Converged Cryptographic Engine for Low-Power Storage Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The presence of multiple cryptographic engines at different locations on a platform leads to unnecessary power consumption, area usage, and design complexity, particularly in systems with Non-Volatile Memory express (NVMe) drives, due to duplication of Intellectual Property blocks and increased integration complexity.
Innovation Solution
A Converged Cryptographic Engine (CCE) is introduced to combine all cryptographic engines into a single engine on the memory interface, utilizing a special instruction for encryption/decryption of data between storage devices and main memory, reducing the number of engines and integrating side channel resistance and post-quantum resistance capabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple cryptographic engines are present at different locations on a platform, then security coverage is improved, but power consumption increases
Solution Approach 1:
The patent combines multiple cryptographic engines (memory cryptographic engine and storage cryptographic engine) into a single converged cryptographic engine located at the memory interface. This consolidation maintains security coverage for both main memory and storage devices while eliminating the power consumption overhead of multiple separate engines.
Solution Approach 2:
The converged cryptographic engine is designed to perform multiple cryptographic functions (encryption and decryption) for different data paths (main memory accesses and storage device transfers). This multi-functional approach allows a single engine to replace multiple specialized engines, reducing overall power consumption while maintaining comprehensive security coverage.
2Reliability
If multiple cryptographic engines are present at different locations on a platform, then security coverage is improved, but area usage increases
Solution Approach 1:
The patent consolidates multiple cryptographic engines into a single converged cryptographic engine at the memory interface, significantly reducing the silicon area required. Instead of having separate memory cryptographic engine and storage cryptographic engine instances distributed across the platform, a single unified engine handles all cryptographic operations.
Solution Approach 2:
The converged cryptographic engine provides universal cryptographic services for both main memory and storage operations, allowing a single engine instance to perform the functions previously requiring multiple separate engines, thereby reducing overall area usage on the platform.
3Reliability
If multiple cryptographic engines are present at different locations on a platform, then security coverage is improved, but design complexity increases
Solution Approach 1:
The patent merges multiple cryptographic engines and their associated Intellectual Property blocks into a single converged cryptographic engine. This consolidation eliminates the design complexity of integrating multiple separate engines, reducing the number of IP blocks that need to be managed and the integration complexity at the system level.
Solution Approach 2:
The converged cryptographic engine provides a unified interface and control mechanism for all cryptographic operations, simplifying the design by replacing multiple specialized engine designs with a single multi-functional engine. This reduces the overall design complexity while maintaining comprehensive security coverage for both memory and storage.
4Productivity
If multiple cryptographic engines are present at different locations on a platform, then cryptographic operations can be performed in parallel, but integration complexity increases
Solution Approach 1:
The patent combines multiple cryptographic engines into a single converged engine, reducing integration complexity by eliminating the need to integrate multiple separate IP blocks. The single engine architecture simplifies the integration process while maintaining the ability to handle multiple cryptographic operations.
Solution Approach 2:
The converged cryptographic engine dynamically allocates its processing resources to handle different cryptographic operations (memory encryption/decryption and storage encryption/decryption) as needed. This dynamic resource allocation allows the single engine to maintain high throughput by efficiently managing its workload, replacing the need for static parallel engine architectures.
Data Source
AI summary
Methods and apparatus relating to a Converged Cryptographic Engine (CCE) for storage encryption are described. In an embodiment, decode circuitry decodes an instruction to determine whether Converged Cryptographic Engine (CCE) circuitry is enabled. Execution circuitry executes the instruction to program a plurality of keys in response to the CCE circuitry being enabled. The CCE circuitry performs all encryption and all decryption of data to be transferred between a memory and a storage device based at least in part on at least one of the plurality of keys. Other embodiments are also disclosed and claimed.