Secure Communication Memory Partitioning for Session Key Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer systems are vulnerable to architectural flaws that allow hackers to access memory associated with different connection sessions, compromising security, and current solutions either introduce significant latency or increase costs and complexity without maintaining performance or efficiency.
Innovation Solution
Implement a system where session keys and keying material are stored in separate physical memory locations, accessible only via unique handles associated with each connection, using virtual addresses mapped to physical addresses on a per-core basis, ensuring secure and efficient communication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If memory is partitioned as a single contiguous block to simplify architecture and improve processor efficiency, then ease of operation and productivity are improved, but security is worsened due to vulnerability to attacks like Heartbleed that can access memory of other connection sessions
Solution Approach 1:
The patent divides the single contiguous memory block into multiple separate memory partitions, with each partition dedicated to storing session keys and keying material for a specific connection session. This segmentation isolates memory access so that a security vulnerability in one connection cannot compromise other connections, directly resolving the security issue while maintaining architectural simplicity through controlled memory separation.
2Reliability
If separate processes are assigned to each connection session to prevent memory access by other sessions, then security is improved, but latency increases and processor demands increase significantly
Solution Approach 1:
The patent extracts the security isolation mechanism from the process level and implements it at the memory level instead. By assigning separate memory partitions to each connection session and controlling access through memory management, the system achieves security without requiring separate processes for each connection, thereby eliminating the associated latency and processor overhead while maintaining security.
3Reliability
If a separate hardware security module is used to store session keys in isolated hardware, then security is improved, but device complexity and cost increase
Solution Approach 1:
The patent makes the existing system memory serve multiple functions: it continues to store general system data while simultaneously providing isolated partitions for secure storage of session keys and keying material. By implementing memory partitioning and access control within the existing memory infrastructure, the system achieves security without requiring separate hardware security modules, thereby avoiding increased device complexity and cost.
Data Source
AI summary
The present disclosure is directed to preventing computer data from being usurped and exploited by individuals or organizations with nefarious intent. Methods and systems consistent with the present disclosure may store keys and keying data for each of a plurality of connections in separate memory locations. These memory locations may store data that maps a virtual address to a physical memory address associated with storing information relating to a secure connection. These separate memory locations may have a unique instance for each individual communication connection session, for example each transport layer security (TLS) connection may be assigned memory via logical addresses that are mapped to one or more physical memory addresses on a per-core basis. Such architectures decouple actual physical addresses that are used in conventional architectures that assign a single large continuous physical memory partition that may be accessed via commands that access physical memory addresses directly.