Secure Data Transfer via External Cryptography Device
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure data transfer solutions using NVMe memory technology with built-in memory controllers face challenges in ensuring data security due to the exposure of plaintext data over PCIe interfaces, which compromises read/write security.
Innovation Solution
A secure data transfer apparatus and method that employs a cryptography device to encrypt and decrypt data within a system on chip, using a PCIe interface to exchange ciphertext data with an external memory controller, thereby maintaining data security and allowing for flexible interface selection, including PCIe, without the need for an integrated memory controller within the apparatus.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a memory controller with built-in cryptography function is integrated in the system on chip, then data security is improved, but device complexity and implementation difficulty increase significantly
Solution Approach 1:
The system separates the cryptography function into an independent external memory controller rather than integrating it within the system on chip. This segmentation allows the SoC to maintain its existing architecture while adding security capabilities through an externally connected controller that handles encryption/decryption operations separately.
Solution Approach 2:
An external memory controller acts as an intermediary between the system on chip and the memory device. This intermediary component performs cryptography operations on data before it enters or leaves the SoC, thereby securing data transmission without requiring modifications to the internal architecture of the SoC itself.
2Adaptability or versatility
If the system on chip is updated to support new memory protocols, then compatibility with updated memory technology is improved, but manufacturing cost and update complexity increase
Solution Approach 1:
The memory protocol support functionality is extracted from the system on chip and placed in an external memory controller. This allows the SoC to remain unchanged while the external controller is updated to support new memory protocols such as NVMe, thereby maintaining manufacturing simplicity while improving adaptability.
Solution Approach 2:
The system adopts a dynamic architecture where the memory controller can be independently updated or replaced without changing the core SoC. This dynamic separation allows the memory interface layer to adapt to evolving protocols while the main processing unit remains stable and cost-effective to manufacture.
3Speed
If plaintext data is transmitted over PCIe interface to external memory, then data transfer speed is improved, but data security deteriorates
Solution Approach 1:
The system performs preliminary encryption of data before it is transmitted over the PCIe interface. The external memory controller encrypts data outbound before leaving the SoC and decrypts data inbound before it enters the SoC, ensuring that only ciphertext traverses the PCIe bus while maintaining high transfer speeds.
Solution Approach 2:
The external memory controller serves as a security intermediary that intercepts data at the boundary of the SoC. It performs cryptography operations on all data passing through it, thereby securing the PCIe transmission without affecting the internal data flow or performance of the SoC.
Data Source
AI summary
A secure data transfer apparatus, where a processor in the apparatus is configured to execute a driver software to generate cryptography information, a cryptography device in the apparatus is configured to obtain a current cryptography parameter based on the cryptography information, and perform a cryptography operation using the current cryptography parameter, a Peripheral Component Interconnect Express (PCIe) interface in the apparatus configured to perform a ciphertext data exchange with a memory controller in a memory located external to the apparatus, where the ciphertext data exchange includes sending the ciphertext data from the cryptography device to the memory controller when the memory is to be written, and sending the ciphertext data from the memory controller to the cryptography device when the memory is to be read.