In-Memory Encryption Key Obfuscation via Core Dump Overwrite
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing encryption processing methods leave vulnerabilities during key handling, as keys can be accessed and stolen during core dumps or hibernations, allowing unauthorized decryption of secure files.
Innovation Solution
A method and system that minimize the time a key is in plaintext form in memory by decrypting it on-demand and discarding it immediately after use, and overwriting the key in memory during core dumps or hibernations to prevent exposure.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption keys are stored in memory for use during encryption processing, then encryption operations can be performed, but keys become accessible and vulnerable to hostile attacks during core dumps or hibernations
Solution Approach 1:
The system performs preliminary action by detecting core dump or hibernation events before they complete, and proactively overwriting the encryption key in memory during these events. This prevents the key from being captured in the core dump image or persisted in hibernation memory, thereby eliminating the vulnerability window before the hostile attack can occur.
2Productivity
If encryption keys are kept in plaintext form in memory, then encryption processing is efficient, but the time window for vulnerability exposure increases
Solution Approach 1:
The system changes the state parameter of the encryption key from plaintext to overwritten/obscured state during core dump or hibernation events. This parameter change occurs dynamically based on system events, allowing the key to remain in plaintext during normal encryption processing (maintaining productivity) while being transformed to a secure state during vulnerable operations (reducing exposure time).
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
A method for obfuscating keys is provided. The method includes identifying that a memory is subject to one of a core dump or an hibernation and overwriting a key in unencrypted form in the memory, responsive to the identifying, wherein at least one method operation is performed by a processor. A system and a computer readable media are also provided.