Virtualized RAM Encryption for Secure OS and Firmware
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing hardware platforms in industrial environments face challenges in ensuring the confidentiality and integrity of sensitive data due to physical attacks like side-channel, fault injection, and cold boot attacks, with external RAM being a common attack vector for unencrypted data storage.
Innovation Solution
Implementing a virtualized RAM with software encryption to encrypt data before storing it in external RAM, using a hypervisor to manage encryption keys and potentially utilizing hardware-based cryptography acceleration for faster processing, and enforcing security policies to restrict unencrypted access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If data is stored in external RAM without encryption, then system performance and memory access speed are improved, but data security and confidentiality deteriorate due to physical attacks
Solution Approach 1:
The patent applies preliminary action by encrypting data before storing it in external RAM. The encryption process is performed in advance on data that will be stored, ensuring that even if physical attacks occur later, the data remains protected. This resolves the contradiction by maintaining fast storage access while pre-protecting against security threats.
Solution Approach 2:
The patent introduces encryption as an intermediary layer between the data and the external RAM storage. Instead of directly storing plaintext data in external RAM, the data is encrypted first, creating a protective barrier that maintains both access speed and security. The encryption acts as a mediator that allows fast storage while preventing unauthorized access.
2Object-affected harmful factors
If hardware-based encryption features are used, then data security is improved, but device complexity and cost increase
Solution Approach 1:
The patent substitutes hardware-based encryption mechanisms with software-based encryption implementations. Instead of relying on dedicated hardware encryption units that increase device complexity, the system uses software algorithms to achieve encryption functionality. This resolves the contradiction by maintaining data security while reducing hardware complexity and cost.
Solution Approach 2:
The patent makes the existing RAM memory serve multiple functions: it acts as both the storage medium and the encryption target. By implementing encryption in software on the existing hardware platform, the system avoids adding specialized encryption hardware. This universal approach maintains security while minimizing device complexity.
3Object-affected harmful factors
If all data from virtualized RAM is encrypted and stored in external RAM, then data security is improved, but memory management complexity and system performance deteriorate
Solution Approach 1:
The patent applies segmentation by encrypting data selectively based on its sensitivity and usage patterns, rather than encrypting all data uniformly. This allows the system to maintain security for critical data while reducing the overhead of encryption management for less sensitive data. The segmentation approach resolves the contradiction by balancing security coverage with manageable complexity.
Solution Approach 2:
The patent implements partial encryption action by encrypting only the portions of data that require protection, rather than encrypting everything. This selective approach maintains adequate security for critical data while reducing the overall complexity of memory management. The partial action principle resolves the contradiction by achieving sufficient security without excessive computational overhead.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The method is, in particular, a computer-implemented method and serves for the secure operation of an operating system or firmware on a hardware platform with at least one external RAM. In the method according to the invention, a virtualized RAM is provided to the operating system or firmware, and data from the virtualized RAM is encrypted using software encryption and subsequently stored in the at least one external RAM. The hardware platform is configured to execute such a method.