecting sensitive data from unauthorized access.
Solution Approach 2:
Different memory regions are assigned different security characteristics through the use of region-specific keys. The root cause value in the address determines which key to use, creating local quality variations in security protection across the memory space, allowing critical areas to be heavily protected while less sensitive areas remain more accessible.
2Device complexity
If a single key is used for encryption across the entire system memory, then device complexity is reduced, but security is worsened due to potential key compromise
Solution Approach 1:
Instead of using a single key for the entire memory space, the system segments the key set into multiple region-specific keys. The key selection is automatically determined by the root cause value of the memory address, providing distributed key management that reduces security vulnerability without requiring complex external key management infrastructure.
Solution Approach 2:
The system performs self-service key selection based on the memory address itself. The root cause value embedded in the address automatically determines which key to use for encryption/decryption operations, eliminating the need for external key management systems and reducing overall device complexity while maintaining enhanced security.
3Object-affected harmful factors
If encryption is applied to all system memory operations, then security is improved, but processing speed is worsened due to additional encryption/decryption overhead
Solution Approach 1:
The encryption/decryption function is extracted and integrated directly into the memory control logic. By incorporating the encryption/decryption capability within the memory controller itself, the patent eliminates the need for separate processing steps, allowing security operations to occur in parallel with memory access operations and minimizing speed penalty.
Solution Approach 2:
The encryption/decryption function is merged with the memory control logic. The key selection and encryption/decryption operations are combined with the existing memory read/write control pathways, allowing security processing to occur simultaneously with data transfer operations rather than as separate sequential steps.
Data Source
AI summary
A computer system with data encryption and decryption on system memory is shown. The computer system has a system memory storing data, and a processor coupled to the system memory. The processor has key registers storing multiple keys. Based on the access address on the system memory, the processor selects a target key from the key registers, to apply the target key to perform data encryption and decryption on the system memory.