Self-Correcting Secure Computer System Memory Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current operating systems executed from persistent memory are vulnerable to persistent attacks due to resource-intensive integrity verification and configuration tracking, and securing encryption keys is challenging, especially when aspects of the encryption process are known, leading to potential reverse-engineering of keys.
Innovation Solution
A self-correcting secure computer system that loads a trusted operating system configuration from read-only memory (ROM) into volatile random-access memory (RAM) during boot, automatically erases volatile memory upon shutdown or reboot, and disconnects from networks before accessing encryption protocols to prevent malicious activities and protect key generation processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Duration of action of stationary object
If the operating system is executed from persistent memory, then the system can maintain data across power cycles, but the system becomes vulnerable to persistent attacks and integrity verification becomes resource intensive and time consuming
Solution Approach 1:
The patent divides the memory system into two distinct segments: persistent memory for data storage and volatile memory for executing the operating system. This segmentation allows the system to maintain data persistence while eliminating security vulnerabilities associated with executing code from persistent memory, as the OS is loaded into a separate volatile memory space that can be cleared on reboot.
Solution Approach 2:
The patent extracts the operating system from persistent memory and places it in volatile memory for execution. This extraction removes the OS from the vulnerable persistent storage environment, allowing integrity verification to occur in a controlled volatile memory space that can be securely cleared after use, thereby resolving the security vulnerability while maintaining data persistence capabilities.
2Reliability
If integrity verification of the operating system is performed in persistent memory, then security is improved, but the process becomes resource intensive and time consuming due to lengthy random access times
Solution Approach 1:
The patent introduces volatile memory as an intermediary between persistent memory and the CPU for OS execution and verification. Integrity verification is performed on the OS copy in volatile memory, which provides much faster random access times compared to persistent memory. This intermediary approach maintains security through verification while dramatically improving productivity by eliminating the slow random access bottleneck of persistent memory.
3Reliability
If encryption keys are secured through encryption, then security is improved, but reverse-engineering of keys becomes possible if certain aspects of the encryption process are known
Solution Approach 1:
The patent changes the state of encryption keys from persistent to transient by generating them in volatile memory during OS execution and clearing them upon shutdown. This parameter change (from persistent storage to ephemeral existence in volatile memory) fundamentally alters the security model, making reverse-engineering impossible since the keys never exist in a state that could be extracted or analyzed, thereby improving key security without adding encryption process complexity.
Data Source
AI summary
A self-correcting secure computer system is provided. The computer system includes a read-only memory (ROM) device, a random access memory (RAM) device, and at least one processor in communication with the ROM device and the RAM device. The at least one processor is programmed to receive an activation signal; retrieve, from the ROM device, data to execute an operating system; execute, on the RAM device, the operating system based on the data from the ROM device; receive a clear RAM signal; end execution of the operating system on the RAM device; and depower the RAM device such that all data on the RAM device is deleted.