Volatile Key Caching for Secure NVDIMM Data Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Emerging memory architectures face challenges in securing non-volatile memory devices, particularly NVDIMMs, due to the complexity and vulnerability of cryptographic methods used for data access, which can be compromised by physical removal of the memory controller.
Innovation Solution
A memory controller generates an encrypted key stored in a volatile cache that is erased upon power loss, ensuring secure access to non-volatile memory devices by using AES encryption with a pseudorandom value as an initialization vector, and employing a timer or threshold voltage to detect power disconnection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Duration of action of stationary object
If encrypted keys are stored in non-volatile memory for persistent access, then data accessibility is improved, but security is worsened because keys remain accessible after power loss
Solution Approach 1:
The patent changes the physical state parameter of the memory storing the encrypted key from non-volatile to volatile. This parameter change ensures that the key automatically disappears when power is removed, eliminating the security vulnerability of persistent key storage while maintaining the ability to reload keys when needed.
Solution Approach 2:
The patent employs volatile memory to store encrypted keys, treating the key storage as a temporary, disposable function. The keys are loaded into volatile memory during operation and automatically discarded when power is lost, preventing unauthorized access to persisted data even if the physical device is compromised.
2Object-affected harmful factors
If encrypted keys are stored in volatile memory to prevent unauthorized access, then security is improved, but data accessibility is worsened because keys are lost when power is removed
Solution Approach 1:
The system performs preliminary action by loading the encrypted key into volatile memory before it is needed for decryption operations. This ensures the key is readily available in fast access memory during the operational window, and the system manages key reloading as a routine operation to maintain continuous access while preserving security through volatile storage.
Solution Approach 2:
The patent introduces an intermediary mechanism in the form of a key management system that handles the loading, caching, and reloading of encrypted keys. This intermediary manages the trade-off between security and accessibility by coordinating key operations across the volatile memory boundary, ensuring keys are available when needed while maintaining security through volatile storage.
3Speed
If fast volatile memory is used for key storage, then access speed is improved, but security is worsened because volatile memory may retain residual data
Solution Approach 1:
The patent converts the potential harm of residual data in volatile memory into a benefit by relying on the fundamental property of volatile memory: it loses its contents when power is removed. The system design accepts and utilizes this characteristic, ensuring that any residual data is automatically cleared upon power loss, thus maintaining security while preserving the speed advantages of volatile memory.
Data Source
AI summary
Examples of systems and methods described herein provide for erasing an encrypted key used for data access to a non-volatile memory device. A memory controller may generate an encrypted key for data access to non-volatile memory devices; and, to provide security of data stored on the non-volatile memory devices, the memory controller may store the encrypted key in a local cache of the memory controller. The encrypted key may be erased responsive to losing power or powering down of memory controller. Advantageously, the data stored at the non-volatile memory device may not be accessed when the memory controller (or a computing device implementing the memory controller) loses power. Accordingly, if a malicious actor were to physically remove (or steal) a computing device implementing the memory controller (e.g., a laptop computer), in an attempt to acquire the data, the data stored on the non-volatile memory devices could not be accessed.