Kernel-Level Cryptographic Separation via Mandatory Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems fail to ensure cryptographic separation between plaintext and ciphertext data, leading to potential security breaches when sensitive information is transmitted or stored, as encryption is not consistently enforced at the operating system kernel level.
Innovation Solution
Implementing containment mechanisms using trusted operating systems, such as HP Trusted Linux, with mandatory system access controls and compartmentalization to enforce encryption at the operating system kernel level, ensuring that plaintext data is processed through an encryption engine before transmission or storage, and specifying communication rules to maintain separation between plaintext and ciphertext resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption is implemented at the application level, then encryption functionality is provided, but cryptographic separation between plaintext and ciphertext cannot be ensured
Solution Approach 1:
The system divides the encryption functionality into separate compartments: a plaintext compartment for unencrypted data, a ciphertext compartment for encrypted data, and an encryption engine compartment that bridges them. This segmentation ensures that plaintext and ciphertext are physically separated in memory and cannot be accessed by the same process, thereby guaranteeing cryptographic separation while maintaining manageable system complexity through structured organization.
Solution Approach 2:
The encryption engine acts as an intermediary component between the plaintext and ciphertext compartments. It is the only system resource permitted to access both compartments simultaneously, serving as a controlled bridge that transforms plaintext to ciphertext while maintaining security boundaries. This intermediary approach enables cryptographic separation by preventing direct access between plaintext and ciphertext regions.
2Reliability
If plaintext and ciphertext are stored in the same system resource, then storage efficiency is improved, but security policy compliance deteriorates
Solution Approach 1:
The system implements separate system resources (memory compartments) for plaintext and ciphertext data. The plaintext compartment stores unencrypted data while the ciphertext compartment stores encrypted data, with the encryption engine compartment serving as the transformation bridge. This segmentation ensures security policy compliance by preventing unauthorized access to plaintext while maintaining organized data management through clear separation of concerns.
3Reliability
If mandatory encryption is enforced at the kernel level, then cryptographic separation is ensured, but system complexity increases
Solution Approach 1:
The operating system kernel implements mandatory access control rules that designate the encryption engine as the sole intermediary permitted to access both plaintext and ciphertext compartments. This kernel-level enforcement ensures cryptographic separation by preventing any other process or system resource from accessing plaintext data, while the structured intermediary approach keeps the added system complexity manageable through clear access control policies.
4Ease of operation
If encryption engine has access to both plaintext and ciphertext, then encryption functionality is enabled, but risk of compromise increases
Solution Approach 1:
The encryption engine is isolated in its own dedicated compartment that is distinct from both the plaintext and ciphertext compartments. This segmentation ensures that the encryption engine has programmatic access to perform its function while the operating system's mandatory access control rules prevent any compromise of the plaintext or ciphertext data. The structured isolation reduces security risk by limiting the attack surface to the encryption engine compartment alone.
Data Source
AI summary
To provide for cryptographic separation, embodiments of the invention employ containment mechanisms provided by trusted operating systems to ensure that plaintext data which must be encrypted in accordance with a security policy (or, in reverse, ciphertext data which is to be decrypted) is processed by a suitable encryption routine before being sent onwards for transmission, storage, or the like. Such containment mechanisms usually include mandatory system access control rules which specify to which system resources the output of a system resource (such as an application) may be supplied. By specifying a suitable set of such rules, mandatory encryption can be enforced at the operating system kernel level.