Encrypting ECC Bits for Memory Integrity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computing devices remain vulnerable to attacks despite disk encryption, as clear data and keys for decryption can be accessed in system memory, and existing integrity mechanisms may occupy valuable memory space or require specialized operating systems.
Innovation Solution
Implementing the encryption of Error Correction Code (ECC) bits, which provides an additional layer of security by ensuring that data corruption can be detected and corrected, making it harder for attackers to modify encrypted data without updating ECC bits, thus enhancing memory encryption security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If disk encryption is implemented, then data storage security is improved, but system memory remains vulnerable to attacks
Solution Approach 1:
The patent segments the protection mechanism by introducing a separate encryption layer specifically for memory contents. Instead of relying solely on disk encryption, the system divides security into two independent layers: disk-level encryption for persistent storage and memory-level encryption for volatile data, thereby addressing the vulnerability gap between these two storage tiers.
Solution Approach 2:
The patent applies preliminary action by encrypting data before it is written to memory and maintaining encrypted state throughout the data's residence in system memory. This pre-encryption approach ensures that even if an attacker gains access to memory during operation, the data remains protected, preventing attacks that would otherwise exploit clear text data in RAM.
2Reliability
If integrity mechanisms are added to memory encryption, then security against corruption attacks is improved, but memory space and system complexity increase
Solution Approach 1:
The patent merges the integrity check mechanism with the existing encryption framework by using the same encryption key to protect both the data and its integrity verification structures. This combination approach eliminates the need for separate complexity-intensive integrity systems while maintaining security against corruption attacks, as the encrypted integrity checks are verified alongside the decrypted data.
Solution Approach 2:
The patent implements self-service by having the memory encryption system automatically generate and manage its own integrity verification mechanisms without requiring external or specialized operating system components. The system uses its encryption infrastructure to create and verify integrity checks, reducing overall system complexity while maintaining robust protection against corruption attacks.
3Measurement precision
If ECC bits are encrypted, then detection of data corruption is improved, but access speed may be reduced
Solution Approach 1:
The patent maintains continuity of useful action by performing integrity verification as an integrated part of the normal memory access operation rather than as a separate step. The encrypted ECC bits are decrypted and verified concurrently with the data decryption process, ensuring that corruption detection does not add significant overhead to access speed while maintaining continuous security protection.
Data Source
AI summary
Various examples are directed to systems and methods for securing a data storage device. A storage controller may receive a read request directed to the data storage device. The read request may comprise address data indicating a first address of a first storage location at the data storage device. The storage controller may request from the data storage device a first encrypted data unit stored at the first memory element and a first encrypted set of parity bits, such as Error Correction Code (ECC) bits, associated with the first storage location. An encryption system may decrypt the first encrypted set of parity bits to generate a first set of parity bits based at least in part on an a first location parity key for the first address.