Encrypted Cache Protection with Unauthorized Decryption Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computing devices lack effective methods to detect and prevent unauthorized access to encrypted secrets such as secure session cookies, which are often targeted by malicious actors.
Innovation Solution
Implementing multiple layers of encryption for key material controlling cryptographic access and instrumenting compute instances to detect unauthorized decryption attempts, comparing the requesting process to authorized users.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple layers of encryption are implemented for key material, then security protection is improved, but device complexity increases
Solution Approach 1:
The encryption system is divided into multiple independent layers: an outer encryption layer protecting the secret and an inner encryption layer protecting the key material. Each layer operates independently with its own key management, creating a segmented security architecture that enhances protection while maintaining manageable complexity through modular design.
Solution Approach 2:
The patent implements nested encryption where one encryption layer is placed inside another. The inner encryption layer protects the key material, while the outer encryption layer protects the secret. This nested structure allows each layer to provide security without knowing the details of the other layers, resolving the contradiction by organizing complexity hierarchically.
2Reliability
If compute instances are instrumented to detect unauthorized decryption attempts, then security detection capability is improved, but device complexity increases
Solution Approach 1:
An intermediary component is introduced between the decryption process and the secret data. This intermediary monitors decryption attempts by observing key material access patterns and comparing them against authorized user profiles. The intermediary handles the complexity of detection logic separately from the core decryption function, improving detection capability while containing complexity in a dedicated module.
Solution Approach 2:
The system implements self-service monitoring where the compute instance automatically detects and reports unauthorized decryption attempts without requiring external surveillance. The instrumentation enables the system to self-monitor its own security state by tracking key material access and comparing it against authorized patterns, improving detection while reducing the need for additional external complexity.
Data Source
AI summary
Secrets such as secure session cookies for a web browser can be protected on a compute instance with multiple layers of encryption, such as by encrypting key material that in turn controls cryptographic access to the secret. A compute instance can be instrumented to detect when a process attempts to decrypt this key material so that the process requesting decryption can be compared to authorized or legitimate users of the secret.