CXL Memory Key Hierarchy for Region-Level Data Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The CXL memory protocol lacks data encryption and protection for stored data, posing a security risk, despite supporting data encryption and protection during transmission between communication links.
Innovation Solution
A key management method generates a data key and an independent protection key for each CXL memory region based on device identification and address information, using a system root key and random numbers to ensure each region's keys are unique, enhancing security by isolating the data key from the system root key.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data encryption is implemented for CXL memory regions, then data security is improved, but key management complexity increases
Solution Approach 1:
The patent segments the key management system into distinct components: a key manager that generates and protects keys, and a CXL memory controller that uses the keys for encryption. The memory space is segmented into multiple CXL memory regions, each with its own unique data key and protection key, isolating security risks to individual regions rather than affecting the entire system.
Solution Approach 2:
The patent introduces a key manager as an intermediary component between the system root key and the data keys. The key manager generates protection keys from the system root key, then generates data keys from the protection keys. This intermediary layer prevents direct exposure of the system root key while still enabling encryption across multiple memory regions.
2Reliability
If a unique protection key is generated for each CXL memory region, then security isolation between regions is improved, but key generation and management overhead increases
Solution Approach 1:
The patent performs preliminary key generation actions by creating protection keys in advance for each CXL memory region during system initialization. The key manager generates these protection keys from the system root key before data storage operations begin, so that when data needs to be encrypted, the protective key infrastructure is already in place and ready to use.
Solution Approach 2:
The system root key serves multiple functions: it is used to generate protection keys for multiple different CXL memory regions, and each protection key in turn generates data keys for encryption. This multi-functional approach allows a single master key to secure the entire system while maintaining isolation between regions through the hierarchical key derivation process.
3Device complexity
If the system root key is used directly to encrypt data, then key management is simplified, but system security is compromised if the data key is compromised
Solution Approach 1:
The patent implements a nested key structure where the system root key is at the top level, protection keys are nested within it, and data keys are nested within protection keys. Each layer of encryption is contained within the previous layer, creating a nested hierarchy where compromise of the outermost data key does not expose the inner protection key or the root system key.
Solution Approach 2:
The patent extracts the data key from direct connection to the system root key by introducing an intermediate protection key layer. The protection key is extracted as a separate entity that mediates between the root key and data encryption, allowing the system to maintain simplicity in key distribution while enhancing security through the extracted intermediate layer.
Data Source
Figure 1~3
Figure 4
Figure 5~6
AI summary
Embodiments of the present disclosure provide a key management method, a data protection method, a system, a chip, and a computer device, and the key management method includes: determining a plurality of memory regions that need to be encrypted and protected in a memory and a memory protocol of each memory region, in which the plurality of memory regions include at least one Compute Express Link (CXL) memory region based on a CXL memory protocol; determining, for each CXL memory region, a device identification and address information of the CXL memory region; generating protection key generation information of the CXL memory region according to the device identification and the address information of the CXL memory region; generating a protection key of the CXL memory region according to a system root key predetermined and the protection key generation information of the CXL memory region; generating a random number for the CXL memory region; and generating a data key of the CXL memory region according to the random number of the CXL memory region; the data key of the CXL memory region is used for encrypting and decrypting data of the CXL memory region, and the protection key is used for protecting the data key. The embodiments of the present disclosure provide a basis for enhancing the data memory security performance of the CXL memory protocol.