Automated NVDIMM Persistent Region Unlocking via Firmware Passphrase Retrieval

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional methods for unlocking persistent regions in NVDIMM require manual user intervention, increasing labor intensity and decreasing operation efficiency, while also posing a risk of unauthorized access if not properly secured.

Innovation Solution

A method and apparatus that automatically unlock persistent regions in memory devices by configuring firmware to check for lock status and use a stored passphrase without human intervention, ensuring secure and efficient operation.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If manual passphrase input is required to unlock persistent region, then data security is maintained, but user operation complexity increases and system efficiency decreases

Engineering Contradiction:

Improvedata securityVSAvoiduser operation complexity

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The passphrase is retrieved from storage in advance during system initialization, before the user needs to access the persistent region. This preliminary retrieval action eliminates the need for manual input during critical operations, resolving the contradiction between security (maintained through pre-stored passphrase) and ease of operation (improved by automatic retrieval).

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system performs self-service by automatically retrieving and using the stored passphrase without requiring user intervention. The firmware autonomously completes the unlocking process by fetching the passphrase from storage and applying it to decrypt the persistent region, thereby maintaining security while eliminating manual operational steps.

Inventive Principle:

Principle #25Self-service

2Reliability

If manual passphrase input is required, then unauthorized access is prevented, but system operation time increases

Engineering Contradiction:

Improveunauthorized access preventionVSAvoidsystem operation time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The passphrase retrieval is performed in advance during system startup initialization, before the persistent region needs to be accessed. This preliminary action reduces the time penalty by moving the retrieval operation to an earlier stage when the system is already initializing, thus preventing unauthorized access while minimizing impact on operational time.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system maintains continuous useful action by overlapping the passphrase retrieval with the system startup process. Instead of adding a separate manual input step, the retrieval occurs continuously during initialization, ensuring security is maintained while the time loss is absorbed into the existing startup sequence rather than adding to operational time.

Inventive Principle:

Principle #20Continuity of useful action

3Productivity

If automatic passphrase retrieval is implemented, then operation efficiency improves, but system complexity increases

Engineering Contradiction:

Improveoperation efficiencyVSAvoidfirmware complexity

Core Design Contradiction:

ProductivityVSDevice complexity

Solution Approach 1:

The firmware acts as an intermediary layer that automatically manages the passphrase retrieval process. It mediates between the storage device containing the passphrase and the persistent region decryption process, handling the complexity of automatic retrieval while presenting a simple interface to the rest of the system, thus improving operation efficiency without proportionally increasing overall system complexity.

Inventive Principle:

Principle #24Intermediary (Mediator)

4Extent of automation

If passphrase is stored in storage device, then automatic unlocking is enabled, but security risk of passphrase exposure increases

Engineering Contradiction:

Improveautomatic unlocking capabilityVSAvoidpassphrase exposure risk

Core Design Contradiction:

Extent of automationVSObject-affected harmful factors

Solution Approach 1:

The passphrase is retrieved in advance during controlled system initialization before any user data access occurs. This preliminary retrieval happens in a secure context where the system is still establishing its security state, allowing automatic unlocking functionality while minimizing the window of exposure to potential threats.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system creates a secure, controlled environment (inert atmosphere) during the passphrase retrieval process, where the storage device is accessed under protected conditions during system initialization. This isolated, controlled environment minimizes exposure risks while enabling automatic unlocking, as the retrieval occurs in a secure context before external threats can intervene.

Inventive Principle:

Principle #39Inert atmosphere (Inert environment)

Data Source

PatentUS11556483B2Information handling apparatus and method for unlocking a persistent region in memory

Publication Date: 2023.01.17 LENOVO GLOBAL TECHNOLOGIES SWITZERLAND INTERNATIONAL GMBH

AI summary

Methods, systems, and apparatuses for unlocking a persistent region in memory are disclosed. An information handling apparatus includes a controller, a memory coupled to the controller, the memory having a persistent region that can either be locked or unlocked, and a firmware configured to determine whether the persistent region of the memory is locked, obtain a stored passphrase from a storage device if the persistent region is locked, and use the passphrase to unlock the persistent region of the memory.