Secure Flash Controller TLV Record Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Flash memories in computer systems face limitations such as asymmetric read/write access, limited erase/program cycles, and vulnerability to security attacks, which affect data storage reliability and security.
Innovation Solution
The use of Type-Length-Value (TLV) records with encrypted and non-encrypted fields allows for secure encryption and invalidation of records without decryption, reducing erase cycles and enhancing data protection, thereby extending the lifespan and reliability of Flash devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all fields of TLV records are encrypted for security, then data protection is improved, but read operations become slower and more complex due to requiring decryption
Solution Approach 1:
The TLV record is segmented into encrypted fields (type, length) and non-encrypted fields (validity indicators, metadata). This allows the processor to read and validate non-encrypted fields without decryption, improving read speed while maintaining security for sensitive data in encrypted fields
Solution Approach 2:
Different fields within the TLV record have different encryption states. Critical fields like validity indicators are kept non-encrypted for fast access, while sensitive fields like data content are encrypted for protection. This local differentiation optimizes both security and performance
2Reliability
If invalidation is performed by decrypting and modifying encrypted fields, then data integrity is maintained, but the number of erase cycles increases reducing device lifespan
Solution Approach 1:
The validity indicator is extracted from the encrypted data portion and stored separately in a non-encrypted field. This allows invalidation operations to modify only the extracted validity indicator without touching the encrypted data fields, minimizing erase cycles and extending device lifespan
Solution Approach 2:
Validity indicators are prepared and stored in non-encrypted fields in advance. When invalidation is needed, the processor can immediately modify these pre-positioned indicators without initiating decryption or complex erase operations, reducing wear on the Flash memory
3Reliability
If encryption and decryption operations are performed frequently, then data security is maintained, but storage throughput decreases and latency increases
Solution Approach 1:
Instead of encrypting and decrypting entire TLV records for every operation, the system performs partial encryption only on necessary fields (type, length) while leaving other fields (validity indicators, metadata) unencrypted. This reduces the volume of data requiring encryption/decryption operations, improving throughput and reducing latency while maintaining adequate security
Data Source
Figure 1A
Figure 1B
Figure 2~3
AI summary
A computing device includes a non-volatile memory (NVM) interface (108) and a processor (102). The NVM interface is configured to communicate with an NVM (106). The processor is configured to store in the NVM Type-Length-Value (TLV) records (116), each TLV record including one or more encrypted fields (120) and one or more non-encrypted fields (118), the non-encrypted fields including at least respective validity indicators of the TLV records, to read the TLV records that include the encrypted fields and the non-encrypted fields from the NVM, and to invalidate selected TLV records by modifying the respective validity indicators of the selected TLV records that are stored in the non-encrypted fields.