Memory Expansion Encryption for Multi-Tenant Data Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing memory expansion devices with non-volatile storage face security risks due to unauthorized access, especially in multi-tenant environments, and existing encryption methods by the CPU add processing complexity, affecting performance.
Innovation Solution
A memory expansion device with integrated encryption and decryption engines divides memory regions using multiple keys, encrypting data transparently based on region and criteria, ensuring secure access control without burdening the host CPU.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the CPU performs encryption on data before storing it in non-volatile memory, then data security is improved, but processing complexity and computational load increase
Solution Approach 1:
The encryption function is extracted from the CPU and relocated to a dedicated encryption engine within the memory device. This separation allows the CPU to offload the computationally intensive encryption operations, reducing processing complexity while maintaining data security. The encryption engine operates independently within the memory device, handling encryption/decryption transparently without burdening the host CPU.
Solution Approach 2:
An encryption engine is introduced as an intermediary component between the CPU and non-volatile memory. This intermediary handles all encryption and decryption operations, shielding the CPU from computational complexity while ensuring data security. The encryption engine acts as a dedicated mediator that processes data between storage and computation, resolving the contradiction between security and processing simplicity.
2Reliability
If multiple keys are used to divide memory regions for different virtual machines, then security isolation between tenants is improved, but key management complexity increases
Solution Approach 1:
The non-volatile memory is segmented into multiple isolated regions, each protected by a dedicated encryption key and associated with a specific virtual machine. This segmentation enables strong security isolation between tenants while the encryption engine automatically manages key selection based on the memory region being accessed, preventing unauthorized cross-tenant access without requiring complex manual key management.
Solution Approach 2:
The encryption engine implements self-service key management by automatically selecting the appropriate encryption key based on the memory region identifier. When data is stored or retrieved from a specific region, the engine autonomously identifies and applies the corresponding key without external intervention. This automation reduces key management complexity while maintaining robust security isolation across multiple virtual machines.
3Speed
If non-volatile memory is presented as volatile memory to the host, then access speed is improved, but security protection is reduced
Solution Approach 1:
The memory device implements local quality by applying encryption selectively at the region level rather than globally. Each memory region maintains its own encryption key and security parameters, allowing the system to provide security protection where needed (in non-volatile storage) while maintaining fast access characteristics when data is cached in volatile memory portions. This localized approach resolves the contradiction between speed and security by applying protection only where persistence is required.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Systems and methods for securing data in a memory device are described. The memory device may be coupled to a computing device (102) and may comprise a volatile storage medium (120), a non-volatile storage medium (122), and a processor configured to communicate with the volatile storage medium (120) and the non-volatile storage medium (122). The processor may be configured to: store one or more keys; receive data from the computing device (102); identify a first key of the one or more keys associated with the data; encrypt the data based on the first key; output encrypted data; and store the encrypted data in the non-volatile storage medium (122).