Data security when tiering volatile and non-volatile byte-addressable memory

A method, implemented at a computer system that includes a processor, a first memory that is byte-addressable and volatile, and a second memory that is byte-addressable and non-volatile, comprising:

• identifying a portion of cache data stored in the first memory that is to be copied to the second memory, the portion of cache data being associated with a cryptographic requirement for storing the portion of cache data on non-volatile storage;
• identifying a cryptographic capability of the second memory;
• determining that the cryptographic requirement is met by the cryptographic capability;
• and
• copying the portion of cache data to the second memory while relying on the second memory to encrypt the portion of cache data.

A method, implemented at a computer system that includes a processor, a first memory that is byte-addressable and volatile, and a second memory that is byte-addressable and non-volatile, comprising:

• identifying a portion of cache data stored in the first memory that is to be copied to the second memory, the portion of cache data being associated with a cryptographic requirement for storing the portion of cache data on non-volatile storage;
• identifying a cryptographic capability of the second memory;
• determining that the cryptographic requirement is not met by the cryptographic capability;
• encrypting the portion of cache data to generate an encrypted portion of cache data;
• and
• copying the encrypted portion of cache data to the second memory.

A computer system comprising:

• a processor;
• a first memory that is byte-addressable and volatile;
• a second memory that is byte-addressable and non-volatile;
• and
• a computer-readable medium that stores computer-executable instructions that are executable by the processor to cause the computer system to at least:
• identify a cryptographic capability of the second memory;
• identify a first portion of cache data stored in the first memory that is to be copied to the second memory, the first portion of cache data being associated with a first cryptographic requirement for storing the first portion of cache data on non-volatile storage;
• determine that the first cryptographic requirement is met by the cryptographic capability;
• based on the first cryptographic requirement being met by the cryptographic capability, copy the first portion of cache data to the second memory while relying on the second memory to encrypt the first portion of cache data;
• identify a second portion of cache data stored in the first memory that is to be copied to the second memory, the second portion of cache data being associated with a second cryptographic requirement for storing the second portion of cache data on non-volatile storage;
• determine that the second cryptographic requirement is not met by the cryptographic capability;
• and
• based on the second cryptographic requirement being not met by the cryptographic capability,
• encrypt the second portion of cache data to generate an encrypted portion of cache data;
• and
• copy the encrypted portion of cache data to the second memory.