Memory Encryption Engine for Low-Latency Secure Data Transfer
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing memory devices lack efficient data security protection mechanisms, particularly for cache data transferred to storage media, leading to latency overheads in CPU-based encryption/decryption solutions.
Innovation Solution
Incorporating encryption/decryption engines within the memory device to securely transfer data between cache and storage media, minimizing latency by performing encryption/decryption operations independently of the host CPU.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If CPU-based encryption/decryption is used to protect cache data, then data security is improved, but latency overhead increases
Solution Approach 1:
The encryption and decryption functions are extracted from the host CPU and relocated to dedicated hardware engines within the memory device. This separation allows the CPU to continue executing other operations while encryption/decryption occurs independently in the memory device, thereby maintaining data security without incurring CPU latency overhead.
Solution Approach 2:
Dedicated encryption and decryption engines are introduced as intermediary components between the cache media and storage media within the memory device. These intermediary engines handle the security-critical operations locally, eliminating the need for CPU intervention and reducing the time penalty associated with CPU-based cryptographic operations.
2Reliability
If encryption/decryption operations are performed on the host CPU, then data security is improved, but CPU productivity decreases
Solution Approach 1:
The computationally intensive encryption and decryption operations are extracted from the host CPU and assigned to dedicated hardware engines in the memory device. This extraction enables the CPU to maintain high productivity by avoiding involvement in cryptographic operations, while data security is preserved through the specialized security engines.
Solution Approach 2:
The memory device becomes self-sufficient by incorporating its own encryption and decryption capabilities. The device performs security operations independently without requiring host CPU resources, thereby maintaining both data security and CPU productivity simultaneously.
3Adaptability or versatility
If multiple encryption algorithms are supported, then adaptability is improved, but device complexity increases
Solution Approach 1:
The encryption and decryption engines are designed with multi-functionality to support multiple encryption algorithms (e.g., AES, DES, 3DES). This universal design allows the same hardware infrastructure to perform various cryptographic operations, enhancing adaptability while managing complexity through shared components and standardized processing pipelines.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
In some aspects, a device may include at least one circuit including an encryptor and a decryptor; memory media; and storage media, where the encryptor and decryptor are configured between the memory media and storage media; and the at least one circuit is configured to perform one or more operations including receiving at least a portion of data; encrypting, using the encryptor, the at least a portion of data as encrypted data; and storing, to the storage media, the encrypted data. In some aspects, the at least one circuit is further configured to perform one or more operations including receiving, from the storage media, the encrypted data; decrypting, using the decryptor, the encrypted data as decrypted data; and sending the decrypted data.