Deterministic Encryption Deduplication for Secure Memory
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional secure memory encryption techniques are inefficient due to high overhead in storing initialization vectors and message authentication codes, particularly when encrypting or decrypting data at the granularity of cache lines, making them vulnerable to attacks and resource-intensive.
Innovation Solution
A system that implements deduplicated, encrypted data content using a Hierarchical Immutable Content Addressable Memory Processor (HICAMP) with a memory controller and encryption/decryption engine, which supports efficient encryption and decryption of memory line units by using deterministic encryption and a content directory-based deduplication technique, minimizing latency and overhead.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional stream encryption is used with initialization vectors, then data confidentiality is improved, but space overhead and processing latency increase significantly
Solution Approach 1:
The patent extracts the initialization vector requirement entirely by using deterministic encryption. Instead of adding IVs to conventional encryption, the invention removes the need for IVs by encrypting data blocks in deterministic order based on their physical memory addresses, thereby eliminating the space overhead associated with storing and managing IVs while maintaining confidentiality through the deterministic encryption process
Solution Approach 2:
The patent changes the encryption parameter from probabilistic (requiring IVs) to deterministic. By using the physical memory address as the encryption input along with a secret key, the system transforms the encryption process into a deterministic operation that produces consistent ciphertext for the same plaintext location, eliminating the need for IVs and their associated space overhead
2Productivity
If encryption is performed at cache line granularity, then processing efficiency is improved, but overhead for initialization vectors and message authentication codes increases
Solution Approach 1:
The patent removes the need for per-block IVs and MACs by using deterministic encryption based on physical memory addresses. This extraction of the IV/MAC requirement allows cache line-granularity encryption to proceed without the overhead that would normally accompany each encryption operation, maintaining processing efficiency while reducing total overhead
Solution Approach 2:
The patent makes the encryption system universal across different memory granularities by using a unified deterministic encryption approach. The same encryption mechanism works whether encrypting cache lines, pages, or larger blocks, eliminating the need for different overhead structures at different granularities and allowing efficient operation at cache line level without proportionally increasing overhead
3Quantity of substance
If deduplication is implemented on encrypted data, then storage efficiency is improved, but frequency analysis attacks become more difficult to detect
Solution Approach 1:
The patent introduces asymmetry between the encryption process and the deduplication process. Encryption is performed deterministically based on physical memory addresses before deduplication, creating an asymmetric relationship where the encryption key remains secret while the deduplication structure can be exposed. This asymmetry allows deduplication to improve storage efficiency while the secret key protects against frequency analysis attacks on the deduplicated structure
4Duration of action of stationary object
If non-volatile random access memory is used, then data persistence is improved, but vulnerability to attacks requiring less effort increases
Solution Approach 1:
The patent applies preliminary anti-action by encrypting data in NVRAM before it becomes vulnerable to attacks. The deterministic encryption is performed on the data while it is being written to or resides in NVRAM, creating a preemptive security layer that protects the persistent data from attacks such as cold boot attacks or direct memory extraction, thereby allowing NVRAM to provide data persistence without the associated vulnerability increase
Data Source
Figure 1
Figure 2A~2B
Figure 3
AI summary
Providing data security includes: in response to a request to write data content to a storage, generating encrypted data content based on the data content; attempting to obtain a reference to the encrypted data content in the storage; in the event that the reference to the encrypted data content is obtained, modifying a translation line to refer to the reference to the encrypted data content in the storage; and in the event that the reference to the encrypted data content is not obtained: storing the encrypted data content at a new location; obtaining a reference to the encrypted data content stored at the new location; and modifying the translation line to refer to the reference to the encrypted data content stored at the new location.