Runtime Memory Encryption for Cloud Containers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing solutions for in-memory protection of software code and data require significant re-engineering and are limited to specific runtimes, making it difficult to protect code and data from unauthorized access and modification, especially in dynamic and diverse software development environments.
Innovation Solution
A system and method that integrates a protected memory software program conversion service with a software development pipeline, using a wrapper engine and secure engine to wrap software program code and data, generating secure counterpart code that executes in protected memory areas, such as Intel SGX enclaves, providing runtime memory encryption and access protection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing in-memory protection solutions are implemented, then code and data security is improved, but device complexity and re-engineering requirements increase significantly
Solution Approach 1:
The patent introduces a wrapper engine as an intermediary component that sits between the existing software and the protected memory area. This wrapper engine automatically handles the encryption and decryption of code and data, eliminating the need for extensive re-engineering of existing software while still providing strong security protection through the intermediary encryption layer
Solution Approach 2:
The system segments the memory into protected and unprotected areas, with only critical code and data placed in protected memory areas. This segmentation approach allows selective protection of sensitive information without requiring the entire system to be re-engineered, thus reducing overall complexity while maintaining security
2Reliability
If runtime memory encryption is implemented, then unauthorized access protection is improved, but processing overhead and execution speed may worsen
Solution Approach 1:
The encryption keys and protection mechanisms are prepared and configured in advance during system initialization or software compilation. The wrapper engine pre-establishes encryption contexts and manages key storage, so that during runtime, the encryption operations can proceed efficiently without excessive overhead, as the heavy preparation work has already been done
Solution Approach 2:
The patent applies encryption selectively only to specific code and data segments that require protection, rather than encrypting the entire memory space. This local approach ensures that only the necessary portions incur encryption overhead, while the rest of the system operates at full speed, thus minimizing the impact on overall execution performance
3Ease of operation
If protection service is integrated with software development pipeline, then ease of operation is improved, but device complexity increases
Solution Approach 1:
The wrapper engine is designed as a universal component that can work with multiple programming languages, runtime environments, and software development pipelines. By creating a multi-functional wrapper that handles various scenarios through a unified interface, the system reduces the need for separate complex integration solutions for each development environment, thus improving ease of operation without proportionally increasing complexity
Data Source
AI summary
Technologies for providing software code and data with in-memory protection through runtime memory encryption are described. A service comprising an integration component (an interface set) receives software program code and data that is to be protected in one or more protected areas of execution in memory. The integration component can integrate with a software development pipeline. The service (e.g. a wrapper engine component thereof) obtains the software program code and wraps the software program code and the data into a wrapped component. The service generates a secure counterpart program for executing in one or more protected areas of execution in memory (e.g., an enclave).