Cache Locking for Secure AES State Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Smartphones and tablets with ARM SoC architecture are vulnerable to memory attacks such as cold boot, DMA, and bus monitoring attacks, which can extract sensitive data like AES cryptographic keys from RAM, due to the lack of hardware-based IOMMUs on mobile devices and inefficiencies in protecting pre-computed AES states.
Innovation Solution
Implementing a software-based solution that maintains secret state in on-SoC secure storage, specifically using cache locking to prevent eviction to unsecure memory during AES operations, and securely managing cache lines to protect access-protected states, ensuring that sensitive data is never written to or accessed from unsecure storage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If secret state is stored in RAM for fast access during encryption/decryption operations, then processing speed is improved, but the system becomes vulnerable to cold boot attacks and DMA attacks that can read RAM contents
Solution Approach 1:
The patent extracts the secret state from unsecure RAM storage and places it in secure storage (such as secure element or trusted platform module) that is isolated from DMA controllers and other attack vectors. Only necessary encrypted data remains in RAM, while the secret state that would expose cryptographic keys is removed to secure storage, thus maintaining processing speed while eliminating the attack surface.
Solution Approach 2:
The patent introduces secure storage as an intermediary between the processing unit and unsecure RAM. The secure storage acts as a mediator that allows the processor to access secret state through controlled interfaces that prevent DMA attacks and cold boot attacks, while still enabling fast encryption/decryption operations through optimized access paths.
2Speed
If pre-computed AES state tables are cached in RAM to speed up encryption operations, then encryption speed is improved, but the access patterns leak information about the encryption key
Solution Approach 1:
The patent applies local quality by differentiating between secret state and access-protected state. Secret state (encryption keys) is stored in secure storage with restricted access, while access-protected state (pre-computed tables) is stored in unsecure RAM but accessed only through controlled interfaces that mask access patterns. This localized protection strategy speeds up encryption by allowing fast access to non-secret data while protecting against side-channel attacks.
Solution Approach 2:
The patent creates copies of the secret state in secure storage that are isolated from the main memory system. Multiple instances of the same secret state can be maintained in secure storage, allowing the system to service multiple encryption requests without repeatedly accessing the same physical memory locations in unsecure RAM, thereby masking access patterns and preventing timing attacks.
3Object-affected harmful factors
If IOMMU is implemented to restrict DMA device access to memory regions, then protection against DMA attacks is improved, but device complexity increases and IOMMUs are not yet present on most mobile devices
Solution Approach 1:
The patent uses software-based security mechanisms that leverage existing hardware components already present in mobile devices, rather than requiring expensive additional hardware like IOMMUs. The solution uses software-controlled cache locking, virtual memory management, and secure boot processes to achieve DMA attack protection using resources already available in the device, thus avoiding increased hardware complexity.
4Object-affected harmful factors
If RAM is cleared on reboot to prevent cold boot attacks, then security against cold boot attacks is improved, but disk encryption systems cannot retrieve cryptographic keys after reboot
Solution Approach 1:
The patent implements preliminary action by pre-loading the secret state into secure storage before the system needs it for encryption/decryption operations. The secure storage retains the secret state across reboots through persistent secure memory, while unsecure RAM is cleared after use. This allows the system to maintain security against cold boot attacks by never leaving keys in unsecure memory, while still enabling key availability after reboot through the persistent secure storage mechanism.
Applied Scientific Principles
This section explains which scientific principles are used to turn an abstract innovation direction into a practical engineering solution.
Function Achieved in This Case
Effectively prevents memory attacks by ensuring that secret state is never stored in unsecure memory, maintaining secure storage during encryption and decryption processes, and minimizing performance impact on mobile devices.
Implementation Method 1
maintaining a locked state of a cache line in a cache, the locked state preventing eviction of the cache line to a system memory
Implementation Method 2
This attack is possible because of the RAM remanence effect in which residual data remains into RAM long after the RAM has lost power
Data Source
AI summary
Described is a technology by which classes of memory attacks are prevented, including cold boot attacks, DMA attacks, and bus monitoring attacks. In general, secret state such as an AES key and an AES round block are maintained in on-SoC secure storage, such as a cache. Corresponding cache locations are locked to prevent eviction to unsecure storage. AES tables are accessed only in the on-SoC secure storage, to prevent access patterns from being observed. Also described is securely preparing for an interrupt-based context switch during AES round computations and securely resuming from a context switch without needing to repeat any already completed round or round of computations.