Cryptographically protected paging subsystem

Details Cryptographically protected paging subsystem Cryptographically protected paging subsystem

1998-04-30

2004-03-16

Sheikh, Ayaz (Department: 2131)

Electrical computers and digital processing systems: support

Data processing protection using cryptography

Computer instruction/address encryption

C713S177000, C713S189000, C713S193000, C713S194000, C713S152000, C713S152000, C380S029000, C380S030000

Reexamination Certificate

active

06708274

ABSTRACT:

BACKGROUND OF THE INVENTION
(1) Field of the Invention
The invention relates to data protection in an insecure environment. More specifically, the invention relates to handling memory resource exhaustion within a secure environment without jeopardizing the security of the data and programs used therein.
(2) Related Art
Resource exhaustion and particularly memory exhaustion is a common problem in computer systems. The random access memory (RAM) from which programs can be executed is necessarily limited both by cost and space. External memory devices such as hard disk drives, magnetic tape, and so forth are used to hold programs and data not currently being accessed by the processor. Virtual memory uses these external memory devices to ameliorate the physical memory constraints of the RAM and create the appearance that adequate space is available in the RAM to hold all the currently needed code and data. Virtual memory has a hierarchical structure based on a page directory, page tables, and page frames. A page frame contains a block of usable code or data. The size of the block is determined by design considerations. One common page frame size in existing systems is four kilobytes. Thus, the minimum size blocks that can be moved in from external memory to RAM in such a system is a 4K block. The page table holds the base addresses of a number of page frames. A page table is the same size as a page frame and can similarly be paged out to external memory.
The page directory is similar to the page table except that it holds the base address of a number of page tables. Typically, it is retained in internal memory and not paged out. The base address of the page directory is held in an internal CPU control register. Functioning of paging systems is generally well understood in the art.
It is also possible to create a physically secure environment. For example, one draconian method of creating a physically secure environment might be placing the CPU and its RAM in a safe with wires running out of the safe to an external storage unit. While this creates a secure environment within the safe, data paged out to the external memory is readily compromised. Moreover, the resource exhaustion issues are exacerbated in the secure environment model because both cost and space concerns escalate to maintain a physically secure environment, e.g. need a bigger safe.
In view of the foregoing, it would be desirable to be able to insure reasonable security from substitution and modification attacks of programs and data beyond the memory capacity of a secure environment.
BRIEF SUMMARY OF THE INVENTION
A method and system for maintaining integrity and confidentiality of pages paged to an external storage unit from a physically secure environment is disclosed. An outgoing page is selected to be exported from a physically secure environment to an insecure environment. An integrity check value is generated and stored for the outgoing page. In one embodiment, this takes the form of taking a one-way hash of the page using a well-known one-way hash function. The outgoing page is then encrypted using a cryptographically strong encryption algorithm. Among the algorithms that might be used in one embodiment of the invention are IDEA and DES. The encrypted outgoing page is then exported to the external storage. By virtue of the encryption and integrity check, the security of the data on the outgoing page is maintained in the insecure environment.


REFERENCES:
patent: 4847902 (1989-07-01), Hampson
patent: 5007083 (1991-04-01), Constant
patent: 5224166 (1993-06-01), Hartman, Jr.
patent: 5343527 (1994-08-01), Moore
patent: 5386469 (1995-01-01), Yearsley et al.
patent: 5412717 (1995-05-01), Fischer
patent: 5694569 (1997-12-01), Fischer
patent: 5768382 (1998-06-01), Schneier et al.
patent: 5825878 (1998-10-01), Takahashi et al.
patent: 5944821 (1999-08-01), Angelo
Smith, R. Internet Cryptography. pp. 1-6. Jul. 1997.*
E. Palmar, “An Introduction to Citadel—A Secure Crypto Coprocessor for Workstations,” IBM Thomas J. Watson Research Center, Version 1.00, Sep. 30, 1992.
B. Yee, “Using Secure Coprocessors,” School of Computer Science,Carnegie Mellon University, May 1994.
“VMS320—High Speed PCMCIA Security Token Cryptographic Engine,” VLSI Technology, Inc., 1997.

Affiliated with

Also associated with

Rating

Cryptographically protected paging subsystem does not yet have a rating. At this time, there are no reviews or comments for this patent.

If you have personal experience with Cryptographically protected paging subsystem, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Cryptographically protected paging subsystem will most certainly appreciate the feedback.

Rate now

Comments { 0 }

Profile ID: LFUS-PAI-O-3242425