Visible to the public Biblio

Filters: Author is Drescher, Gabor  [Clear All Filters]
2017-05-30
Götzfried, Johannes, Müller, Tilo, Drescher, Gabor, Nürnberger, Stefan, Backes, Michael.  2016.  RamCrypt: Kernel-based Address Space Encryption for User-mode Processes. Proceedings of the 11th ACM on Asia Conference on Computer and Communications Security. :919–924.

We present RamCrypt, a solution that allows unmodified Linux processes to transparently work on encrypted data. RamCrypt can be deployed and enabled on a per-process basis without recompiling user-mode applications. In every enabled process, data is only stored in cleartext for the moment it is processed, and otherwise stays encrypted in RAM. In particular, the required encryption keys do not reside in RAM, but are stored in CPU registers only. Hence, RamCrypt effectively thwarts memory disclosure attacks, which grant unauthorized access to process memory, as well as physical attacks such as cold boot and DMA attacks. In its default configuration, RamCrypt exposes only up to 4 memory pages in cleartext at the same time. For the nginx web server serving encrypted HTTPS pages under heavy load, the necessary TLS secret key is hidden for 97% of its time.