Partitioned Memory Encryption for Secure Multi-Host Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing memory systems in multi-host environments face security vulnerabilities due to the bypassing of memory management units and the vulnerability of passwords to snooping, allowing unauthorized access to memory cells.
Innovation Solution
Implement cryptographic protection using asymmetric or symmetric key pairs, where each host system has a respective key, and the memory system stores a corresponding key, enabling encrypted commands to update memory cell protection attributes, ensuring secure access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If memory management units are bypassed in multi-host environments, then access speed to memory cells is improved, but security is worsened allowing unauthorized access
Solution Approach 1:
The memory system is divided into multiple independent memory cell ranges, each protected by its own cryptographic key. Each host system is assigned specific memory ranges it can access, creating segmented security zones that prevent unauthorized access while maintaining efficient access paths without requiring full MMU intervention for authorized operations.
Solution Approach 2:
Cryptographic keys serve as intermediaries between host systems and memory cell ranges. Instead of direct access control through MMU, the patent uses cryptographic authentication where hosts prove their authority to access specific memory ranges through key-based authentication, enabling secure bypass of traditional MMU security checks.
2Ease of operation
If passwords are used for memory access control, then ease of operation is improved, but security is worsened due to vulnerability to snooping
Solution Approach 1:
The patent replaces the mechanical/password-based access control system with a cryptographic system using asymmetric key pairs. Instead of transmitting passwords that can be snooped, the system uses public key infrastructure where hosts authenticate through cryptographic proofs, eliminating the vulnerability to password interception while maintaining simple access control operations.
3Reliability
If cryptographic protection is implemented for each memory cell range, then security is improved, but device complexity is worsened
Solution Approach 1:
The memory system is segmented into discrete memory cell ranges, each with its own protection attributes and cryptographic key. This segmentation allows the security system to manage complexity by treating each range independently rather than implementing a monolithic security system, making the overall complexity manageable through modular organization.
Solution Approach 2:
The patent introduces protection attributes as configurable parameters for each memory cell range that define access permissions. By changing the state of these protection parameters based on cryptographic authentication, the system achieves high security through parameter management rather than through complex structural mechanisms.
Data Source
AI summary
Methods, systems, and devices for partitioned cryptographic protection for a memory system are described. The method may include a host system generating a command to update a protection attribute of a first set of memory cells of the memory system, where the memory system includes multiple sets of memory cells, each set associated with a respective set of one or more first keys. The method may further include encrypting the command based on a second key corresponding to a first key within the respective set of one or more first keys, and transmitting, after encrypting the command, the command to the memory system to update the protection attribute of the first set of memory cells.