Persistent Memory Passphrase Management via BIOS Intermediary
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Persistent memory systems face issues with passphrase management, leading to permanent unavailability ('bricking') when passphrases are lost, especially in App Direct Mode or Mixed Mode configurations.
Innovation Solution
The proposed solution involves an information handling system with a persistent memory secured via a passphrase, utilizing a BIOS to set and encrypt the passphrase using asymmetric key pairs, and a management controller for out-of-band management, ensuring secure passphrase propagation and storage across the system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If passphrase security mechanisms are implemented on persistent memory modules, then data security is improved, but the risk of memory bricking due to lost passphrases increases
Solution Approach 1:
The patent introduces a passphrase backup mechanism where the system acts as an intermediary between the user and the persistent memory. The BIOS captures and stores a backup of the passphrase used to unlock the memory, creating a mediator that can recover access if the original passphrase is lost, thereby preventing memory bricking while maintaining security
Solution Approach 2:
The system performs preliminary action by capturing and storing the passphrase backup before the user potentially loses it. The BIOS intercepts the passphrase during the memory unlock process and creates a backup copy, ensuring that recovery information is available in advance before any bricking scenario can occur
2Reliability
If passphrases are stored securely using encryption, then security is improved, but system complexity increases due to key management requirements
Solution Approach 1:
The system implements self-service by automatically managing the passphrase backup process without requiring user intervention. The BIOS automatically captures the passphrase during memory unlock, encrypts it using the existing system key infrastructure, and stores it in the configuration memory. This automated approach reduces complexity by eliminating manual key management steps
Solution Approach 2:
The patent leverages existing universal components in the system - the BIOS firmware, the existing asymmetric key pair already present in the system, and the configuration memory - to implement passphrase backup. By reusing these multi-functional components, the solution avoids adding dedicated key management hardware or software, thereby limiting complexity increase
Data Source
Figure 1
Figure 2
AI summary
An information handling system may include a persistent memory configured to be secured via a passphrase; a basic input/output system (BIOS); and a management controller configured to provide out-of-band management of the information handling system. The BIOS may be configured to set the passphrase of the persistent memory, encrypt the passphrase via a first key of a first asymmetric key pair, and transmit the encrypted passphrase to the management controller. The management controller may be configured to decrypt the encrypted passphrase via a second key of the first asymmetric key pair, re-encrypt the passphrase via a first key of a second asymmetric key pair, and transmit the re-encrypted passphrase to an external management console via an out-of-band management interface.