Memory Encryption Key Table for Secure NVRAM Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer systems face significant security vulnerabilities due to the potential for hackers to access and obtain data from system memories, particularly non-volatile random access memory (NVRAM), which retains data even when power is interrupted, posing serious security risks when plaintext is stored.
Innovation Solution
A multi-key memory encryption technology (MKMET) is implemented using a key table with key identification codes (KeyID) and an encryption and decryption engine that operates at a high security level, isolating hosts from virtual machines and ensuring secure access to system memory through privilege level 0 instructions, utilizing cryptographic algorithms like AES-XTS and SM4 block message cipher algorithms.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If plaintext is stored in the system memory, then the ease of operation is improved, but the security is worsened
Solution Approach 1:
The patent segments the memory encryption key into multiple key components (first key component, second key component, third key component) that are stored in different locations and used at different stages. This segmentation allows the memory to be encrypted without requiring the entire key to be present in one location, maintaining security while enabling operation. The key components are combined through cryptographic operations to decrypt data when needed.
2Duration of action of stationary object
If NVRAM retains data without power, then the data persistence is improved, but the security vulnerability is worsened
Solution Approach 1:
The patent applies preliminary anti-action by encrypting the data stored in NVRAM before it can be accessed by unauthorized parties. The encryption is performed using multiple key components that are not simultaneously present in the system, making the stored ciphertext useless without the complete key. This preliminary protective measure counteracts the inherent vulnerability of NVRAM's data persistence capability.
Solution Approach 2:
The patent changes the state of the data from plaintext to ciphertext through cryptographic transformation. By changing the parameter of data representation from readable plaintext to encrypted ciphertext, the system maintains data persistence in NVRAM while eliminating the security vulnerability of storing sensitive information in readable form.
3Reliability
If multiple keys are used for encryption, then the security is improved, but the device complexity is worsened
Solution Approach 1:
The patent implements a nested structure where multiple key components are organized in a hierarchical manner. The first key component, second key component, and third key component are nested within different security domains or storage locations. This nesting allows the system to manage multiple keys systematically, reducing the operational complexity despite using multiple keys for enhanced security.
Solution Approach 2:
The patent introduces cryptographic intermediaries (such as key derivation functions, hash functions, or encryption algorithms) that mediate between the multiple key components and the data. These intermediaries simplify the complexity by providing standardized methods to combine key components and perform cryptographic operations, rather than requiring custom complex logic for key management.
Data Source
AI summary
A computer system with a processor having an encryption and decryption engine is shown. The encryption and decryption engine includes a key table, which is provided for encryption and decryption of the system memory. In response to a platform setting instruction, the processor reads a key identification code from a key identification code register, and reads control parameters from a control parameter register. Based on the control parameters, the processor manages a key, associated with the key identification code, in the key table.