Memory Dump Encryption with Key-Encrypting Key
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for memory dumps in cloud computing environments do not adequately secure sensitive information, as memory contents are typically stored unencrypted, making them vulnerable to unauthorized access both within and outside an organization.
Innovation Solution
A computing system is used to encrypt memory contents of a server upon detecting a memory dump trigger condition, generating a symmetric key for encryption and encrypting it with a public key from a digital certificate, ensuring secure storage and decryption for authorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If memory contents are stored unencrypted for diagnostic access, then ease of operation is improved, but security is worsened
Solution Approach 1:
The system performs preliminary encryption of memory contents before storing them to disk or in cloud storage. This advance protective measure ensures that even if the stored memory dump is accessed unauthorized, the sensitive information remains encrypted and inaccessible without the decryption key.
Solution Approach 2:
The patent introduces an intermediary decryption key management mechanism that controls access to encrypted memory contents. The key is encrypted and stored separately, requiring authentication through the key management service for decryption, thus mediating between the need for diagnostic access and security protection.
2Object-affected harmful factors
If memory contents are encrypted for security, then security is improved, but ease of operation is worsened
Solution Approach 1:
The key management service acts as an intermediary that simplifies access to encrypted memory contents. Developers can request decryption keys through authenticated API calls, and the system automatically manages the decryption process, maintaining ease of operation while ensuring security through controlled key distribution.
Solution Approach 2:
The system implements self-service capabilities where authorized users can independently obtain decryption keys through the key management service without requiring manual intervention. The automated key management and decryption processes allow developers to access encrypted memory dumps on-demand while maintaining security controls.
3Device complexity
If encryption keys are stored with encrypted memory contents, then device complexity is reduced, but security is worsened
Solution Approach 1:
The patent segments the key management functionality into a separate, dedicated key management service distinct from the application servers. This segmentation isolates key storage and management, allowing for specialized security measures in the key service while keeping the main system simple. The key service can implement enhanced security controls without complicating the core application logic.
Solution Approach 2:
The key management service serves as an intermediary layer between the encrypted memory contents and the decryption keys. This intermediary architecture allows keys to be stored securely in a dedicated service with specialized security measures, while the main system remains relatively simple. The intermediary manages key encryption, storage, and distribution, preventing direct exposure of keys in the main system.
Data Source
AI summary
Disclosed are some implementations of systems, apparatus, methods and computer program products for securing memory dumps. In response to a trigger condition, a server generates a symmetric key corresponding to an instance of a memory dump. The server encrypts memory contents of the server using the symmetric key. In addition, the server encrypts the symmetric key using a key-encrypting key (kek), which can include a public key Both the encrypted memory contents and the encrypted symmetric key are stored for the instance of the memory dump. Responsive to a request for information pertaining to the instance of the memory dump, the encrypted memory contents and the encrypted symmetric key are retrieved from storage, the encrypted symmetric key is decrypted using a private key, and the symmetric key is used to decrypt the encrypted memory contents.