Persistent Memory Encryption via Unique Identifier Address Tweak
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing memory encryption technologies face challenges in ensuring spatial uniqueness across memory spaces, particularly with non-volatile memory, where configuration changes can lead to data loss due to changes in physical addresses, compromising both security and persistence requirements.
Innovation Solution
The implementation of spatially unique and location-independent persistent memory encryption uses a unique identifier value per persistent memory device, appended to the offset within the persistent memory range, to generate a tweak that remains consistent across memory reconfigurations, ensuring security and data integrity during device migration and memory expansions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional memory encryption is used with non-volatile memory, then security is provided, but data loss occurs during memory reconfigurations due to physical address changes
Solution Approach 1:
The encryption system is segmented into multiple independent encryption keys, each associated with specific memory regions or devices. This allows different memory regions to be encrypted with different keys, enabling reconfiguration without losing data integrity, as each segment can be independently managed and re-encrypted if needed.
Solution Approach 2:
The system performs preliminary actions by establishing encryption associations between memory regions and their encryption keys before reconfiguration occurs. This pre-establishment of encryption contexts allows the system to maintain data integrity during subsequent reconfigurations, as the encryption framework is already in place to handle address changes.
2Reliability
If physical addresses are used for encryption in non-volatile memory, then encryption is provided, but spatial uniqueness is lost when memory configuration changes
Solution Approach 1:
The system applies local quality by using device-specific identifiers and region-specific encryption keys rather than universal physical addresses. Each memory device or region has its own encryption context tied to its logical identity rather than physical location, maintaining spatial uniqueness even when physical addresses change during migration or reconfiguration.
Solution Approach 2:
The system changes the encryption parameter from physical addresses to device identifiers and logical region addresses. This parameter transformation allows the encryption to remain valid during memory reconfigurations, as the new parameters (device IDs, logical addresses) remain constant even when physical addresses change.
3Reliability
If encryption keys are tied to specific memory locations, then security is maintained, but data loss occurs during device migration
Solution Approach 1:
The encryption system achieves universality by using device identifiers that remain constant across different physical locations and configurations. The same device ID can be used to identify the same logical memory device regardless of its physical address or host system, enabling secure device migration while maintaining security through consistent identification and key management.
Data Source
AI summary
Systems, methods, and apparatuses to implement spatially unique and location independent persistent memory encryption are described. In one embodiment, a system on a chip (SoC) includes at least one persistent range register to indicate a persistent range of memory, an address modifying circuit to check if an address for a memory store request is within the persistent range indicated by the at least one persistent range register, and append a unique identifier value, for a component corresponding to the memory store request for the address, to the address to generate a modified address and output the modified address as an output address when the address is within the persistent range, and output the address as the output address when the address is not within the persistent range, and an encryption engine circuit to generate a ciphertext based on the output address.