Kernel Key Handling for Large Encryption Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Storing large encryption keys in kernel memory can consume significant volatile memory, leading to reduced available memory and system inefficiency, especially when thousands of such keys are stored, as they cannot be paged out like other data.
Innovation Solution
Implementing a 'big key data type' that determines if the key size exceeds a threshold, allocating pageable memory outside the kernel for large keys, and storing a pointer to this memory within the kernel, allowing the bulk data to be paged out to non-volatile memory while maintaining security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If large encryption keys are stored within kernel memory, then security is maintained, but volatile memory consumption increases significantly
Solution Approach 1:
The patent segments the key storage into two parts: the key handle and metadata remain in kernel memory for security, while the actual key data is stored in a separate buffer in user space. This segmentation allows the system to maintain security requirements while reducing kernel memory consumption.
Solution Approach 2:
The patent extracts the bulk key data from kernel memory and places it in user space buffer memory. Only essential references (pointers/handles) and metadata remain in kernel memory, significantly reducing the quantity of volatile memory consumed by the kernel while maintaining the ability to access and protect the keys.
2Adaptability or versatility
If thousands of large encryption keys are stored in kernel memory, then comprehensive key management is achieved, but available memory for other uses is reduced
Solution Approach 1:
By segmenting key storage between kernel and user space, the system can manage thousands of large keys without proportionally increasing kernel memory consumption. Each key's handle and metadata occupy minimal kernel memory space, while the bulk data resides in user space, preserving memory for other system uses.
Solution Approach 2:
The patent introduces a key handle as an intermediary between the kernel and the actual key data stored in user space. This handle serves as a reference that allows the kernel to access and manage keys without storing the entire key data in kernel memory, enabling efficient management of numerous large keys.
3Quantity of substance
If encryption keys are stored outside kernel memory in pageable memory, then volatile memory availability is improved, but security may be compromised
Solution Approach 1:
The patent segments key-related data into different security zones: sensitive metadata (key handle, permissions, state) remains in secure kernel memory, while the actual key data is stored in user space buffer memory. This segmentation allows pageable memory to be used for key data while maintaining security through proper isolation and access control.
Solution Approach 2:
The patent applies different security qualities to different parts of the key storage system. The kernel memory portion contains only essential metadata with strict access controls, while the user space buffer contains the bulk key data with appropriate memory protection. This local differentiation of security qualities allows optimization of both security and memory availability.
Data Source
AI summary
According to one example, a method performed by a computing system includes determining that a size of key data to be stored within a kernel memory is greater than a threshold value. The threshold value is based on a size value associated with maintaining the key data outside of the kernel memory. The method further includes allocating a block of memory within a volatile memory store, the block of memory being outside the kernel memory, storing the key data within the block of memory, and storing, within the kernel memory, a pointer to the key data.