Volatile Memory Encryption via Segmented Block Allocation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Sensitive data stored in volatile memory can remain accessible after a computer shuts down, allowing unauthorized access due to existing encryption methods' limitations, particularly when data is not properly cleared from memory chips.

Innovation Solution

Implementing a system that allocates specific memory blocks for encrypted data, using distinct unencrypted and encrypted memory allocation and I/O functions, with an operating system managing encryption keys to securely handle and erase data, preventing unauthorized access.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If data is stored in volatile memory without encryption, then data access speed and availability are improved, but security and protection against unauthorized access deteriorate

Engineering Contradiction:

Improvedata accessibilityVSAvoiddata security

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

The memory is divided into separate encrypted and unencrypted blocks, allowing the system to segment data storage based on security requirements. Sensitive data is stored in encrypted blocks while less sensitive data can be stored in unencrypted blocks, resolving the contradiction by applying encryption selectively rather than universally

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

An encryption key management mechanism acts as an intermediary between the data and the unauthorized access attempt. The operating system manages encryption keys and controls access to encrypted memory blocks, allowing legitimate access while preventing unauthorized access without affecting the overall data accessibility performance

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If encryption is applied to all memory data, then data security is improved, but memory access performance and system efficiency deteriorate

Engineering Contradiction:

Improvedata securityVSAvoidmemory access performance

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

Different parts of the memory have different security properties. Encrypted blocks provide enhanced security for sensitive data while unencrypted blocks maintain optimal performance for non-sensitive data. This local differentiation allows the system to optimize both security and performance simultaneously

Inventive Principle:

Principle #3Local quality

3Ease of operation

If data remains in volatile memory after shutdown, then data availability for legitimate access is improved, but vulnerability to unauthorized access increases

Engineering Contradiction:

Improvedata availabilityVSAvoidunauthorized access risk

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The system performs preliminary encryption of data before it is stored in volatile memory. This preliminary encryption action ensures that even if data remains in memory after shutdown, it cannot be read by unauthorized users. The encryption keys are also managed and erased appropriately during system shutdown sequences

Inventive Principle:

Principle #10Preliminary action

4Reliability

If separate encrypted and unencrypted memory blocks are used, then data security is improved, but device complexity increases

Engineering Contradiction:

Improvedata securityVSAvoidmemory management complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The operating system provides universal memory management functions that handle both encrypted and unencrypted blocks through a unified interface. The same memory allocation, access, and management operations work for both block types, reducing the apparent complexity despite the dual-block structure

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS8954753B2Encrypting data in volatile memory

Publication Date: 2015.02.10 INTERNATIONAL BUSINESS MACHINE CORPORATION

AI summary

Provided are a computer program product, system, and method to allocate blocks of memory in a memory device having a plurality of blocks. An unencrypted memory allocation function requests allocation of unencrypted blocks in the memory device. An encrypted memory allocation function requests allocation of encrypted blocks in the memory device. An unencrypted Input/Output (I/O) request performs an I/O operation against the unencrypted blocks in the memory device. An encrypted I/O request function performs an I/O operation against the encrypted blocks in the memory device. An operating system uses an encryption key associated with the encrypted blocks to encrypt or decrypt data in the encrypted blocks to perform the encrypted I/O operation in response to processing the encrypted I/O request functions, wherein the unencrypted and encrypted memory allocation functions and unencrypted and encrypted I/O request functions comprise different functions in a library of functions available to the application.