Cold Boot Attack Defense in Self-Service Terminals
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Self-service terminals, such as ATMs, are vulnerable to cold boot attacks where attackers can read memory content after a restart, exploiting the persistence of memory data despite power loss, which existing countermeasures like BIOS-initiated memory clearing are ineffective and introduce delays.
Innovation Solution
A method using the main processor and system software to check status data including downtime, processor temperature, and external storage usage to determine deviations from normal states, triggering partial or complete deletion of volatile memory if attack criteria are met, ensuring secure restarts without noticeable delays.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If BIOS-initiated memory clearing is used during Power-On Self-Test, then memory security is improved, but restart delay increases significantly
Solution Approach 1:
The patent changes the parameter of when memory clearing occurs - shifting it from the Power-On Self-Test phase to the bootloader phase. This temporal parameter change allows the system to avoid memory clearing during POST (reducing restart delay) while still performing clearing later (maintaining security). The conditionality parameter is also changed by introducing temperature and downtime thresholds that determine whether clearing is necessary.
Solution Approach 2:
The patent performs preliminary detection of attack conditions (temperature, downtime, case state) before deciding whether to clear memory. This preliminary action allows the system to prepare for potential security threats without immediately executing the memory clearing operation, thus avoiding unnecessary delays during normal restarts while being ready to act quickly when threats are detected.
2Productivity
If POST is disabled or interrupted to improve restart speed, then productivity is improved, but memory security deteriorates
Solution Approach 1:
The patent extracts the memory clearing function from the POST process and relocates it to the bootloader phase. This separation allows POST to complete quickly without security-related delays, while the clearing operation is performed later when the system has already detected whether an attack is in progress based on temperature, downtime, and case state criteria.
Solution Approach 2:
The patent implements a feedback mechanism where the system continuously monitors temperature, downtime, and case state parameters, then uses this feedback to determine whether memory clearing is necessary. This feedback loop allows the system to maintain security by clearing memory only when attack conditions are detected, rather than always clearing during POST or never clearing.
3Reliability
If memory is continuously cleared to prevent cold boot attacks, then security against attacks is improved, but loss of time during normal operations increases
Solution Approach 1:
The patent applies partial action by clearing memory only when necessary - specifically when attack conditions (low temperature, short downtime, case opened) are detected. Instead of continuously clearing memory during all operations, the system performs selective clearing based on detected conditions, thus maintaining security against cold boot attacks while avoiding unnecessary time loss during normal operations.
Solution Approach 2:
The patent makes the memory clearing operation dynamic rather than static. The clearing action is conditional and adapts to system state - it is performed only when specific conditions indicate a potential attack. This dynamic approach allows the system to optimize between security and performance based on real-time conditions rather than following a fixed clearing schedule.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method to defend effectively against cold-boot attacks includes checking state data stored in a state memory to which the system software has access. At least two of the state data items are checked (111; 112) to determine deviations from parameters that are defined for a normal state of the computer. If deviations from the parameters are determined for at least two of the checked state data items, at least subareas of the main memory are cleared or overwritten (120); otherwise, the main memory is not cleared or overwritten (130); then, the system startup of the computer is carried out by means of the configured system software (140).