Edge Cloud Data Protection Bypassing Encryption Logic
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current edge cloud data protection systems face high CPU and memory overheads due to multiple decryption-encryption cycles, especially in multi-tenant environments, leading to increased latency and inefficiencies, particularly when handling IoT data that requires secure storage and processing.
Innovation Solution
The solution unifies Multi-Key Total Memory Encryption (MKTME) protection with Transport Layer Security (TLS)/Secure Sockets Layer (SSL) transport security, using ephemeral private keys provisioned by a key server to enable direct storage of encrypted data, bypassing unnecessary decryption and re-encryption steps, and leveraging hardware-based encryption to minimize CPU and memory usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple decryption-encryption cycles are performed for data protection in edge cloud environments, then data security is improved, but CPU overhead and memory overhead increase significantly
Solution Approach 1:
The patent extracts the encryption/decryption operations from the main data processing flow and performs them in parallel using multiple CPU cores. By taking out these security-critical operations and executing them concurrently rather than sequentially, the system maintains strong data protection while distributing the CPU overhead across multiple cores, thereby reducing the burden on any single core and improving overall processing efficiency.
Solution Approach 2:
The patent performs preliminary encryption of data before it is stored in memory, and preliminary decryption of data before it is processed. By performing these security operations in advance rather than during data access, the system ensures data protection is maintained while reducing the CPU overhead during critical data processing operations. The encrypted data can be stored and transferred without requiring repeated encryption/decryption cycles.
2Reliability
If multiple decryption-encryption cycles are performed for data protection, then data security is improved, but latency increases
Solution Approach 1:
The patent establishes continuous encryption and decryption sessions that remain active throughout the data processing workflow. Instead of performing discrete encryption/decryption cycles for each data access operation, the system maintains continuous security contexts that allow data to be processed without repeatedly entering and exiting encryption states. This continuity eliminates the latency overhead associated with repeated cryptographic operations while maintaining data security throughout the processing pipeline.
Solution Approach 2:
The patent performs preliminary decryption of encrypted data into a secure working format before processing begins, and maintains this decrypted state throughout the processing workflow. By performing the decryption action in advance and maintaining continuous access to the decrypted data through secure memory regions, the system eliminates the need for repeated decryption operations during processing, thereby reducing latency while preserving data security through controlled access to the decrypted state.
3Reliability
If traditional encryption methods are used for data protection, then security is achieved, but memory overhead increases due to multiple encryption contexts
Solution Approach 1:
The patent implements a universal encryption context that can be shared across multiple CPU cores and processing operations. Instead of creating separate encryption contexts for each core or operation, the system establishes a single cryptographic context that serves multiple functions and multiple processing units simultaneously. This universal context reduces memory overhead by eliminating redundant encryption state storage while maintaining security across all processing operations through shared cryptographic parameters and keys.
Solution Approach 2:
The patent merges multiple encryption operations into a unified cryptographic processing framework that handles multiple data streams and processing contexts simultaneously. By combining separate encryption contexts into a single integrated security subsystem that manages multiple operations concurrently, the system reduces the total memory required for encryption state storage while maintaining the security properties of each individual operation through proper isolation and key management within the unified framework.
Data Source
AI summary
An embodiment of a semiconductor apparatus may include technology to receive data with a unique identifier, and bypass encryption logic of a media controller based on the unique identifier. Other embodiments are disclosed and claimed.