Secure Sleep State Module for DRAM Encryption

Solution Overview

Problem

Computing platforms in sleep states are vulnerable to data breaches, as sensitive information in Dynamic Random Access Memory (DRAM) can be accessed during cold boot attacks, and existing power states like OFF and hibernation have drawbacks such as long boot times and loss of unsaved data.

Innovation Solution

Implementing a secure sleep state management system that encrypts DRAM data when the platform enters a sleep state and decrypts it upon resume with proper credentials, using a passphrase-based secure sleep state module integrated with the BIOS to protect data from unauthorized access.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Loss of time

If the computing platform is placed in a sleep state to preserve system state and enable fast resume, then resume time is reduced and user productivity is improved, but data security is compromised as sensitive information in DRAM can be accessed during cold boot attacks

Engineering Contradiction:

Improveresume timeVSAvoiddata security

Core Design Contradiction:

Loss of timeVSReliability

Solution Approach 1:

The system performs preliminary encryption of DRAM contents before transitioning to sleep state. The secure sleep state module encrypts sensitive data in DRAM while the system is still powered on, so that when the system enters sleep mode, the encrypted data cannot be accessed even if an attacker performs a cold boot attack. This preliminary protective action resolves the contradiction by ensuring data security is maintained during the fast resume sleep state.

Inventive Principle:

Principle #10Preliminary action

2Reliability

If the computing platform is placed in OFF state to protect data security, then data protection is improved, but boot time increases and unsaved data is lost

Engineering Contradiction:

Improvedata protectionVSAvoidboot time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system performs preliminary encryption of DRAM contents before transitioning to sleep state. The secure sleep state module encrypts sensitive data in DRAM while the system is still powered on, so that when the system enters sleep mode, the encrypted data cannot be accessed even if an attacker performs a cold boot attack. This preliminary protective action resolves the contradiction by ensuring data security is maintained during the fast resume sleep state.

Inventive Principle:

Principle #10Preliminary action

3Reliability

If the computing platform is placed in hibernation state to protect data security, then data protection is improved, but resume time increases and user productivity decreases

Engineering Contradiction:

Improvedata protectionVSAvoidresume speed

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The system performs preliminary encryption of DRAM contents before transitioning to sleep state. The secure sleep state module encrypts sensitive data in DRAM while the system is still powered on, so that when the system enters sleep mode, the encrypted data cannot be accessed even if an attacker performs a cold boot attack. This preliminary protective action resolves the contradiction by ensuring data security is maintained during the fast resume sleep state.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentEP2867822B1Methods and apparatus for a secure sleep state

Publication Date: 2019.08.14 INTEL CORP

Figure 1
Figure 2
Figure 3A

AI summary

Methods and apparatus for a secure sleep state are disclosed. An example method includes, in response to an initiation of a sleep state of a computing platform, encrypting a memory of the computing platform; and decrypting the memory when resuming the computing platform from the sleep state, wherein placing the computing platform in the sleep state includes powering down a portion of the computing platform and preserving a state of the computing platform.