Encrypted Core Dump Key Regeneration via Remote Key Server
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in securely managing encrypted core dumps to prevent private key leakage and ensure efficient decryption without delaying network transfer, while maintaining the integrity of the core dump process.
Innovation Solution
A system comprising an encryptor, decryptor, and remote key server (RKS) that uses a symmetric key generation mechanism, where the encryptor encrypts the core dump with a symmetric key, the decryptor extracts metadata to regenerate the key at the RKS, and the RKS shares the regenerated key securely with the decryptor for decryption, ensuring secure key management and in-place decryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the symmetric key is stored securely, then security is improved, but access time and decryption speed deteriorate
Solution Approach 1:
The system performs preliminary actions by pre-computing and storing key derivation parameters (salt, iteration count) alongside the encrypted core dump. When decryption is needed, the system retrieves these pre-stored parameters and uses them to regenerate the symmetric key, eliminating the need for time-consuming key search or generation operations during the critical decryption phase.
Solution Approach 2:
The patent introduces an intermediary key management service that acts as a mediator between the secure key storage system and the decryption process. This intermediary service handles the complex key regeneration and retrieval operations, allowing the decryption process to access keys efficiently without directly interacting with the secure storage mechanisms, thus reducing access time while maintaining security.
2Reliability
If the core dump is encrypted with a symmetric key, then security is improved, but the complexity of key management increases
Solution Approach 1:
The patent extracts the key management complexity from the core dump encryption process by separating key generation, storage, and regeneration operations into a dedicated key management service. The encrypted core dump itself only contains the ciphertext and minimal metadata, while all complex key management operations are performed externally by the service, simplifying the core dump structure and the decryptor implementation.
Solution Approach 2:
The key management service implements self-service mechanisms where the system automatically regenerates symmetric keys using stored seed material and pre-computed parameters when needed. This eliminates the need for manual key management, reduces the complexity burden on the decryptor, and allows the system to maintain security without requiring complex user intervention or external key management infrastructure.
3Reliability
If the symmetric key is regenerated, then security is improved, but processing time and computational resources increase
Solution Approach 1:
The system performs preliminary computational actions by pre-generating and storing cryptographic parameters (salt values, iteration counts, key derivation functions) alongside the encrypted core dump. When regeneration is needed, the system only needs to execute the pre-defined key derivation algorithm with the stored parameters, significantly reducing the computational burden compared to generating all cryptographic material from scratch.
Solution Approach 2:
The patent applies partial action by regenerating only the necessary portion of the key material rather than the entire key management system. The system regenerates the symmetric key using a deterministic algorithm based on stored seed material and parameters, which is computationally efficient compared to full key generation or cryptographic operations, thus reducing processing time and resource consumption while maintaining security.
Data Source
AI summary
A method of a decryptor including receiving, from an encryptor of an electronic device, a core dump that has been encrypted with a symmetric key generated by the encryptor, and core dump metadata, extracting crash metadata from the core dump metadata, transmitting the crash metadata to a remote key server for regenerating the symmetric key, obtaining, from the remote key server, a regenerated symmetric key based the crash metadata, and decrypting the core dump based on the regenerated symmetric key and the crash metadata.