BMC Flash Encryption with Hardware-Bound Keys and Fast Control Access

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing server systems face security vulnerabilities due to unauthorized access to sensitive BMC and BIOS firmware and data during decommissioning, as these components are often overlooked and can be easily extracted from discarded flash memory chips, compromising the security of entire datacenters.

Innovation Solution

Implementing a stream cipher-based encryption mechanism within the BMC to encrypt and decrypt data streams to and from storage, using unique keys derived from hardware identifiers, while allowing control commands to bypass encryption to minimize latency and processing load.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If encryption is applied to all data in flash memory, then security is improved, but processing latency increases

Engineering Contradiction:

ImprovesecurityVSAvoidprocessing latency

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent applies different encryption treatments to different regions of flash memory: control commands are stored in an unencrypted first region for fast access, while sensitive data is stored in an encrypted second region. This local differentiation resolves the contradiction by providing both fast unencrypted access for control operations and secure encrypted storage for sensitive data.

Inventive Principle:

Principle #3Local quality

2Reliability

If encryption is applied to all data in flash memory, then security is improved, but device complexity increases

Engineering Contradiction:

ImprovesecurityVSAvoiddevice complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The flash memory is divided into distinct encrypted and unencrypted regions, with separate management for control commands and data. This segmentation simplifies the encryption implementation by allowing the controller to handle different types of data differently, reducing overall system complexity compared to encrypting everything uniformly.

Inventive Principle:

Principle #1Segmentation

3Reliability

If encryption is applied to control commands, then security is improved, but processing speed decreases

Engineering Contradiction:

ImprovesecurityVSAvoidprocessing speed

Core Design Contradiction:

ReliabilityVSSpeed

Solution Approach 1:

Control commands are stored in an unencrypted region of flash memory, allowing the BMC to read and execute them without decryption overhead. This local exemption for control commands resolves the contradiction by maintaining high processing speed for time-critical operations while still providing security for sensitive data regions.

Inventive Principle:

Principle #3Local quality

Data Source

PatentUS12608322B2Techniques of encrypting BMC and bios firmware and data in flash memory

Publication Date: 2026.04.21 AMERICAN MEGATRENDS

AI summary

In an aspect of the disclosure, a method, a computer-readable medium, and an apparatus are provided. The apparatus is a BMC. The BMC receives data to be written to a storage. The BMC encrypts the data using a stream encrypt engine to generate encrypted data. The BMC writes the encrypted data to the storage. The BMC receives encrypted data read from the storage. The BMC decrypts the encrypted data using a stream decrypt engine to generate decrypted data. The BMC provides the decrypted data to a component of the BMC.