Volatile Memory Obfuscation for Cryptographic Key Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cryptographic material, such as passwords and encryption keys, remains vulnerable when stored in volatile memory, as malicious users can access and retrieve them through memory dumps, core dump files, and cold boot attacks, compromising system security.
Innovation Solution
The technique involves scrambling the storage location of each byte of plaintext cryptographic material in a volatile memory using a random obfuscation buffer and a position tracking buffer, making it difficult for malicious users to recover the data without adding significant overhead to system operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If plaintext cryptographic material is stored in volatile memory for use, then cryptographic operations can be performed efficiently, but the system becomes vulnerable to memory scanning attacks and cold boot attacks
Solution Approach 1:
The patent divides the storage structure into multiple segments: an obfuscation buffer that stores scrambled cryptographic material and a position tracking buffer that stores location information. This segmentation allows the system to maintain plaintext data in volatile memory for efficient cryptographic operations while protecting it from direct scanning attacks by scattering the actual data across non-contiguous memory locations with random offsets.
Solution Approach 2:
The patent introduces an intermediary obfuscation layer between the volatile memory and the cryptographic material. Instead of storing plaintext directly in accessible memory locations, the system uses an obfuscation buffer with random offsets as an intermediary structure. This intermediary prevents direct access to plaintext while allowing authorized retrieval through the position tracking mechanism, thus enabling both security and operational efficiency.
2Object-affected harmful factors
If cryptographic material is encrypted in non-volatile memory, then security is improved, but decryption and retrieval time increases
Solution Approach 1:
The patent applies preliminary action by pre-scrambling the cryptographic material when it is loaded into volatile memory from encrypted non-volatile storage. Instead of decrypting data every time it is accessed, the system performs the decryption and initial scrambling once during loading, then maintains the scrambled form in volatile memory with position tracking information. This preliminary action eliminates repeated decryption overhead while maintaining security.
Solution Approach 2:
The patent changes the parameter of data organization in volatile memory from contiguous plaintext storage to scrambled storage with random offsets. By transforming the storage parameters (from direct plaintext to obfuscated format with position metadata), the system achieves both security benefits and efficient retrieval, as the scrambled data can be quickly assembled using pre-stored position information without time-consuming decryption operations on each access.
Data Source
AI summary
Methods and systems disclosed herein describe obfuscating plaintext cryptographic material stored in memory. A random location in an obfuscation buffer may be selected for each byte of the plaintext cryptographic material. The location of each byte of the plaintext cryptographic material may be stored in a position tracking buffer. To recover the scrambled plaintext cryptographic material, the location of each byte of the plaintext cryptographic material may be read from the position tracking buffer. Each byte of the plaintext cryptographic material may then be read from the obfuscation buffer and written to a temporary buffer. When each byte of the plaintext cryptographic material is recovered, the plaintext cryptographic material may be used to perform one or more cryptographic operations. The scrambling techniques described herein reduce the likelihood of a malicious user recovering plaintext cryptographic material while stored in memory.