Encrypted Enclave Validation Against Platform NV Storage Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Information handling systems are vulnerable to attacks on non-volatile storage due to open access to system NV memory, which can lead to malicious or inadvertent access, damaging critical data and hogging processor resources.
Innovation Solution
An Encrypted Enclave NV Virtual Store (ENVS) manager intercepts and validates Get/Set calls to system NV memory using a safe list, trust authentication protocol, and AI-ML engine to ensure only valid calls are executed, discarding or ignoring invalid ones.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If open access to system NV memory is provided, then ease of operation is improved, but reliability deteriorates due to vulnerability to attacks
Solution Approach 1:
The patent introduces an intermediary validation layer between access requests and system NV memory. The validation mechanism checks each Get/Set call against a safe list and uses AI-ML engine evaluation to determine whether to allow or block access, thus mediating between open access requirements and security needs
2Reliability
If validation mechanisms are added to protect system NV memory, then reliability is improved, but device complexity increases
Solution Approach 1:
The patent implements preliminary action by pre-establishing a safe list of authorized access patterns and pre-training AI-ML models before deployment. This allows the system to quickly evaluate access requests without complex real-time analysis, reducing operational complexity while maintaining high reliability
3Reliability
If all access requests are processed and validated, then reliability is improved, but productivity decreases due to processing overhead
Solution Approach 1:
The patent applies partial action by implementing a tiered validation approach where commonly authorized access patterns from the safe list are processed quickly with minimal validation, while only suspicious or unauthorized requests undergo full AI-ML engine evaluation. This partial validation strategy maintains security while improving overall processing throughput
Data Source
AI summary
An information handling system includes a processor, a permanent data storage device, and a non-volatile data storage device. The processor receives a request to store an object to the non-volatile data storage device, stores the object to a secure portion of the permanent data storage device, and evaluates the request to determine whether or not the request is valid. When the first request is valid, the processor transfers the object from the secure portion of the permanent data storage device to the non-volatile data storage device. When the first request is not valid, the processor ignores the request and discards the object.