Secure Sensitive Data in Temporary Memory via Kernel Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current technologies lack effective methods to control and secure sensitive data stored in local memory on computing devices, making them vulnerable to memory scraping attacks, especially since many applications do not properly wipe credentials and sensitive information from memory after use, leading to prolonged exposure and increased security risks.
Innovation Solution
Implementing a system that identifies applications using sensitive data, analyzes user input and application attributes, and automatically enacts control actions such as memory wiping, alert generation, or credential rotation to limit accessibility and secure sensitive data stored in temporary access memory.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If applications store sensitive data in local memory for normal operation, then data accessibility and processing efficiency are improved, but security vulnerability increases due to prolonged exposure in memory
Solution Approach 1:
The system performs preliminary detection of sensitive data in memory before attackers can scrape it, and preemptively wipes the memory contents. The security system monitors memory allocation and automatically clears sensitive data before potential exposure occurs, preventing the vulnerability from being exploited.
Solution Approach 2:
The system continuously monitors memory for sensitive data patterns and provides feedback control by automatically triggering memory wiping when sensitive data is detected. This closed-loop feedback mechanism dynamically adjusts memory protection based on real-time detection of credential storage patterns.
2Device complexity
If applications do not implement comprehensive memory wiping mechanisms, then device complexity and implementation difficulty are reduced, but security reliability deteriorates due to incomplete memory clearance
Solution Approach 1:
The patent introduces a kernel-mode intermediary layer that sits between applications and physical memory. This intermediary automatically detects and wipes sensitive data without requiring application-level implementation, thus maintaining low device complexity while achieving high security reliability through centralized enforcement.
Solution Approach 2:
The security system operates autonomously to detect and wipe sensitive data in memory without requiring manual intervention or complex application-level programming. The system self-manages the entire process from detection to clearance, reducing implementation burden on applications while ensuring reliable memory security.
3Productivity
If sensitive data remains in memory after application termination, then memory utilization efficiency is improved, but security exposure increases as attackers can access terminated process memory
Solution Approach 1:
The system performs preliminary detection of sensitive data patterns in terminated process memory and preemptively wipes the memory contents before attackers can access them. This preliminary action occurs during system monitoring cycles even after applications have terminated, preventing post-termination exposure while allowing memory to be reused.
4Reliability
If comprehensive memory monitoring and automatic wiping systems are implemented, then security protection is improved, but system complexity and computational overhead increase
Solution Approach 1:
The system creates simplified copies or models of sensitive data patterns rather than analyzing actual credential contents. By working with pattern templates rather than full data representations, the system achieves comprehensive monitoring with reduced computational overhead and simplified architecture.
Solution Approach 2:
The patent replaces complex application-level memory management mechanisms with a streamlined kernel-mode detection and wiping system. This substitution consolidates multiple complex functions into a single centralized mechanism, reducing overall system complexity while maintaining comprehensive security protection.
Data Source
AI summary
Disclosed embodiments relate to systems and methods for discovering and controlling sensitive data stored in temporary access memory. Techniques include identifying an application configured to perform one or more secure functions using sensitive data, wherein the application is configured to store or access the sensitive data in a temporary access memory accessible to the application; analyzing one or more processes associated with runtime activity of the application; detecting, based on the analyzing, an instance of the sensitive data, wherein the detecting is based on at least one of: analyzing input from a user to the application, or analyzing attributes of the application; and automatically implementing, based on the detecting, a control action to limit the accessibility of the sensitive data in the temporary access memory.