Memory Expansion Encryption with Region-Specific Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
There is a need for efficient and secure data protection in memory expansion devices that utilize non-volatile memory, as existing security mechanisms can compromise CPU performance and do not adequately protect data from unauthorized access, especially in shared environments.
Innovation Solution
A memory expansion device with integrated encryption and decryption engines divides memory regions using specific keys, encrypting data transparently and securely, allowing sharing across virtual machines without adding computational burden to the host CPU.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing security mechanisms are used to protect data in memory expansion devices, then data security is improved, but CPU performance deteriorates
Solution Approach 1:
The patent divides the memory space into multiple regions, with each region assigned a unique encryption key. This segmentation allows different data to be protected with different keys, enabling selective encryption that reduces the overall computational burden on the CPU while maintaining security for sensitive regions.
Solution Approach 2:
The patent introduces a memory expansion device with integrated encryption capabilities that acts as an intermediary between the CPU and storage media. This device handles encryption and decryption operations independently, shielding the CPU from the computational overhead of cryptographic operations while ensuring data security.
2Reliability
If encryption is applied to all data in memory expansion devices, then data confidentiality is improved, but system performance deteriorates
Solution Approach 1:
The patent applies encryption selectively to specific memory regions based on their security requirements rather than encrypting all data uniformly. Each region can have different encryption characteristics, allowing critical data to be encrypted while non-sensitive data remains accessible, thus maintaining system performance while protecting confidential information.
Solution Approach 2:
The patent implements partial encryption where only portions of the memory space requiring confidentiality protection are encrypted. This partial action approach ensures that data confidentiality is maintained for sensitive regions while avoiding the performance penalty of encrypting entire memory spaces.
3Reliability
If multiple keys are used for different memory regions, then security against unauthorized access is improved, but device complexity increases
Solution Approach 1:
The memory expansion device incorporates a universal key management mechanism that handles multiple encryption keys through a unified interface. The device can automatically select and apply the appropriate key based on the memory region being accessed, providing multi-region security without requiring complex key management from the host system.
Data Source
AI summary
Systems and methods for securing data in a memory device are described. The memory device may be coupled to a computing device and may comprise a volatile storage medium, a non-volatile storage medium, and a processor configured to communicate with the volatile storage medium and the non-volatile storage medium. The processor may be configured to: store one or more keys; receive data from the computing device; identify a first key of the one or more keys associated with the data; encrypt the data based on the first key; output encrypted data; and store the encrypted data in the non-volatile storage medium.