Secure Module Key Management for Disk Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing full disk encryption (FDE) and file-level encryption (FLE) approaches face challenges in protecting cryptographic keys from unauthorized access, particularly from administrative users and malicious processes, due to keys being stored in memory where they can be vulnerable to cold-boot attacks and side-channel attacks.
Innovation Solution
Implementing a secure module that fetches and uses distinct cryptographic keys for decryption and encryption operations on a computing device, ensuring these keys are discarded promptly after use, thereby minimizing exposure and enhancing security by maintaining the key hierarchy within a tamper-responsive cryptographic boundary, separate from the system's memory.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic keys are stored in system memory for use, then encryption and decryption operations can be performed, but keys become vulnerable to cold-boot attacks and side-channel attacks
Solution Approach 1:
The patent extracts cryptographic keys from system memory and stores them in a secure element (separate secure module). The secure element maintains the key hierarchy internally, exposing only authentication interfaces to the host system. This extraction removes keys from the vulnerable memory environment while preserving their cryptographic functionality.
Solution Approach 2:
The secure element acts as an intermediary between the host system and the cryptographic key hierarchy. It provides authenticated access to cryptographic operations without exposing the actual keys to the host system's memory space, thereby mediating between operational needs and security requirements.
2Productivity
If keys are loaded into memory for encryption/decryption operations, then data processing can proceed, but exposure time increases vulnerability to attacks
Solution Approach 1:
The secure element pre-loads and maintains the complete key hierarchy internally in a secure environment. This preliminary preparation allows the host system to perform encryption and decryption operations without repeatedly loading keys from external storage, thus maintaining operational speed while minimizing host memory exposure time.
Solution Approach 2:
By extracting the key hierarchy from the host system's memory management entirely and maintaining it within the secure element, the patent eliminates the need for keys to reside in vulnerable memory during processing, thereby reducing exposure time without impacting operational productivity.
3Ease of operation
If administrative users have access to the system, then system management is enabled, but they can access keys in memory and compromise security
Solution Approach 1:
The patent segments the system into a host system and a separate secure element. The secure element maintains an isolated key hierarchy that is inaccessible to administrative users of the host system. This segmentation allows system management functions to operate normally while protecting cryptographic keys from administrative access through physical and logical isolation.
Solution Approach 2:
The secure element serves as an intermediary that provides controlled access to cryptographic functionality. It implements its own authentication mechanisms independent of the host system's administrative access controls, thereby mediating between system management needs and key protection requirements.
4Reliability
If a secure module is implemented to protect keys, then key security is improved, but system complexity increases
Solution Approach 1:
The secure element is a self-contained module that maintains its own key hierarchy and authentication mechanisms internally. It requires minimal integration with the host system, communicating only through standardized authentication interfaces. This self-service capability reduces integration complexity while providing robust key protection.
Solution Approach 2:
The secure element provides multiple cryptographic functions (key storage, key generation, authentication, encryption/decryption operations) through a single integrated module. This multi-functionality consolidates what would otherwise require multiple separate components, thereby reducing overall system complexity while maintaining comprehensive key protection.
Data Source
AI summary
Methods, apparatus and articles of manufacture for key management in full disk and file-level encryption are provided herein. A method includes fetching a distinct cryptographic key from a secure module in connection with a request to perform one of a decryption operation and an encryption operation on at least one of an individual file and an individual sector within a storage device on a computing device; using the distinct cryptographic key to perform the one of a decryption operation and an encryption operation on the at least one of an individual file and an individual sector within the storage device on the computing device; and discarding the distinct cryptographic key subsequent to said performing the one of a decryption operation and an encryption operation on at least one of an individual file and an individual sector within the storage device on the computing device.