System and method for cryptographic keys security in the cloud
View Patent ↗An improved method or security solution for securing cryptographic keys in a virtual machine RAM. A security solution is proposed to hide cryptographic keys in the cloud, without the necessity of any architectural modifications. The present solution requires the availability of a Trusted Platform Module (TPM) capable of creating and holding a protected public/private key pair. It lends itself to security-as-a-service scenarios where third parties perform encryption or decryption on behalf of data owners. This allows the present solution to be easily integrated and coupled with other existing cloud architectures. A decrypt-scatter or gather-decrypt solution which allows users to carry out encryption or decryption while protecting keys from unauthorized peeks by the cloud administrators is proposed.
1. A method of securing a key in a cloud using decrypt-scatter and gather-decrypt techniques, the key comprising a plurality of key chunks, the method comprising the steps of:
creating a Virtual Machine, wherein the Virtual Machine has a Random Access Memory;
generating a plurality of scattered memory addresses in the Random Access Memory of the Virtual Machine;
storing the plurality of key chunks in the plurality of generated scattered memory addresses, such that each scattered memory address stores a single key chunk among the plurality of key chunks; and
generating a plurality of temporary memory addresses, wherein each temporary memory address stores a temporary value used for calculating a round key,
wherein the plurality of key chunks are scattered by columns within the plurality of scattered memory addresses rather than scattering by row.
2. The method of claim 1 , wherein the plurality of temporary memory addresses each storing a temporary value used to calculate the round keys are located at an end of the plurality of scattered memory addresses scattered by columns.
3. The method of claim 1 , wherein the plurality of temporary memory addresses each storing a temporary value used to calculate the round keys are located at a beginning of the plurality of scattered memory addresses scattered by columns.
4. The method according to claim 1 , wherein the round key is calculated only when decrypting data, and the round key calculated is the minimum required to decrypt data.
5. The method according to claim 1 , wherein the plurality of key chunks are stored in the form of bytes.
6. The method according to claim 1 , wherein the plurality of scattered memory addresses are randomly generated memory address locations that are spread across rows and columns.
7. The method according to claim 1 , wherein the plurality of scattered memory addresses are randomly generated using a Pseudo Random Number Generator (PRNG).
8. The method according to claim 1 , wherein the method further comprises implementing an Advanced Encryption Standard (AES) encryption algorithm on the plurality of key chunks.
9. The method according to claim 8 , wherein the calculated round key is XORed with an array of plain text chunks on which the Advanced Encryption Standard (AES) algorithm is implemented.
10. A method of securing a key in a cloud using decrypt-scatter and gather-decrypt techniques, the key comprising a plurality of key chunks, the method comprising the steps of:
creating a Virtual Machine, wherein the Virtual Machine has a Random Access Memory;
generating a plurality of scattered memory addresses in the Random Access Memory of the Virtual Machine;
storing the plurality of key chunks in the plurality of generated scattered memory addresses, such that each scattered memory address stores a single key chunk among the plurality of key chunks; and
generating a plurality of temporary memory addresses, wherein each temporary memory address stores a temporary value used for calculating a round key,
wherein the plurality of key chunks are scattered by rows within the plurality of scattered memory addresses rather than scattering by column.
11. The method of claim 10 , wherein the plurality of temporary memory addresses each storing a temporary value used to generate a round key are located at an end of the plurality of the scattered memory addresses scattered by rows.
12. The method of claim 10 , wherein the plurality of temporary memory addresses each storing a temporary value used to generate a round key are located at a beginning of the plurality of scattered memory addresses scattered by rows.
13. The method according to claim 10 , wherein the round key is calculated only when decrypting data, and the round key calculated is the minimum required to decrypt data.
14. The method according to claim 10 , wherein the plurality of key chunks are stored in the form of bytes.
15. The method according to claim 10 , wherein the plurality of scattered memory addresses are randomly generated memory address locations that are spread across rows and columns.
16. The method according to claim 10 , wherein the plurality of scattered memory addresses are randomly generated using a Pseudo Random Number Generator (PRNG).
17. The method according to claim 10 , wherein the method further comprises implementing an Advanced Encryption Standard (AES) encryption algorithm on the plurality of key chunks.
18. The method according to claim 17 , wherein the calculated round key is XORed with an array of plain text chunks on which the Advanced Encryption Standard (AES) algorithm is implemented.