Memory Controller Encryption Key Generation from Physical Address
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Software-based encryption is slow and vulnerable to key exposure, while hardware encryption with processors requires costly system calls and has limited advantages due to all-or-nothing encryption settings for short-term memory.
Innovation Solution
A processor with a memory controller that generates a dynamic encryption key based on the physical address of data storage, allowing for selective encryption and decryption using an encryption path or bypass path, ensuring secure hardware encryption without exposing the key to software.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If software-based encryption is used, then encryption can be performed, but the encryption key is exposed to software making it vulnerable to attacks and the process is slow
Solution Approach 1:
The encryption key is extracted from the software domain and placed in the hardware domain (memory controller). The key is generated and used exclusively in hardware, never exposed to software, thus eliminating the vulnerability of key exposure while maintaining encryption functionality.
Solution Approach 2:
The memory controller acts as an intermediary between the software and the encryption process. Instead of software directly handling keys and encryption, the memory controller mediates by generating keys from physical addresses and performing encryption/decryption operations transparently to the software.
2Productivity
If hardware encryption is used, then encryption speed is improved and key security is enhanced, but system calls are required making the process costly
Solution Approach 1:
The memory controller performs encryption and decryption operations autonomously without requiring software intervention or system calls. The hardware automatically generates keys from physical addresses and encrypts/decrypts data in the data path, making the system self-sufficient for encryption tasks.
Solution Approach 2:
The encryption functionality is merged with the memory controller, combining memory management and encryption operations into a single hardware component. This integration eliminates the need for separate system calls and allows encryption to occur transparently in the data path.
3Reliability
If all data in memory is encrypted, then security is improved, but data must be decrypted before storage increasing processing overhead
Solution Approach 1:
Different encryption treatments are applied to different data locations based on their destination. Data destined for persistent storage is encrypted with persistence keys, while data remaining in volatile memory uses different key management. This localized approach avoids unnecessary decryption operations.
Solution Approach 2:
The encryption key changes dynamically based on the physical address and destination of the data. Instead of using a static key for all data, the system generates different keys for different memory locations and persistence destinations, allowing flexible encryption/decryption decisions based on data flow.
4Ease of operation
If a static encryption key is used, then key management is simplified, but brute-force cracking becomes feasible
Solution Approach 1:
The encryption key is made dynamic by deriving it from the physical address in the memory request. Each memory location has its own unique key based on its address, making brute-force attacks infeasible while the memory controller automatically manages these dynamic keys without software intervention.
Solution Approach 2:
The key parameter changes based on the physical address parameter. Instead of a fixed key, the system derives the encryption key from variable address parameters, ensuring that each data location has a unique key that changes with its storage location.
Data Source
AI summary
Embodiments herein describe a memory controller that has an encryption path and a bypass path. Using an indicator (e.g., a dedicated address range), an outside entity can inform the memory controller whether to use the encryption path or the bypass path. For example, using the encryption path when performing a write request means the memory controller encrypts the data before it was stored, while using the bypass path means the data is written into memory without be encrypted. Similarly, using the encryption path when performing a read request means the controller decrypts the data before it is delivered to the requesting entity, while using the bypass path means the data is delivered without being decrypted.