Secure Physical Memory Area for Persistent Authentication Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data storage and processing methods lack secure mechanisms to protect sensitive information from unauthorized access, particularly on mobile devices, where data can be compromised during reboot or accessed by unauthorized applications.
Innovation Solution
Implementing a hardware-separated environment on mobile devices using a designated physical memory area for secure storage and processing of authentication data, which remains inaccessible to other applications and persists across reboots, combined with cryptographic hashing for additional security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If data is stored in regular memory accessible by applications, then ease of operation is improved, but security is worsened as unauthorized applications can access sensitive information
Solution Approach 1:
The memory space is segmented into a secure memory region and non-secure regions. The secure memory region is physically isolated and can only be accessed by the authentication application, while other applications are restricted from accessing this region. This segmentation resolves the contradiction by providing controlled accessibility - easy for authorized operations, secure against unauthorized access.
2Reliability
If temporary storage is cleared on reboot, then security is improved by preventing persistent access, but loss of information worsens as authentication data is lost
Solution Approach 1:
The system performs preliminary designation of the secure memory region before authentication operations. This designation is persisted across reboots, so when the device restarts, the secure region is automatically re-established and authentication data can be immediately stored there, preventing loss while maintaining security.
Solution Approach 2:
The secure memory region is configured to automatically re-designate itself after a reboot without requiring external intervention. The system self-maintains the secure region's properties and automatically restores authentication data storage capabilities, resolving the contradiction between security clearing and data preservation.
3Reliability
If a physical memory area is designated for secure storage, then security is improved, but device complexity increases due to additional memory management requirements
Solution Approach 1:
The secure memory region is configured to automatically re-designate itself after a reboot without requiring external intervention. This self-service mechanism reduces the complexity burden by eliminating the need for complex reboot detection and re-designation logic, while still providing strong data protection.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
In some embodiments, inputs provided to an application are securely stored and processed. In some embodiments, input data is obtained via a user interface of an application accessed on a network device and the input data is stored in a physical memory area of temporary storage of the network device. The physical memory area of the temporary storage is configured to be designated for securely storing data processed by the application and to remain designated for securely storing data processed by the application when the network device is rebooted. The physical memory area is inaccessible to other applications. The input data is processed via the physical memory area of the temporary storage in accordance with instructions of the application, and, in response to a reboot of the network device, the designation of the physical memory area of the temporary storage to securely store data processed by the application is reapplied.