Policy Protected Cryptographic API in Secure Memory
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Security concerns arise due to unprotected access of applications to cryptographic APIs, which can lead to misuse or breaches, and require developers to have sufficient knowledge of cryptographic parameters to ensure compliance with security policies.
Innovation Solution
Implementing policy-protected cryptographic APIs deployed in secure memory partitions, where the cryptographic API implementation runs in a separate and secure processing space from the application, with a policy checking algorithm that evaluates requests against predefined security policies to ensure compliance and prevent unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If cryptographic APIs run in the same process space as the application, then ease of operation is improved, but security is worsened due to unprotected access
Solution Approach 1:
The system divides the process space into separate secure and non-secure regions. The cryptographic API implementation is isolated in a protected memory space, while the application runs in a non-secure space. This segmentation allows the application to easily call cryptographic functions while preventing unauthorized access to the API implementation and its keys.
Solution Approach 2:
A secure interface layer acts as an intermediary between the non-secure application and the secure cryptographic API implementation. This intermediary validates requests, enforces security policies, and manages key access, allowing easy application operation while maintaining security boundaries.
2Adaptability or versatility
If developers have full access to cryptographic parameters, then adaptability is improved, but security is worsened due to potential misuse
Solution Approach 1:
Different levels of access and control are applied to different cryptographic parameters. Sensitive parameters like keys are protected and accessed only through controlled interfaces, while less sensitive parameters can be configured by the application. This allows adaptability where needed while maintaining security where required.
Solution Approach 2:
The system implements policy checking algorithms that evaluate cryptographic requests against predefined security policies. This feedback mechanism allows the system to adaptively control access based on security requirements, enabling legitimate cryptographic operations while blocking potentially harmful ones.
3Reliability
If cryptographic API is isolated in secure memory, then security is improved, but device complexity is worsened
Solution Approach 1:
The secure cryptographic API implementation is combined with the application in the same overall process space, but with internal memory segmentation. This merging approach maintains security through isolation while avoiding the complexity of completely separate systems, allowing straightforward integration and communication.
Data Source
AI summary
Systems, methods, and apparatus are provided for policy protected cryptographic Application Programming Interfaces (APIs) that are deployed in secure memory. One embodiment is a method of software execution. The method includes executing an application in a first secure memory partition; formatting a request to comply with a pre-defined secure communication protocol; transmitting the request from the application to a cryptographic application programming interface (API) of the application, the API being in a second secure memory partition that is separate and secure from the first secure memory partition; and verifying, in the second secure memory partition, that the request complies with a security policy before executing the request.