Selective Memory Encryption via Page Encryption Hardware Unit
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In environments where physical access to computer systems is not controlled, such as in cloud computing, physical attacks on bus and memory are a concern, and existing solutions that encrypt all data to prevent unauthorized access incur significant computational overhead, encrypting both sensitive and non-sensitive data.
Innovation Solution
A hardware-software approach for selective memory encryption that transparently encrypts only sensitive data outside the System-on-a-chip (SoC) security perimeter, using a page encryption hardware unit and encryption monitor to automatically encrypt sensitive pages without active OS intervention, allowing non-sensitive pages to remain unencrypted.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all data is encrypted to prevent unauthorized access from physical attacks, then security against physical attacks is improved, but computational overhead increases significantly
Solution Approach 1:
The patent segments data into sensitive and non-sensitive portions, applying encryption only to sensitive data. The system identifies sensitive data through metadata tags or classification mechanisms, then selectively encrypts only those segments while leaving other data in plaintext form, thereby reducing computational overhead while maintaining security for critical information.
Solution Approach 2:
The patent applies different encryption qualities to different data regions based on their sensitivity. Sensitive data receives full encryption protection while non-sensitive data remains unencrypted or receives lighter protection. This local differentiation allows the system to optimize the balance between security and computational efficiency by applying resources only where needed.
2Reliability
If all data is encrypted to protect from physical attacks, then security is improved, but data access speed deteriorates due to encryption/decryption operations
Solution Approach 1:
The patent divides data into encrypted and unencrypted segments, allowing the system to access unencrypted data at full speed while only encrypting/decrypting sensitive portions when needed. This segmentation enables parallel processing where sensitive and non-sensitive data can be accessed simultaneously with different performance characteristics.
Solution Approach 2:
The patent applies encryption partially rather than universally, encrypting only the portion of data that requires protection. This partial action reduces the total number of encryption/decryption operations performed, thereby maintaining faster data access speeds while still providing security for critical information.
3Use of energy by moving object
If selective encryption is applied to only sensitive data, then computational overhead is reduced, but security coverage deteriorates by leaving non-sensitive data unencrypted
Solution Approach 1:
The patent applies different security qualities to different data regions based on their sensitivity classification. Sensitive data receives encryption protection while non-sensitive data remains unencrypted. This local quality differentiation allows the system to optimize security coverage by applying protection only where it is actually needed, avoiding waste of computational resources on data that does not require protection.
4Extent of automation
If hardware-software approach is used for selective encryption, then automation of encryption process is improved, but device complexity increases
Solution Approach 1:
The patent introduces a hardware encryption module as an intermediary between the CPU and memory. This dedicated hardware component handles encryption/decryption operations independently, automating the process without requiring operating system intervention. The hardware module communicates with the OS through standardized interfaces, masking its complexity while providing automatic encryption services.
Solution Approach 2:
The hardware encryption module operates autonomously, identifying sensitive data and performing encryption/decryption operations without external control. The system self-manages the encryption process by monitoring data access patterns and automatically applying encryption to sensitive data, reducing the automation burden on the operating system while maintaining high levels of automation.
Data Source
AI summary
In one example in accordance with the present disclosure, a method may include receiving, by a processor on a system on a chip (SoC), a request to encrypt a subset of data accessed by a process. The method may also include receiving, at a page encryption hardware unit of the SoC, a system call from an operating system on behalf of the process, to generate an encrypted memory page corresponding to the subset of data. The method may also include generating, by the page encryption hardware unit, an encryption/decryption key for the first physical memory address. The encryption/decryption key may not be accessible by the operating system. The method may also include encrypting, by the page encryption hardware unit, the subset of data to the physical memory address using the encryption/decryption key and storing, by the page encryption hardware unit, the encryption/decryption key in a key store.