Dynamic Data Re-Encryption for Memory Attack Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for protecting data storage in computing devices are vulnerable to memory attacks, such as Meltdown and Spectre, and rely on untrustworthy hardware and operating system implementations, leading to security concerns and performance degradation.
Innovation Solution
A system comprising an encoder and a decoder that dynamically re-encrypts data using new encryption information each time it is read or written, ensuring that data is never stored unencrypted, and operates within a single thread of execution to prevent interruptions and unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional encryption techniques with fixed keys are used, then data storage is protected, but the system becomes vulnerable to memory attacks and hardware vulnerabilities
Solution Approach 1:
The patent implements dynamic re-encryption where encryption keys are continuously changed and updated during runtime. The system periodically re-encrypts data with new keys and updates encryption parameters, transforming the static encryption approach into a dynamic one that adapts to security threats and prevents attacks that exploit fixed cryptographic parameters.
Solution Approach 2:
The system changes cryptographic parameters including encryption keys, initialization vectors, and other security parameters during operation. By dynamically modifying these parameters rather than using fixed values, the system prevents attacks that target specific cryptographic implementations while maintaining data protection reliability.
2Reliability
If hardware-based protection mechanisms are implemented, then data security is improved, but manufacturing cost increases
Solution Approach 1:
The patent replaces hardware-based security mechanisms with software-based cryptographic operations. Instead of relying on specialized security hardware modules that increase manufacturing complexity and cost, the system uses software implementations of encryption and key management that can be deployed on standard computing hardware, thereby reducing manufacturing costs while maintaining security.
Solution Approach 2:
The system implements self-managed security where the software handles key generation, encryption, and security management without requiring external hardware security modules. This self-service approach to security eliminates the need for expensive hardware-based protection mechanisms while maintaining data security through software-based cryptographic operations.
3Reliability
If memory isolation techniques are used, then protection against unauthorized access is improved, but computing performance deteriorates
Solution Approach 1:
The patent applies encryption selectively to specific data regions and operations rather than isolating entire memory spaces. By encrypting only the necessary portions of data and using efficient cryptographic operations, the system provides protection against unauthorized access without the severe performance penalties associated with comprehensive memory isolation techniques.
Solution Approach 2:
The system maintains continuous data protection through efficient encryption operations that do not interrupt normal computing workflows. By optimizing the encryption process to run continuously without blocking critical operations, the system provides security while minimizing performance degradation compared to interrupt-based isolation approaches.
Data Source
Figure 1A
Figure 1B
Figure 2
AI summary
There is provided a system (100) for providing protected data storage in a data memory (102) of a computing device. The system (100) comprises an encoder (104) and a decoder (106). The encoder (104) encrypts unencrypted data (D1) using encryption information to generate encrypted data (E2), and stores the encrypted data (E2) and the encryption information in an allocated portion of the data memory (102). The decoder (106) accesses the encrypted data (E2) and the encryption information from the allocated portion of the data memory (102), and decrypts the encrypted data (E2) using the encryption information to re-generate the unencrypted data (D1). Each time the unencrypted data (D1) is read from the allocated portion of the data memory (102) or the unencrypted data (D1) is to be written to the allocated portion of the data memory (102), the encoder (104) re-encrypts the unencrypted data (D1) using newer encryption information to generate newer encrypted data (EN+1), and replaces previous encrypted data (EN) and previous encryption information with the newer encrypted data (EN+1) and the newer encryption information, respectively, in the allocated portion of the data memory (102). The encoder (104) and the decoder (106) are integrated, so as to operate in a single thread of execution.