Dynamic Key Relocation in Cloud Memory
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In cloud computing environments, high security modules (HSMs) are expensive and not ubiquitously available, posing security risks due to the vulnerability of storing encryption keys in memory, especially in public cloud settings where allocated memory is elastic and can be reallocated, making it susceptible to advanced persistent threats and automated attacks that can dump and crack keys.
Innovation Solution
Implementing a key management monitor that continuously changes the location of encryption keys, key masks, and shuffle indices within memory on a periodic or random basis, ensuring that the location address of at least one key element is changed within a time period less than the time required for an external data dump, thereby protecting keys from being dumped by malicious attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If encryption keys are stored in memory in cloud environments, then key accessibility and operation speed are improved, but security vulnerability increases due to memory dumping attacks
Solution Approach 1:
The patent implements dynamic key storage by continuously changing the memory location addresses where encryption keys, key masks, and shuffle indices are stored. The key management monitor periodically updates these locations, ensuring that even if an attacker dumps memory contents, the keys cannot be reconstructed because they were moved during the dumping process. This dynamic relocation resolves the contradiction by maintaining fast in-memory access while preventing static analysis attacks.
Solution Approach 2:
The system performs preliminary protective actions by pre-establishing the key management monitor that continuously monitors and relocates key elements before attackers can dump the memory. The periodic changing of key element locations occurs proactively, ensuring that when a memory dump attack occurs, the keys have already been moved to new locations, making reconstruction impossible. This preliminary action prevents the security vulnerability while maintaining operational speed.
2Reliability
If high security modules (HSMs) are deployed to protect encryption keys, then security strength is improved, but cost and device availability worsen
Solution Approach 1:
The patent replaces expensive HSM hardware with a software-based key management approach using ordinary computer memory and a key management monitor. Instead of relying on costly dedicated security hardware, the system uses volatile memory with continuously changing key element locations. This software-based solution achieves comparable security protection without the high cost and limited availability of HSMs, effectively resolving the contradiction between security strength and device complexity.
Solution Approach 2:
The patent substitutes the mechanical/Hardware-based HSM system with a software-based key management mechanism. The key management monitor, implemented as software, performs the security function previously requiring dedicated hardware modules. This substitution eliminates the need for expensive HSM devices while maintaining security protection through continuous key element relocation, resolving the contradiction between security strength and device complexity/cost.
3Ease of operation
If key elements are stored statically in memory, then operation simplicity is improved, but susceptibility to attacks increases
Solution Approach 1:
The patent transforms the static storage of key elements into a dynamic system where the key management monitor continuously changes the memory location addresses of encryption keys, key masks, and shuffle indices. This dynamic relocation occurs periodically, ensuring that even simple memory access operations remain secure because the keys are not stationary. The dynamic approach maintains operational simplicity while eliminating the vulnerability of static key storage to dumping attacks.
Data Source
AI summary
Systems and methods for managing keys in a computer memory are described. In some embodiments, location addresses are determined for two key elements. A periodic time interval that is based on a time duration for performing a transaction involving a distance between the key elements is determined. One key element may be stored at a location address and then relocated to another location address after the periodic time interval has passed. In some embodiments, areas the computer memory may remain static during relocation of the key element.