Persistent Memory Encryption Counters for Secure DAX File Auditing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Emerging non-volatile memory (NVM) technologies, such as byte-addressable persistent memory, face challenges in providing secure and efficient file encryption and auditing capabilities, particularly in DAX-based filesystems where direct access to files bypasses traditional software-based decryption and auditing mechanisms, leading to security and performance bottlenecks.
Innovation Solution
A method and system for secure byte-addressable persistent memory that employs a hardware/software co-design to initialize encryption counters and perform file and memory encryption/decryption using counter-mode encryption, incorporating error correction codes for crash and attack recovery, and enables filesystem auditing by tracking access information without sacrificing direct access capabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional software-based decryption and auditing mechanisms are used in DAX-based filesystems, then security and auditing capabilities are provided, but performance bottlenecks and security vulnerabilities occur due to bypassed mechanisms
Solution Approach 1:
The patent introduces a memory encryption counter block as an intermediary data structure that enables both encryption/decryption and auditing functions. This counter block contains encryption counters, file identification fields, and access information fields that work together to provide security while maintaining direct access performance. The intermediary structure allows the system to capture audit information without blocking the fast NVM access path.
Solution Approach 2:
The patent implements nesting by embedding multiple functional elements within the memory encryption counter block structure. The counter block contains nested components including encryption counters, file identification fields, access information fields, and error correction codes. This nested organization allows multiple security and auditing functions to be consolidated in a single data structure that does not interfere with the direct access performance of DAX-based filesystems.
2Productivity
If direct access to files is enabled in DAX-based filesystems, then access performance is improved, but traditional auditing mechanisms are bypassed leading to loss of audit capabilities
Solution Approach 1:
The memory encryption counter block serves as an intermediary that captures audit information directly from memory access operations. The access information field within the counter block records file access details without requiring intervention from traditional software-based auditing mechanisms. This intermediary approach preserves audit capabilities while maintaining the performance benefits of direct NVM access.
Solution Approach 2:
The system implements self-service auditing where the memory controller automatically populates the access information field in the counter block without requiring external auditing software. The counter block structure includes built-in fields for tracking access patterns, and the encryption/decryption operations automatically generate and record this audit information, enabling auditing to serve itself without additional overhead.
3Reliability
If encryption is implemented in NVM-based filesystems, then data security is improved, but complexity of encryption management and key handling increases
Solution Approach 1:
The patent merges encryption management functions into the memory controller and consolidates multiple encryption-related data structures into the unified memory encryption counter block. By combining encryption counters, file identification fields, access information, and error correction codes in a single structure, the system reduces the complexity of managing separate encryption components while maintaining strong data security through counter-mode encryption with persistent key material.
Data Source
AI summary
A method comprising initializing, by a processor, a field identification (FID) field and a file type field in a memory encryption counter block associated with pages for each file of a plurality of files stored in a persistent memory device (PMD), in response to a command by an operating system (OS). The file type field identifies whether each file associated with FID field is one of an encrypted file and a memory location. The method includes decrypting data of a page stored in the PMD, based on a read command by a requesting core. When decrypting, determining whether the requested page is an encrypted file or memory location. If the requested page is an encrypted file, performing decryption based on a first encryption pad generated based on the file encryption key of the encrypted file and a second encryption pad generated based on a processor key of the secure processor.