Secure Processor Execution of Encrypted Instructions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software security technologies fail to adequately protect proprietary algorithms from reverse engineering and unauthorized duplication, especially after system boot, and are vulnerable to hardware attacks like cold-boot RAM attacks.
Innovation Solution
A method and system for securely executing encrypted executables by decrypting instructions using a decryption key stored in a secure location within the processor, and storing the decrypted instructions in a secure storage area, such as a permissions-protected memory page or CPU cache, to prevent exposure to main memory and maintain key security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the decryption key is stored in main memory for instruction decryption, then the processor can access the key for decryption operations, but the security of the decryption key is compromised due to potential access by malicious software or hardware attacks
Solution Approach 1:
The decryption key is extracted from main memory and stored in a secure storage area within the processor, separating the key from the general memory space where it would be vulnerable to attacks. This extraction maintains operational accessibility while eliminating exposure risks.
Solution Approach 2:
A secure storage area acts as an intermediary between the decryption key and the processor operations. The key remains protected in this intermediate secure location while still being accessible for decryption when needed, preventing direct exposure to main memory vulnerabilities.
2Productivity
If decrypted instructions are stored in main memory for execution, then the processor can execute the instructions, but the decrypted instructions become vulnerable to extraction by attackers
Solution Approach 1:
Decrypted instructions are extracted from main memory and stored in a secure storage area within the processor. This extraction allows the instructions to be executed while preventing attackers from accessing the decrypted sensitive information in main memory.
Solution Approach 2:
The secure storage area provides localized protection for decrypted instructions, creating a restricted access zone within the processor where sensitive information can be temporarily held for execution without exposing it to the general memory system.
3Reliability
If traditional encryption methods are used to protect proprietary algorithms, then the algorithms are protected from discovery, but modern binary analysis tools can still detect packers and extract control-flow graphs
Solution Approach 1:
The patent replaces traditional software-based encryption and packing mechanisms with hardware-level secure storage and decryption capabilities within the processor. This substitution makes the protection mechanism invisible to software-based binary analysis tools, as the encryption/decryption occurs at the hardware level rather than through software layers that can be analyzed.
Data Source
AI summary
Provided are facilities for secure execution of an encrypted executable comprising an encrypted instruction. The secure execution includes obtaining the encrypted instruction, decrypting the encrypted instruction using a decryption key being maintained in a secure location within a processor, and storing the decrypted instruction to a secure storage for execution, where the decryption key remains in the secure location during the decrypting and the storing to facilitate maintaining security of the decryption key.