Remote Boot Latency Reduction via Session-Bound Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Remotely-booted information handling systems experience high latency when accessing frequently-accessed temporary data due to higher network data access latency compared to local storage resources.
Innovation Solution
Implementing a method where an information handling system establishes an encryption key for local storage at the start of a session, encrypts data written during the session, and permanently disables access to the encrypted data at the end of the session, using a local storage resource.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is accessed over a network in a remotely-booted system, then data security is improved, but data access latency increases
Solution Approach 1:
The patent segments data into two categories: frequently-accessed temporary data stored locally on the information handling system, and other data stored remotely on network-attached storage. This segmentation allows the system to access hot data locally with low latency while maintaining security for cold data through remote storage and encryption.
Solution Approach 2:
The patent introduces an intermediary mechanism - a local storage resource with encrypted storage - that mediates between the need for fast local access and the requirement for secure remote storage. The local storage acts as a buffer that temporarily holds decrypted data during sessions, eliminating network latency for frequent operations while maintaining overall security through encryption at rest.
2Speed
If local storage is used for temporary data, then data access speed is improved, but data security is worsened
Solution Approach 1:
The patent applies preliminary action by encrypting data before it is written to local storage and establishing encryption keys in advance. The data is encrypted using keys derived from secure authentication credentials before local storage, ensuring that even if the local storage is compromised, the data remains protected. This preliminary encryption action resolves the security concern while allowing fast local access.
Solution Approach 2:
The patent changes the security parameter from 'encrypted at rest' to 'encrypted with session-specific keys'. By using different encryption keys for different sessions and temporarily validating them only during active sessions, the system enables fast local access during sessions while maintaining security through key rotation and session-bound encryption. This parameter change allows the system to achieve both speed and security.
3Reliability
If encryption is applied to local storage data, then data security is improved, but processing overhead increases
Solution Approach 1:
The patent applies partial encryption action by encrypting only the data that needs to be stored locally, rather than all data. Frequently-accessed temporary data is encrypted and stored locally, while other data remains remotely stored. This partial application of encryption reduces the overall processing overhead while still providing security for the most sensitive operations.
Solution Approach 2:
The system uses self-service by deriving encryption keys from the user's authentication credentials themselves. The same credentials used for authentication also serve as the basis for encryption keys, eliminating the need for separate key management infrastructure and reducing processing overhead. The system serves its own key management needs through this self-service approach.
Data Source
AI summary
Systems and methods for reducing latency on a remotely-booted information handling system are disclosed. A method may include remotely booting an information handling system having a local storage resource. The method may also include establishing, at the start of a session, an encryption key for the local storage resource for use during the session. Additionally, the method may include using the encryption key to encrypt data written to the local storage resource during the session. The method may further include permanently disabling access to the encrypted data written to the local storage resource at the end of the session.