Key Encryption Handling for NVDIMM Security

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing memory sub-systems face challenges in securely managing encryption keys, particularly in protecting access encryption keys from hacking attempts and ensuring data integrity in non-volatile dual in-line memory modules (NVDIMM) used in enterprise class server systems.

Innovation Solution

The implementation of a key encryption handling mechanism that encrypts access encryption keys, stores them in non-volatile memory, and transitions between secure states using an encrypted media encryption key, employing algorithms like PBKDF2 and AES-XTS for secure key generation, wrapping, and unwrapping, ensuring the keys are statistically un-hackable and protected from unauthorized access.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Duration of action of stationary object

If access encryption keys are stored in non-volatile memory for persistence, then key availability is improved, but key vulnerability to hacking increases

Engineering Contradiction:

Improvekey availabilityVSAvoidkey vulnerability to hacking

Core Design Contradiction:

Duration of action of stationary objectVSObject-affected harmful factors

Solution Approach 1:

The encryption key hierarchy is segmented into multiple levels: media encryption keys stored in non-volatile memory and access encryption keys stored in volatile memory. This segmentation allows the system to maintain key availability through non-volatile storage while protecting against hacking by isolating the most sensitive keys in volatile memory that are erased on power loss.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

A key encryption handling component acts as an intermediary between the volatile and non-volatile memory systems. This component manages the encryption and decryption of access keys using media keys, enabling secure key storage in non-volatile memory while maintaining security through the intermediary's controlled key management operations.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If encryption keys are protected from unauthorized access, then security is improved, but system complexity increases

Engineering Contradiction:

ImprovesecurityVSAvoidsystem complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The key encryption handling component performs self-service operations by automatically managing key encryption and decryption processes. The system encrypts access keys using media keys and stores them in non-volatile memory without requiring external intervention, thereby improving security while containing complexity within the self-managing component.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The complex key management functions are extracted into a dedicated key encryption handling component. This component isolates the complexity of key encryption, decryption, and storage management from the rest of the memory system, allowing the broader system to benefit from enhanced security without bearing the full complexity burden.

Inventive Principle:

Principle #2Taking out (Extraction)

3Object-affected harmful factors

If access encryption keys are stored in volatile memory for security, then key protection is improved, but key persistence is worsened

Engineering Contradiction:

Improvekey protectionVSAvoidkey persistence

Core Design Contradiction:

Object-affected harmful factorsVSDuration of action of stationary object

Solution Approach 1:

The system creates a copy of the access encryption key in non-volatile memory encrypted with a media encryption key. This copy persists after power loss, while the original volatile key is erased. The key encryption handling component manages the copying and encryption processes, enabling both security through volatile memory and persistence through non-volatile memory.

Inventive Principle:

Principle #26Copying

Data Source

PatentUS20250023727A1Key encryption handling

Publication Date: 2025.01.16 LODESTAR LICENSING GROUP LLC

AI summary

An apparatus comprises an encryption key generator to generate a media encryption key to encrypt data in number of memory components, where the encryption key generator is configured to wrap the media encryption key to generate an encrypted media encryption key, The encrypted media encryption key is stored in a non-volatile memory. The apparatus comprises firmware having instructions to transition the apparatus to and from a secure state using the encrypted media encryption key.