DRAM Memory Controller Encryption Using Address-Based AES Tweaks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computer systems using DRAM memory lack data encryption, leading to potential security vulnerabilities where data stored in DRAM can be accessed by unintended virtual machines or compromised by malicious software.
Innovation Solution
Implementing a memory controller with encryption and decryption circuits that utilize block cipher encryption, such as AES, to encrypt and decrypt data in DRAM, using tweak values modified for each block to enhance security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If data is stored in DRAM without encryption, then access speed and system performance are improved, but data security and confidentiality are compromised
Solution Approach 1:
The patent applies preliminary action by encrypting data before it is written to DRAM memory. The encryption circuit processes data at the memory controller level prior to storage, ensuring that data is already protected when it enters the memory system. This allows fast unencrypted access speeds while maintaining security, as the encryption/decryption happens transparently in the background without requiring application-level intervention.
Solution Approach 2:
The patent introduces an intermediary encryption circuit and tweak value mechanism between the data and the memory storage system. This intermediary layer processes data through multiple block cipher encryption circuits with different keys and tweak values, acting as a mediator that protects data while allowing fast access. The tweak value modifies encryption based on address information, providing security without significantly impacting access speed.
2Reliability
If encryption circuits are added to the memory controller, then data security is improved, but device complexity and manufacturing cost increase
Solution Approach 1:
The patent segments the encryption function into multiple independent block cipher encryption circuits (first, second, and subsequent circuits). Each circuit processes a portion of the data using different encryption keys and tweak values. This segmentation allows the complex encryption function to be divided into manageable, modular components that can be implemented efficiently in hardware without overwhelming the memory controller's complexity.
Solution Approach 2:
The patent creates a universal encryption framework that can handle different data types, memory addresses, and security requirements through a single multi-functional encryption circuit design. The tweak value mechanism allows the same encryption infrastructure to adapt to different memory locations and data blocks, providing versatile security protection without requiring separate encryption systems for different scenarios.
3Object-affected harmful factors
If multiple encryption keys and tweak values are used for different data blocks, then security against malicious threats is improved, but processing time and computational overhead increase
Solution Approach 1:
The patent implements periodic action by systematically applying different tweak values to different data blocks based on their address information. Each memory block is encrypted with a specific tweak value derived from its address, creating a periodic pattern of encryption that provides strong security. This systematic approach allows parallel processing of multiple blocks without significant time penalty, as the tweak value generation is deterministic and can be computed efficiently during normal memory operations.
Data Source
AI summary
A memory controller includes encryption circuits for encrypting write data to be written to an address in a RAM memory. A tweak value is provided based at least on the address. The tweak value is encrypted with Advanced Encryption Standard (AES) encryption using a first key. A first block write data is encrypted by manipulating it based on the encrypted tweak value, AES encrypting with a second key, and then manipulating the result based on the encrypted tweak value again. For subsequent blocks of write data, the encrypted tweak value is modified, and a similar operation is performed.