Application-Specific Encryption for Shared Memory Data Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software architectures lack effective mechanisms to secure data access, particularly preventing one software application from accessing the secrets or digital assets of another application, and are vulnerable to application substitution attacks.
Innovation Solution
An electronic device generates an encryption key based on a secret key and a public key associated with a first application, using cryptographic operations to protect data items and store them in a memory, ensuring only authorized access and preventing unauthorized access to digital assets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If software applications share common memory space for data storage, then device memory utilization is improved, but data security between applications deteriorates
Solution Approach 1:
The patent segments the common memory space into application-specific protected zones using encryption. Each application's data is encrypted with a unique key derived from its package identifier, creating logical separation in the shared physical memory space. This allows multiple applications to store data in the same memory region while maintaining security isolation through cryptographic protection.
Solution Approach 2:
The patent introduces an intermediary encryption layer between applications and the common memory space. The encryption circuit acts as a mediator that translates application data into protected ciphertext before storage, and translates ciphertext back to plaintext for authorized access. This intermediary mechanism enables secure sharing of memory resources without direct application access to each other's data.
2Reliability
If application data is stored in encrypted form, then data security is improved, but data access speed deteriorates
Solution Approach 1:
The patent performs preliminary encryption of application data during the data writing phase, before storage in the common memory space. The encryption circuit encrypts data using the application-specific encryption key immediately when data is generated or modified, so that when data is retrieved, it is already in the correct encrypted/decrypted state without requiring additional real-time cryptographic operations during access.
Solution Approach 2:
The encryption system is self-service in that each application's data is automatically encrypted and decrypted using its own derived encryption key without requiring external cryptographic processing. The system manages its own encryption/decryption operations transparently, minimizing overhead on data access operations while maintaining security.
3Reliability
If dynamic encryption keys are generated for each application, then security against application substitution is improved, but computational complexity increases
Solution Approach 1:
The patent changes the parameter used for key generation from static application identifiers to dynamic values based on package identifiers and cryptographic hashing. The encryption key is derived by hashing the package identifier, creating a dynamic key that changes if the application package is modified or replaced. This parameter transformation provides strong protection against application substitution while using efficient cryptographic hash functions that minimize computational overhead.
Data Source
AI summary
An electronic device receives a software module of a first application, where the software includes comprising a public key associated with the first application. A cryptographic circuit of the electronic device generates an encryption key based on a secret key of the electronic device and on one of: the public key or and an identification value derived from the public key. The cryptographic circuit then generates one or more protected data items by application of a cryptographic operation to one or more first data items associated with the first application and based on the encryption key. The one or more protected data items are then stored in a first portion of a memory of the electronic device.