Methods to improve security of multi-tenant memory modules
An example system includes a host computing device configured to host a first tenant and a second tenant, non-volatile memory configured to store data for the first tenant and data for the second tenant, and a memory controller including a cache of a volatile memory configured to store a first encrypted key associated with the first tenant used to access the data stored at the non-volatile memory and a second encrypted key associated with a second tenant used to access the data stored at the non-volatile memory. The memory controller further includes a processor having encryption logic configured to detect an attack on a portion of the cache storing the second encrypted key by the first tenant, and to erase the stored second encrypted key from the cache in response to detection of the attack.
1 . A method comprising:
writing, to a cache coupled to a volatile memory device, a first encrypted key associated with a first tenant for a non-volatile memory device coupled to the volatile memory device;
writing, to the cache coupled to the volatile memory device, a second encrypted key associated with a second tenant for the non-volatile memory device coupled to the volatile memory device; and
responsive to detection of an attack on a portion of the cache storing the second encrypted key by the first tenant, erasing the stored second encrypted key from the cache.
2 . The method of claim 1 , further comprising detecting the attack on the cache via repeated accesses of one portion of the cache physically adjacent the portion or the cache storing the second encrypted key.
3 . The method of claim 1 , further comprising, further responsive to detection of an attack on a portion of the cache storing the second encrypted key by the first tenant, blocking all access to the non-volatile memory by the second tenant.
4 . The method of claim 1 , further comprising, responsive to receipt of a memory access request from the second tenant, using the second encrypted key to store data to or retrieve data from the non-volatile memory device.
5 . The method of claim 4 , further comprising, responsive to receipt of a memory access request from the first tenant, using the first encrypted key to store data to or retrieve data from the non-volatile memory device.
6 . The method of claim 1 , wherein the first tenant and the second tenant are both hosted on a host computing device.
7 . The method of claim 1 , wherein the non-volatile memory device comprises at least one of a NAND memory device or a 3D XPoint memory device.
8 . The method of claim 1 , further comprising generating the first encrypted key based partly on a pseudorandom value from a pseudorandom number generator.
9 . The method of claim 8 , further comprising generating the first encrypted key using an authenticated stream cipher.
10 . An apparatus comprising:
a cache of a volatile memory configured to store a first encrypted key associated with a first tenant used to access a non-volatile memory and a second encrypted key associated with a second tenant used to access the non-volatile memory; and
a processor having encryption logic configured to detect an attack on a portion of the cache storing the second encrypted key by the first tenant, and to erase the stored second encrypted key from the cache in response to detection of the attack.
11 . The apparatus of claim 10 , wherein the encryption logic is configured to detect the attack on the cache based on repeated accesses of one portion of the cache physically adjacent the portion or the cache storing the second encrypted key.
12 . The apparatus of claim 10 , wherein the encryption logic is further configured to, responsive to detection of an attack on a portion of the cache storing the second encrypted key by the first tenant, block all access to the non-volatile memory by the second tenant.
13 . The apparatus of claim 10 , wherein the processor is configured to:
responsive to receipt of a memory access request from the second tenant, using the second encrypted key to store data to or retrieve data from the non-volatile memory device; and
responsive to receipt of a memory access request from the first tenant, using the first encrypted key to store data to or retrieve data from the non-volatile memory device.
14 . The apparatus of claim 10 , wherein the first tenant and the second tenant are both hosted on a host computing device.
15 . The apparatus of claim 10 , wherein the encryption logic is further configured to generate the first encrypted key based partly on a pseudorandom value from a pseudorandom number generator.
16 . The apparatus of claim 15 , wherein the encryption logic is further configured to generate the first encrypted key using an authenticated stream cipher.
17 . A system comprising:
a host computing device configured to host a first tenant and a second tenant;
non-volatile memory configured to store data for the first tenant and data for the second tenant; and
a memory controller comprising:
a cache of a volatile memory configured to store a first encrypted key associated with the first tenant used to access the data stored at the non-volatile memory and a second encrypted key associated with the second tenant used to access the data stored at the non-volatile memory; and
a processor having encryption logic configured to detect an attack on a portion of the cache storing the second encrypted key by the first tenant, and to erase the stored second encrypted key from the cache in response to detection of the attack.
18 . The system of claim 17 , wherein the encryption logic is configured to detect the attack on the cache based on repeated accesses of one portion of the cache physically adjacent the portion or the cache storing the second encrypted key.
19 . The system of claim 17 , wherein the encryption logic is further configured to, responsive to detection of an attack on a portion of the cache storing the second encrypted key by the first tenant, block all access to the non-volatile memory by the second tenant.
20 . The system of claim 17 , wherein the processor is configured to:
responsive to receipt of a memory access request from the second tenant, using the second encrypted key to store data to or retrieve data from the non-volatile memory device; and
responsive to receipt of a memory access request from the first tenant, using the first encrypted key to store data to or retrieve data from the non-volatile memory device.
21 . The system of claim 17 , wherein the encryption logic is further configured to generate the first encrypted key based partly on a pseudorandom value from a pseudorandom number generator.
22 . The system of claim 21 , wherein the memory controller further comprises the pseudorandom number generator configured to generate the pseudorandom value.