Inline Memory Encryption Circuit for DRAM Security

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional NVM modules face security issues due to the management processor's access to unencrypted DRAM contents during data transfer to persistent storage, and there is a risk of data leakage through probing lines between the management processor and the external NVM controller.

Innovation Solution

Implementing an inline memory encryption (IME) circuit within the memory module to encrypt data streams before storing them in DRAM, ensuring that only encrypted data is accessible by the management processor during transfers to persistent storage, thereby maintaining data security and preventing leakage.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If the management processor accesses DRAM contents during data transfer to persistent storage, then data transfer functionality is enabled, but security is compromised due to exposure of unencrypted data

Engineering Contradiction:

Improvedata transfer functionalityVSAvoiddata leakage risk

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The system performs encryption of DRAM contents before the management processor accesses them during data transfer. The encryption is established in advance so that when the management processor needs to access data for transfer to persistent storage, only encrypted data is available, preventing any exposure of unencrypted data while maintaining transfer functionality

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

An encryption layer is introduced as an intermediary between the DRAM and the management processor. This encryption mechanism acts as a mediator that allows the management processor to access and transfer data while ensuring that the data remains encrypted throughout the process, thus enabling functionality while preventing data leakage

Inventive Principle:

Principle #24Intermediary (Mediator)

2Object-affected harmful factors

If DRAM contents are encrypted before storage, then security is improved, but access and transfer operations become more complex

Engineering Contradiction:

Improvedata securityVSAvoidencryption operation complexity

Core Design Contradiction:

Object-affected harmful factorsVSDevice complexity

Solution Approach 1:

The encryption functionality is merged with the existing DRAM and management processor operations. The encryption is integrated into the data path such that encryption and decryption operations are combined with read and write operations, reducing the need for separate complex encryption handling while maintaining security

Inventive Principle:

Principle #5Merging (Combining)

Solution Approach 2:

The system performs self-service encryption where the encryption and decryption operations are automatically handled by the system components themselves. The management processor and memory controller automatically encrypt/decrypt data as it is accessed and transferred, eliminating the need for external or manual encryption management and reducing operational complexity

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS12327042B2Securing dynamic random access memory (DRAM) contents to non-volatile in a persistent memory module

Publication Date: 2025.06.10 RAMBUS INC

AI summary

Technologies for securing dynamic random access memory contents to non-volatile memory in a persistent memory module are described. One persistent memory module includes an inline memory encryption (IME) circuit that receives a data stream from a host, encrypts the data stream into encrypted data, and stores the encrypted data in DRAM. A management processor transfers the encrypted data from the DRAM to persistent storage memory responsive to a signal associated with a power-loss or power-down event.