Non-Volatile Memory Dual-Key Encryption for Data Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Non-volatile memory (NVM) systems, while providing data persistence, are vulnerable to malicious attacks and data leaks due to their ability to retain data indefinitely, making it challenging to secure sensitive information effectively.
Innovation Solution
A dual-key approach is implemented to encrypt and decrypt data in NVM regions, where ephemeral regions store data that should not persist after power loss and persistent regions store data that should be recoverable, using distinct encryption/decryption key pairs, with ephemeral keys stored in volatile memory to prevent recovery after power loss and persistent keys maintained by a recovery service for secure retrieval.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is stored in NVM to ensure persistence after power loss, then data resilience is improved, but security against malicious attacks and data leaks deteriorates
Solution Approach 1:
The NVM space is divided into multiple regions with different persistence characteristics. The system segments data storage into volatile-backed regions (for secure data that should be lost on power loss) and persistent regions (for data that should survive power loss). This segmentation allows simultaneous achievement of data persistence where needed and security through controlled data loss where needed.
Solution Approach 2:
The system dynamically changes the persistence parameter of NVM regions based on data classification. By adjusting the persistence characteristic (volatile-backed vs. persistent) according to security requirements, the system can maintain both data resilience for critical data and security through controlled non-persistence for sensitive data.
2Object-affected harmful factors
If encryption is applied to secure NVM regions, then security is improved, but system complexity increases
Solution Approach 1:
The system employs self-encrypting NVM controllers that automatically handle encryption and decryption operations without requiring complex external key management infrastructure. The encryption is integrated into the memory controller itself, reducing system complexity while maintaining security.
Solution Approach 2:
The patent introduces a recovery service as an intermediary that manages encryption keys and facilitates secure data recovery. This intermediary handles the complexity of key management and cryptographic operations, allowing the main system to achieve security without bearing the full burden of cryptographic complexity.
3Object-affected harmful factors
If dual-key encryption is implemented with separate key pairs for ephemeral and persistent regions, then security is improved, but key management complexity increases
Solution Approach 1:
The recovery service acts as an intermediary that manages the dual-key system. It stores and manages the persistent region keys securely, while ephemeral region keys are automatically discarded on power loss. This intermediary handles the complexity of maintaining separate key pairs, allowing the system to achieve enhanced security without proportional increases in management complexity.
Solution Approach 2:
The system extracts key management responsibilities from the main processing system and places them in the recovery service. By taking out the complex key management functions to a dedicated service, the main system achieves security through dual-key encryption without bearing the full burden of key management complexity.
Data Source
AI summary
Methods, apparatus and articles of manufacture to secure non-volatile memory regions are disclosed. An example method disclosed herein comprises associating a first key pair and a second key pair different than the first key pair with a process, using the first key pair to secure a first region of a non-volatile memory for the process, and using the second key pair to secure a second region of the non-volatile memory for the same process, the second region being different than the first region.