RamCrypt: Kernel-based Address Space Encryption for User-mode Processes
| Title | RamCrypt: Kernel-based Address Space Encryption for User-mode Processes |
| Publication Type | Conference Paper |
| Year of Publication | 2016 |
| Authors | Götzfried, Johannes, Müller, Tilo, Drescher, Gabor, Nürnberger, Stefan, Backes, Michael |
| Conference Name | Proceedings of the 11th ACM on Asia Conference on Computer and Communications Security |
| Publisher | ACM |
| Conference Location | New York, NY, USA |
| ISBN Number | 978-1-4503-4233-9 |
| Keywords | composability, data lifetime, data protection, linux operating systems security, memory disclosure attacks, Metrics, physical attacks, pubcrawl, RAM encryption, Resiliency |
| Abstract | We present RamCrypt, a solution that allows unmodified Linux processes to transparently work on encrypted data. RamCrypt can be deployed and enabled on a per-process basis without recompiling user-mode applications. In every enabled process, data is only stored in cleartext for the moment it is processed, and otherwise stays encrypted in RAM. In particular, the required encryption keys do not reside in RAM, but are stored in CPU registers only. Hence, RamCrypt effectively thwarts memory disclosure attacks, which grant unauthorized access to process memory, as well as physical attacks such as cold boot and DMA attacks. In its default configuration, RamCrypt exposes only up to 4 memory pages in cleartext at the same time. For the nginx web server serving encrypted HTTPS pages under heavy load, the necessary TLS secret key is hidden for 97% of its time. |
| URL | http://doi.acm.org/10.1145/2897845.2897924 |
| DOI | 10.1145/2897845.2897924 |
| Citation Key | gotzfried_ramcrypt:_2016 |