Protected Data Memory with Dynamic Re-Encryption Against Memory Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional data storage techniques in computing devices are vulnerable to memory attacks, require static protected memory, are not transparent to users, and suffer from performance degradation, making them unreliable for secure data storage.
Innovation Solution
A system with an encoder and decoder integrated in a single thread of execution that dynamically re-encrypts data using new encryption information each time it is read or written, ensuring data is never stored in unencrypted form, and operates independently of operating systems and hardware vulnerabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional encryption techniques with fixed keys are used, then data storage security is provided, but the system becomes vulnerable to memory attacks and hardware vulnerabilities
Solution Approach 1:
The patent applies dynamics by transforming static encryption keys into dynamic, frequently changing encryption parameters. The system generates new encryption keys through cryptographic operations involving multiple input values, ensuring that encryption parameters evolve over time rather than remaining fixed, thereby preventing exploitation through static analysis or memory attacks
Solution Approach 2:
The patent implements parameter changes by continuously modifying encryption keys and related cryptographic parameters. Instead of using fixed encryption keys, the system generates new keys through cryptographic operations that incorporate changing input values, ensuring that the cryptographic parameters are in constant flux to prevent vulnerability to memory attacks
2Reliability
If runtime memory is isolated from protected memory by hardware or operating system, then data protection is provided, but computing performance is severely reduced
Solution Approach 1:
The patent merges the functions of encryption key management and data processing into a unified system. By integrating cryptographic operations directly into the data processing workflow and using the same memory space for both encrypted and unencrypted data with dynamic key transformation, the system eliminates the need for separate protected memory regions while maintaining security
Solution Approach 2:
The system performs self-service by automatically generating new encryption keys through cryptographic operations involving multiple input values without requiring external key management infrastructure. The encryption keys are derived on-demand from input values, eliminating the need for separate key storage or management systems that would otherwise impact performance
3Reliability
If data is encrypted using fixed encryption keys selected by user or software application, then data security is provided, but the system cannot be trusted as security implementations are not transparent to users
Solution Approach 1:
The patent implements feedback by using multiple input values (including user-provided values, timestamps, and other variables) to generate encryption keys through cryptographic operations. This creates a transparent system where users can verify that their input values are being used to derive the encryption keys, providing visibility into the security mechanism while maintaining strong encryption
Solution Approach 2:
The patent introduces intermediary cryptographic operations that transform user-provided input values into encryption keys through deterministic but complex mathematical processes. These intermediary steps act as a bridge between user input and the encryption mechanism, providing transparency while maintaining security through the use of established cryptographic algorithms
Data Source
AI summary
A system for providing protected data storage in a data memory of a computing device has an encoder and a decoder. The encoder encrypts unencrypted data using encryption information to generate encrypted data, and stores the encrypted data and the encryption information in an allocated portion of the data memory. The decoder accesses the encrypted data and the encryption information from the allocated portion of the data memory, and decrypts the encrypted data using the encryption information to re-generate the unencrypted data. Each time the unencrypted data is read from the allocated portion of the data memory or the unencrypted data is to be written to the allocated portion of the data memory, the encoder re-encrypts the unencrypted data using newer encryption information to generate newer encrypted data, and replaces previous encrypted data and previous encryption information with the newer encrypted data and the newer encryption information, respectively, in the allocated portion of the data memory. The encoder and the decoder are integrated, so as to operate in a single thread of execution.