Flash Memory Device with Integrated Encryption Engine
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing flash memory devices require external cryptographic engines and additional hardware/software for encrypting sensitive data, complicating the encryption process and increasing latency, especially in embedded systems where self-encrypting capabilities without external buses or drivers are not available.
Innovation Solution
A flash memory device with an integrated encryption engine and SRAM for data encryption/decryption, utilizing a key store and control circuitry to manage encryption keys, either user-supplied or internally generated, allowing for secure data-at-rest encryption without external components, using AES and hash algorithms for key creation and management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If external cryptographic engines and additional hardware/software are used for encrypting sensitive data, then data security is improved, but device complexity and latency increase
Solution Approach 1:
The patent combines the encryption engine, key store, and flash memory into a single integrated device. The encryption engine is embedded within the flash memory controller, eliminating the need for separate external cryptographic hardware. This merging reduces device complexity while maintaining data security through integrated encryption/decryption operations.
Solution Approach 2:
The flash memory device performs multiple functions: data storage, encryption, decryption, and key management, all within a single device. The encryption engine can operate in multiple modes (encrypting data before storage, decrypting data during retrieval), and the key store manages cryptographic keys internally. This multi-functionality eliminates the need for separate external cryptographic components.
2Reliability
If external cryptographic engines are added to encrypt sensitive data, then data security is improved, but encryption process latency increases
Solution Approach 1:
By merging the encryption engine directly into the flash memory controller, data encryption and decryption occur during the normal memory access operations. Data is encrypted before being written to the flash memory array and decrypted during read operations without requiring separate external processing steps, thereby reducing latency.
Solution Approach 2:
The encryption engine encrypts data before it is written to the flash memory during the write operation itself, rather than as a separate subsequent step. Similarly, decryption occurs during the read operation. This preliminary integration of encryption/decryption into the memory access pathway eliminates additional latency.
3Ease of operation
If self-encrypting flash memory is implemented without external buses or drivers, then ease of operation is improved, but device complexity increases
Solution Approach 1:
The encryption engine, key store, and control logic are merged into the flash memory device itself, allowing the memory to operate as a self-encrypting unit without requiring external cryptographic hardware or additional buses. The device presents a standard interface to the host system while handling encryption internally.
Solution Approach 2:
The flash memory device performs encryption and decryption operations autonomously without requiring external cryptographic engines or additional software drivers. The integrated encryption engine handles all cryptographic operations internally, and the key store manages encryption keys self-contained within the device, enabling ease of operation.
Data Source
AI summary
A flash memory system for encrypting and storing data in a non-volatile flash memory associated with a host system. The device includes flash memory, encryption engine, random number generator, cryptographic hash engine, key store, static random-access memory to interface with the host system, and associated control circuitry. When powered on, the device determines if a valid encryption key is held in the key store. If a valid key is held, a program flag is set when encrypted data in the flash memory is ready to be decrypted and stored in the static random access memory for use by the host system, or when data originating from the host system and stored in the static random access memory is ready to be encrypted by the engine and programmed into the flash memory. The device can be embedded in any host system wherein data is encrypted while at rest in memory.