Secure Non-Volatile Memory Module with Password-Based Data Erasure
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Non-volatile memories (NVMs) pose a security risk when used in cloud-based services, as they can store data intended to be transient, leading to unauthorized access if stolen or re-allocated, as they persist data even when resources are reassigned.
Innovation Solution
Implementing a secure non-volatile memory module with a password authentication mechanism, where data access is granted only with a matching key, and if unauthorized, the data is erased before access is allowed, using a Mode Register Set (MRS) command and Serial Presence Detect (SPD) to determine secure mode and authenticate users.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Duration of action of stationary object
If non-volatile memory is used for long-term storage, then data persistence is improved, but security risk increases due to unauthorized access when memory is stolen or re-allocated
Solution Approach 1:
The patent applies preliminary action by performing data erasure before memory reallocation or theft detection. The system proactively clears sensitive data from non-volatile memory blocks before they can be accessed by unauthorized users, preventing security breaches while maintaining data persistence for authorized long-term storage operations
Solution Approach 2:
The patent converts the harmful characteristic of non-volatile memory (data persistence that prevents overwriting) into a beneficial security feature. By implementing secure erase mechanisms and authentication protocols, the system ensures that persistent storage becomes a security advantage - data remains accessible to authorized users indefinitely but is automatically destroyed if access credentials are lost or memory is stolen, transforming the potential vulnerability into a protective measure
2Object-affected harmful factors
If encryption is implemented to secure data, then unauthorized access is prevented, but access speed decreases due to encryption/decryption delays
Solution Approach 1:
The patent applies segmentation by dividing memory into multiple independent blocks with different access control mechanisms. Some blocks use encryption for high-security data, while other blocks use faster authentication protocols or hardware-based security. This segmentation allows the system to secure sensitive data without encrypting entire memory spaces, thereby maintaining high access speeds for non-sensitive operations while providing strong security where needed
Solution Approach 2:
The patent introduces an intermediary authentication layer between the processor and memory that validates access requests before data transfer. This intermediary security checkpoint uses hardware-accelerated authentication and credential verification that operates in parallel with data access operations, preventing unauthorized access without creating sequential bottlenecks that would slow down legitimate data retrieval
3Object-affected harmful factors
If password authentication is required for memory access, then data security is improved, but operational complexity increases
Solution Approach 1:
The patent applies self-service by implementing automatic authentication mechanisms where the memory system independently verifies access credentials without requiring manual intervention. The system automatically manages authentication tokens, credentials, and access rights, performing security verification in the background during normal operations. This eliminates the need for users to manually manage complex security protocols while maintaining strong password-based protection
Solution Approach 2:
The patent implements a universal authentication framework that supports multiple authentication methods (passwords, biometric data, hardware tokens, cryptographic keys) through a single integrated interface. This multi-functional authentication system allows different user types and access scenarios to be handled by the same security infrastructure, simplifying operations while providing comprehensive security coverage across diverse access patterns
Data Source
AI summary
A secure memory (145) is disclosed. The memory (145) may include data storage (310, 315, 320, 325, 330, 335, 340, 345) for data, along with a data read logic (405) and a data write logic (410) to read and write data from the data storage (310, 315, 320, 325, 330, 335, 340, 345). A password storage (355) may store a stored password (510). A receiver may receive a received password (505) from a memory controller (205). A comparator may compare the received password (505) with the stored password (510). An erase logic (435) may erase data in the data storage (310, 315, 320, 325, 330, 335, 340, 345) if the received password (505) does not match the stored password (510). Finally, a block logic (425) may block access to the memory (145) from the memory controller (205) until after the comparator (430) completes its operation.