Secure Transient Buffer Management via Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In systems relying on shared memory, sensitive data in transient data buffers can be accessed by hardware accelerator units or application processors without proper authorization, posing a risk of unauthorized access and data leaks.
Innovation Solution
A secure processor is introduced to manage encryption of transient data buffers, assigning unique encryption keys and controlling access by validating permissions of hardware units, ensuring that only authorized access results in usable data, while unauthorized access yields encrypted, meaningless data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a shared memory architecture is used to allow hardware accelerator units and application processors to access transient data buffers, then system productivity and ease of operation are improved, but security against unauthorized access to sensitive data deteriorates
Solution Approach 1:
An encryption layer is introduced as an intermediary between the shared memory and the hardware accelerator units/application processors. The transient data buffer is encrypted using cryptographic algorithms, and only authorized components with the proper decryption keys can access the data. This mediator allows the shared memory architecture to function while preventing unauthorized access to sensitive information.
Solution Approach 2:
The patent changes the state of the data in the transient buffer by applying encryption transformations. The data is converted from plaintext to ciphertext form, changing its accessibility parameters. Authorized components can decrypt and access the data, while unauthorized components encounter only encrypted, meaningless data, thus resolving the security vulnerability.
2Object-affected harmful factors
If encryption is applied to transient data buffers to prevent unauthorized access, then security is improved, but device complexity and processing overhead increase
Solution Approach 1:
Encryption keys are pre-assigned to transient data buffers before data is written to them. The secure processor establishes the encryption scheme and key assignments in advance, so that when hardware accelerator units or application processors need to access the data, the encryption infrastructure is already in place and operational, minimizing runtime complexity.
Solution Approach 2:
The system implements self-service encryption management where the secure processor automatically handles key assignment and encryption operations without requiring manual intervention. The hardware accelerator units and application processors can access encrypted data through standardized interfaces, and the encryption/decryption processes are handled automatically by the secure processor and associated cryptographic modules.
Data Source
AI summary
Methods and systems are described that secure application data being maintained in transient data buffers that are located in a memory that is freely accessible to other components, regardless as to whether those components have permission to access the application data. The system includes an application processor, a memory having a portion configured as a transient data buffer, a hardware unit, and a secure processor. The hardware unit accesses the transient data buffer during execution of an application at the application processor. The secure processor is configured to manage encryption of the transient data buffer as part of giving the hardware unit access to the transient data buffer.