Memory Controller Self-Encryption Key Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Non-volatile memory devices pose security risks due to their ability to retain data even when power is shut off, necessitating measures for secure data storage and transfer, especially in high-capacity data storage systems used by sensitive information holders.
Innovation Solution
Implementing a memory controller with self-encryption capabilities, where a security key is generated based on a host key and a characteristic key, stored in volatile memory, and used for encrypting and decrypting data, with the option to change the characteristic key and sanitize the security key storage unit in case of power abnormalities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If non-volatile memory devices are used for high-capacity data storage, then data storage capacity is improved, but security risk increases due to data retention capability
Solution Approach 1:
The patent introduces an encryption key as an intermediary between the stored data and its readable form. The data in non-volatile memory is encrypted using a key that is not stored in the same memory device, creating a security barrier that prevents unauthorized access even when the memory is physically accessed, thus resolving the security risk while maintaining high storage capacity
Solution Approach 2:
The patent segments the security system into two separate components: the encrypted data stored in non-volatile memory and the encryption key stored externally. This segmentation ensures that even if the memory device is compromised, the data remains protected without the key, while still allowing full utilization of the memory's storage capacity
2Reliability
If encryption is implemented in memory controllers, then data security is improved, but device complexity increases
Solution Approach 1:
The memory controller is designed with self-service encryption capabilities, automatically performing encryption and decryption operations without requiring external intervention. The controller generates and manages encryption keys internally and applies encryption to data before writing to non-volatile memory and automatically decrypts upon reading, thereby improving security while minimizing the impact on device complexity through automation
Solution Approach 2:
The patent merges the encryption function directly into the memory controller, combining data processing and security functions in a single integrated unit. This integration allows the controller to perform both memory management and encryption/ decryption operations, improving security while avoiding the need for separate encryption hardware that would increase overall system complexity
3Object-affected harmful factors
If security key is stored in volatile memory, then security against physical access is improved, but reliability under power abnormalities deteriorates
Solution Approach 1:
The system performs preliminary actions by detecting power abnormalities before they result in data loss. When a power anomaly is detected, the controller proactively executes backup operations to transfer the security key from volatile to non-volatile memory, ensuring the key is preserved even though it was originally stored in volatile memory for security reasons
Solution Approach 2:
The patent implements a cushioning mechanism by maintaining the ability to restore the security key in non-volatile memory as a backup. This prior cushioning ensures that even if power loss occurs and the volatile memory is cleared, the system can recover the key from non-volatile storage, thus protecting against both physical access threats and power abnormality risks
Data Source
AI summary
An operating method of a memory controller may include: enabling a security mode in response to a first command received from a host; generating a security key based on a host key received from the host; storing the security key in a security key storing unit; and/or performing a first data processing operation of encrypting data received from the host and decrypting data stored in a non-volatile memory device, based on the security key, when the security mode is enabled. The security key storing unit may be a volatile memory.