Persistent Memory Key Tables for Per-Block Encryption Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data encryption methodologies on memory devices face challenges in managing encryption keys per logical block, leading to issues with key identification and accessibility, which impact device performance.
Innovation Solution
A memory sub-system manages encryption keys per logical block using key tables with key tags and identifiers, and employs a key cache for rapid access, ensuring correct key usage and minimizing performance impact.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption keys are managed per logical block on persistent memory devices, then data security and granularity of encryption control are improved, but key identification and accessibility become more complex, impacting device performance
Solution Approach 1:
The patent segments encryption keys by organizing them in key tables where each logical block has its own dedicated encryption key. This segmentation allows fine-grained control over encryption at the logical block level, improving security granularity while maintaining manageable access through structured key table organization with key tags and identifiers.
Solution Approach 2:
The patent introduces key tables as an intermediary structure between the host system and persistent memory device. These key tables store encryption keys organized by logical block addresses, acting as a mediator that simplifies key management by providing a structured lookup mechanism rather than direct key handling, thus reducing the perceived complexity for host systems.
2Reliability
If multiple encryption keys are stored and managed for different logical blocks, then encryption granularity and security control are improved, but key access time and operational performance deteriorate
Solution Approach 1:
The patent performs preliminary organization of encryption keys in key tables during device initialization or key loading phases. Keys are pre-associated with their corresponding logical block addresses and stored in an optimized structure, so that during actual encryption operations, the host system only needs to perform quick lookups by logical block address rather than searching through all keys, significantly reducing access time.
Solution Approach 2:
The patent optimizes key access by organizing keys locally within key tables according to their associated logical block addresses. This local organization allows the host system to directly access only the specific key needed for a particular logical block without iterating through other keys, improving access efficiency while maintaining fine-grained encryption control.
3Speed
If a key cache is implemented for rapid key access, then key retrieval speed is improved, but memory resource consumption and device complexity increase
Solution Approach 1:
The patent implements a key cache that stores only a subset of frequently accessed encryption keys in high-speed memory, rather than caching all possible keys. This partial caching approach provides significant speed improvement for common operations while avoiding the excessive memory resource consumption that would result from caching the complete key set, thus balancing performance gains with resource constraints.
Data Source
AI summary
A command to perform a data operation at a memory device is received. The command includes an encryption key tag. A first key table is accessed from local memory. The first key table includes a first set of key entries corresponding to a first set of encryption keys. The first key table is searched to determine whether it includes an entry corresponding to the encryption key tag. Based on determining the first key table does not include an entry corresponding to the tag, a second key table is accessed from RAM. The second key table includes a second set of key entries corresponding to a second set of encryption keys. A key entry corresponding to the encryption key tag is identified from the second key table. The key entry includes an encryption key corresponding to the encryption key tag. The command is processed using the encryption key.