Information handling system secret protection across multiple memory devices
View Patent ↗Information handling system secret protection is enhanced by encrypting secrets into a common file and breaking up the encrypted file into plural portions stored at plural memory devices, such as across plural DIMMs disposed in the information handling system. In one embodiment, a decryption key to decrypt the encrypted file is broken into plural portions stored at the plural memory devices. Upon detection of a predetermined security factor, such as an indication of removal of a the encrypted file is removed from the plural portions.
1. An information handling system comprising:
a chassis;
a processor disposed in the chassis and operable to process information;
memory disposed in the chassis and interfaced with the processor, the memory operable to store the information, the memory having at least first and second separate memory devices, the first and second memory devices comprising at least first and second random access memory (RAM) modules;
a memory controller interfaced with the memory and operable to manage locations in the memory devices to store the information; and
a security module interfaced with the memory controller, the security module operable to identify sensitive information based upon predetermined conditions and to locate first and second portions of the sensitive information on the first and second memory devices;
wherein:
the first portion comprises less than all of an encrypted file having encrypted information and less than all of a password to decrypt the encrypted information; and
the second portion comprises less than all of the encrypted file and less than all of the password to decrypt the encrypted information.
2. The system of claim 1 wherein:
the first and second memory devices comprise first and second RAM modules; and
the security module is further operable to delete the second portion if a predetermined condition associated with the first portion is detected.
3. The system of claim 2 wherein the predetermined condition associated with the first portion comprises a predetermined temperature.
4. The system of claim 2 wherein the predetermined condition associated with the first portion comprises an altered electrical characteristic associated with removal of the first memory device.
5. The system of claim 2 wherein the predetermined condition associated with the first portion comprises a signal from a mechanical device, the signal triggered by removal of the first memory device.
6. The system of claim 1 wherein the predetermined conditions comprise transition to an S3 sleep power state.
7. The system of claim 6 wherein the sensitive information comprises passwords stored in a web browser, the passwords stored in an encrypted file upon detection of transition to S3 power state, the encrypted file broken into at least the first and second portions for storage on the first and second memory devices.
8. A method for information handling system secret protection across plural random access memory (RAM) devices, the method comprising:
defining sensitive information stored in memory of an information handling system, the sensitive information including at least a key for decrypting the sensitive information, the key having first and second portions;
storing a first portion of the sensitive information in a first of the plural RAM devices of the information handling system, the first portion including the first portion of the key;
storing a second portion of the sensitive information in a second of the plural RAM devices of the information handling system, the second portion including the second portion of the key;
detecting transition of the information handling system to an S3 reduced power state;
detecting a predetermined condition associated with the first of the plural RAM devices; and
in response to the detecting the predetermined condition, deleting the second portion from the second memory device.
9. The method of claim 8 wherein:
the storing the first portion in the first of the plural RAM devices and the storing the second portion in the second of the plural RAM devices, is performed in response to the detecting transition.
10. The method of claim 8 wherein the predetermined condition comprises a temperature threshold.
11. The method of claim 8 wherein the predetermined condition comprises an indication of removal of the first RAM device.
12. The method of claim 8 wherein the sensitive information comprises passwords stored in RAM by the operating system for accessing encrypted information.
13. The method of claim 8 wherein the predetermined condition further comprises a failure by the first RAM memory module to respond to a periodic poll by the memory controller.
14. A system for secret protection across plural RAM memory modules of an information handling system, the system comprising:
a memory controller operable to map information for storage on the plural RAM memory modules; and
a security module interfaced with the memory controller, the security module operable to map plural portions of predetermined sensitive information for storage across the plural RAM memory modules and to delete the plural portions upon detection of a predetermined security factor;
wherein the plural portions of predetermined sensitive information comprises an encrypted blob of plural files broken into the plural portions; and
wherein the plural portions of predetermined sensitive information comprises a key that decrypts the encrypted blob, the key broken into the plural portions.
15. The system of claim 14 wherein the predetermined security factor comprises an indication of removal of one or more of the plural RAM memory modules from the information handling system.