Cryptographic Key Scattering in Cloud VM RAM
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud computing environments face significant security challenges in protecting cryptographic keys stored in virtual machine (VM) RAM, as they are vulnerable to unauthorized access and extraction by malicious administrators, co-tenants, or external attackers, leading to potential decryption of sensitive information.
Innovation Solution
A method employing decrypt-scatter and gather-decrypt techniques using a plurality of key chunks, where each chunk is stored in randomly generated memory addresses, and a round key is calculated on-the-fly, avoiding storage in memory locations, ensuring that only one byte of the key is reconstructed at a time for AES encryption, utilizing a Pseudo Random Number Generator (PRNG) for address generation and integrating with existing cloud architectures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic keys are stored in VM RAM for encryption/decryption operations, then encryption functionality is enabled, but keys become vulnerable to unauthorized access and extraction by malicious administrators or attackers
Solution Approach 1:
The cryptographic key is divided into multiple key chunks that are scattered across different random memory addresses in VM RAM. Each chunk alone is insufficient for decryption, and the scattered distribution prevents attackers from extracting the complete key even if they access VM RAM, as demonstrated in the patent where a 128-bit key is split into multiple segments stored at non-contiguous addresses
Solution Approach 2:
The patent introduces a key scattering mechanism as an intermediary between key storage and key usage. Instead of storing the complete key in a single location, the system uses scattered key chunks that require a gathering process to reconstruct the key only when needed for encryption/decryption operations, preventing direct extraction by attackers
2Productivity
If complete cryptographic keys are assembled in memory for processing, then encryption operations can be performed efficiently, but the risk of key exposure to malicious insiders increases
Solution Approach 1:
The patent implements dynamic key assembly where key chunks are gathered from scattered memory addresses only when encryption or decryption operations are required. The complete key exists in memory temporarily only during active processing, and is immediately scattered again after use. This dynamic approach balances processing efficiency with security by minimizing the time the complete key is assembled in memory
Solution Approach 2:
The key chunks are pre-scattered to random memory addresses before any encryption operation begins. This preliminary scattering action ensures that even if an insider attacker has access to VM RAM, the complete key is not available for extraction until the gathering process is initiated, which occurs only under controlled conditions during legitimate encryption/decryption operations
3Reliability
If key chunks are stored in scattered random memory addresses, then key extraction is prevented, but memory access complexity increases
Solution Approach 1:
The patent implements self-service mechanisms where the same cryptographic module that encrypts data also manages the scattering and gathering of key chunks. The system generates random memory addresses for scattering and maintains the mapping information internally, eliminating the need for external key management infrastructure and reducing overall system complexity despite the scattered storage approach
Data Source
AI summary
An improved method or security solution for securing cryptographic keys in a virtual machine RAM. A security solution is proposed to hide cryptographic keys in the cloud, without the necessity of any architectural modifications. The present solution requires the availability of a Trusted Platform Module (TPM) capable of creating and holding a protected public/private key pair. It lends itself to security-as-a-service scenarios where third parties perform encryption or decryption on behalf of data owners. This allows the present solution to be easily integrated and coupled with other existing cloud architectures. A decrypt-scatter or gather-decrypt solution which allows users to carry out encryption or decryption while protecting keys from unauthorized peeks by the cloud administrators is proposed.