Memory Compression Security via Dynamic Decompression Timing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In cloud computing and distributed computing environments, malicious actors can exploit memory page compression to deduce secret keys by manipulating decompression times, and existing methods to prevent this often result in computational inefficiencies due to fixed worst-case decompression times.
Innovation Solution
A memory management system that estimates decompression times for memory pages and sets a constant decompression time, ensuring all pages take the same time to decompress, thereby obfuscating actual decompression times and preventing malicious deductions, while also compressing unused pages to free up memory.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If fixed worst-case decompression time is used to prevent timing attacks, then security is improved, but computational efficiency deteriorates due to unnecessary delays
Solution Approach 1:
The patent implements a dynamic decompression time management system that adapts the constant time duration based on actual decompression needs. The system monitors decompression operations and adjusts the constant time value to be the minimum required to maintain security, rather than always using a fixed worst-case value. This dynamic adjustment eliminates unnecessary delays while preserving the constant-time security property against timing attacks.
Solution Approach 2:
The system changes the parameter of decompression time from a static fixed value to a dynamically adjusted constant value. By monitoring actual decompression durations and updating the constant time parameter accordingly, the system maintains the security requirement of constant-time execution while optimizing for computational efficiency. The parameter is updated based on observed decompression patterns without compromising the constant-time property.
2Quantity of substance
If memory pages are compressed to increase memory density, then memory usage efficiency is improved, but security deteriorates due to timing attack vulnerabilities
Solution Approach 1:
The patent applies preliminary anti-action by implementing constant-time decompression operations before malicious actors can exploit timing variations. The system ensures that all decompression operations take the same constant amount of time, regardless of the actual decompression duration needed. This preliminary security measure prevents timing attacks while allowing memory compression to continue for improving memory density.
Data Source
AI summary
Systems and processes for managing memory compression security to mitigate security risks related to compressed memory page access are disclosed herein. A system for managing memory compression security includes a system memory and a memory manager. The system memory includes an uncompressed region configured to store a plurality of uncompressed memory pages and a compressed region configured to store a plurality of compressed memory pages. The memory manager identifies a memory page in the uncompressed region of the system memory as a candidate for compression and estimate a decompression time for a compressed version of the identified memory page. The memory manager determines whether the estimated decompression time is less than a constant decompression time. The memory manager, based on a determination that the estimated decompression time is less than the constant decompression time, compresses the memory page and writes the compressed memory page in the compressed region.