Ephemeral Memory Region Encryption Key Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current computing systems face inefficiencies in power-up processes due to the need to copy and restore volatile system memory from non-volatile memory devices, which is time-consuming and consumes extra power, especially when implementing sleep or hibernation states, and there is a risk of data loss in ephemeral memory regions during power loss.
Innovation Solution
A computing system that includes a non-volatile memory device with an ephemeral memory region, encrypted with an associated encryption key, and firmware to collect and reinstate the encryption key before power loss, allowing the system to maintain data accessibility and reduce the need for data copying during power state changes, thereby improving suspend and resume times and eliminating the need for flushing ephemeral NVM.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If volatile system memory is copied to non-volatile memory during power-down, then data is preserved across power cycles, but power-up time and power consumption increase
Solution Approach 1:
The memory system is segmented into volatile memory regions and non-volatile memory regions, allowing different data handling strategies. Critical system state data is selectively stored in non-volatile memory while other data remains in volatile memory, enabling faster power-up without compromising data preservation for essential components.
Solution Approach 2:
The system performs preliminary actions by identifying and storing only critical system state data in non-volatile memory before power-down, rather than copying all volatile memory contents. This preliminary selection reduces the amount of data that needs to be restored during power-up, thereby reducing power-up time while still preserving necessary system state information.
2Reliability
If all volatile memory is flushed to non-volatile memory, then data is preserved, but power consumption and processing overhead increase
Solution Approach 1:
Instead of performing the complete action of flushing all volatile memory to non-volatile memory, the system performs partial action by selectively flushing only critical system state data. This partial action reduces power consumption and processing overhead while still achieving the essential goal of preserving necessary data across power cycles.
Solution Approach 2:
Different quality levels of data preservation are applied to different memory regions. Critical system state data receives high-priority preservation treatment by being stored in non-volatile memory, while other data maintains its volatile nature. This local differentiation optimizes power consumption by avoiding unnecessary data transfers for non-critical information.
3Ease of operation
If encryption keys are stored persistently, then data accessibility is maintained after power loss, but security risk increases
Solution Approach 1:
Encryption keys are preliminarily loaded into volatile memory during system initialization or power-up, rather than being stored persistently in non-volatile memory. This preliminary loading enables fast data decryption and access when the system is powered on, while the keys are automatically cleared from volatile memory upon power loss, thereby maintaining security without compromising accessibility during operation.
Solution Approach 2:
The encryption keys are treated as disposable, short-lived objects that exist only in volatile memory during system operation. They are loaded when needed, used for decryption operations, and then discarded when power is lost or the system shuts down. This approach provides strong security (keys cannot be recovered after power loss) while maintaining ease of operation (keys are readily available during operation).
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A computing device that includes a non-volatile memory device comprising an ephemeral memory region therein, the ephemeral memory region being encrypted and comprising an associated encryption key; and firmware to cause the encryption key to be stored prior to any power loss to the computing device.