Shim Layer Virtual Memory Extension for HSM Key Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Hardware security modules (HSMs) face memory limitations, making it impractical to store and manage a large number of cryptographic keys due to limited secure memory capacity, which is insufficient for cloud-scale operations.
Innovation Solution
A computer-implemented method using a shim layer interfaced with the HSM driver to encrypt cryptographic objects and store them in external memory storage, freeing up secure memory space while maintaining handles and references for efficient key management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If cryptographic objects are stored in the HSM secure memory, then they are readily available for use, but the limited memory capacity prevents storing a large number of keys
Solution Approach 1:
The patent transitions from storing all cryptographic objects within the HSM's limited secure memory to a two-tier storage architecture where frequently accessed objects remain in secure memory while less frequently accessed objects are stored in external memory. This dimensional expansion allows the system to manage a larger total quantity of cryptographic objects by utilizing external storage resources.
Solution Approach 2:
The patent introduces a shim layer as an intermediary between the HSM driver and the external memory storage system. This shim layer manages the abstraction between the HSM's secure memory and external memory, handling the complexity of object migration, caching, and memory space management to enable efficient access to cryptographic objects stored outside the HSM.
2Volume of stationary object
If cryptographic objects are encrypted and stored externally, then secure memory space is freed up, but encryption operations are time-consuming
Solution Approach 1:
The patent implements a caching mechanism where cryptographic objects are pre-loaded into the HSM secure memory when needed, rather than encrypting and storing all objects externally. This preliminary action of loading frequently accessed objects into secure memory reduces the frequency of time-consuming encryption operations during normal operation.
Solution Approach 2:
The patent creates a dynamic storage system where cryptographic objects can be migrated between external memory and HSM secure memory based on access patterns and memory availability. Objects are dynamically cached in secure memory when needed and evicted when memory is full, optimizing the balance between security and performance.
Data Source
AI summary
A key management system includes a hardware security module (HSM) with a secure memory; an HSM driver implementing an API, interfaced with the HSM to provide handles to cryptographic objects stored on the secure memory of the HSM; and a shim layer interfaced with the HSM driver. The layer is generally configured to enable a client application to interact with the HSM via the driver, i.e., for the HSM to manage cryptographic objects for the client, notwithstanding the layer. External memory storage resides outside the HSM and is interfaced with the layer. The method includes instructing (at the layer) to: (i) encrypt cryptographic objects from the HSM (with the help of the driver) and store the resulting encrypted objects at respective memory locations on the storage, to free up memory space; and (ii) store handles to such cryptographic objects along with references to said respective memory locations, on the storage.