Persistent Memory Key Regeneration for Secure Direct Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer systems face challenges in protecting data stored in persistent memory due to the use of software-based encryption that is not compatible with direct access mechanisms, impacts performance, and risks exposing encryption keys to unauthorized access.
Innovation Solution
A processor with memory protection logic generates non-persistent and persistent keys, where the persistent key is regenerated using an ephemeral component stored in the system, ensuring secure access to persistent memory without storing the key in a readable format.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If software-based encryption is used to protect persistent memory, then data security is improved, but system performance deteriorates and compatibility with direct access mechanisms is lost
Solution Approach 1:
The patent introduces a dedicated encryption engine as an intermediary component between the processor and persistent memory. This specialized hardware module handles encryption/decryption operations independently, allowing direct access mechanisms to function efficiently while maintaining security. The encryption engine acts as a mediator that protects data without impeding the speed of direct access operations.
Solution Approach 2:
The patent replaces software-based encryption with hardware-based encryption. By implementing encryption functionality directly in the processor's encryption engine rather than through software routines, the system eliminates the performance overhead associated with software processing while maintaining strong security protections for persistent memory operations.
2Ease of operation
If encryption keys are stored in readable format for memory access, then ease of operation is improved, but security deteriorates due to risk of unauthorized access
Solution Approach 1:
The patent extracts the encryption key from readable storage and keeps it in a protected state within the encryption engine. The key is separated from the data it protects and is never stored in a readable format in persistent memory. This extraction ensures that even if memory is compromised, the encryption key remains secure and inaccessible to unauthorized parties.
Solution Approach 2:
The encryption engine performs self-service by maintaining and managing the encryption key internally without requiring external access or storage. The key is generated and retained within the secure boundaries of the encryption engine, eliminating the need to store it in readable format elsewhere in the system. This self-contained approach ensures both security and operational efficiency.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An apparatus includes a processor, persistent memory coupled to the processor, and a memory protection logic. The processor may include multiple processing engines. The persistent memory may include a persistent storage portion and a memory expansion portion. The memory protection logic is to: obtain a first ephemeral component associated with the persistent storage portion; generate a persistent key using the first ephemeral component; obtain a second ephemeral component associated with the memory expansion portion; and generate a non-persistent key using the second ephemeral component. Other embodiments are described and claimed.