Runtime Integrity Checking for Tamper Detection in Volatile Memory
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing integrity check methods primarily focus on non-volatile memory, neglecting the need for protection of data stored in volatile main memory, which can be tampered with, leading to erroneous outputs or system vulnerabilities.
Innovation Solution
Implement a method for runtime integrity check using a security core with a one-way encryption algorithm to generate and compare output values in the main memory, ensuring data integrity by periodically changing encryption keys and performing checks on both volatile and non-volatile memory.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If integrity check is performed only on non-volatile memory, then data persistence is maintained, but data in volatile main memory can be tampered with leading to erroneous outputs
Solution Approach 1:
The patent divides the memory system into two segments: non-volatile memory for persistent storage and volatile main memory for active data storage. It applies integrity check mechanisms selectively to both segments, with different approaches for each. The security core independently manages integrity checks for both memory types, ensuring comprehensive protection while maintaining the functional advantages of each memory segment.
Solution Approach 2:
The patent introduces a security core as an intermediary component that mediates between the main memory and the integrity verification process. This security core generates random numbers, performs encryption operations, and compares output values to detect tampering. The intermediary approach allows the system to maintain normal memory operations while providing continuous integrity monitoring.
2Speed
If data is stored in main memory for fast access, then processing speed is improved, but data can be tampered with and lost when power is disconnected
Solution Approach 1:
The patent segments the memory architecture to maintain fast access for volatile memory while providing integrity protection through the security core. The segmentation allows each memory type to fulfill its primary function optimally: speed for volatile memory and persistence for non-volatile memory, with the security core providing additional integrity layer.
Solution Approach 2:
The patent applies preliminary action by storing random numbers and encryption keys in non-volatile memory before they are needed for integrity checks in volatile memory. This ensures that the integrity verification mechanism is pre-prepared and can immediately protect data in volatile memory when power is connected, without requiring additional setup time.
3Reliability
If integrity check is performed on all data in main memory, then data security is improved, but system complexity and processing overhead increase
Solution Approach 1:
The patent applies local quality by providing different levels of integrity protection to different data in main memory based on their sensitivity and importance. Not all data requires the same level of protection, so the system selectively applies encryption and verification mechanisms to critical data structures while maintaining simpler handling for less sensitive data, thereby reducing overall system complexity.
Solution Approach 2:
The security core performs self-service by generating its own random numbers and encryption keys independently, and by automatically comparing output values without requiring external intervention. This self-contained approach simplifies the overall system architecture by eliminating the need for complex external verification mechanisms and manual security management.
4Reliability
If encryption keys are changed periodically, then security against tampering is improved, but processing time for integrity checks increases
Solution Approach 1:
The patent implements periodic action by changing encryption keys at predetermined intervals rather than continuously. This periodic key rotation provides security against tampering while allowing the system to optimize processing time between key changes. The security core manages key rotation automatically, balancing security requirements with performance considerations.
Solution Approach 2:
The patent applies preliminary action by pre-storing random numbers and encryption keys in non-volatile memory before they are needed for integrity checks. This preparation allows the security core to quickly retrieve and use these resources without performing time-consuming generation operations during the actual integrity verification process, thereby reducing processing time.
Data Source
AI summary
A method for runtime integrity check, performed by a security core including one or more processors includes storing a first output value, which is generated by using a one-way encryption algorithm based on first data and a first encryption key managed by an encryption key manager accessible by the security core, in a main memory that is a volatile memory in association with the first data, generating a second output value for the first data based on the first data and the first encryption key by using the one-way encryption algorithm, and checking for possible tampering of the first data stored in the main memory by comparing the first output value with the generated second output value.