A Novel Protection Mechanism for Encryption System

摘要

Software drive encryption system is difficult to prevent memory attacks, in which, an attacker acquire the physical accesses to the unattended computer, obtains the decryption keys from memory and consequently decrypts the drive. We propose a new method for protecting encryption systems against memory attacks, by converting them to use two tiers of keys, a single Master Key and a set of File or Sector keys. When the computer is unattended, the Master Key and part of the second-tier keys are erased from memory. The method is secure against any type of memory attack, including attackers who gain complete control of the unattended system. Compared to previous methods of protection, which erase keys and shut down the computer, our method allows to keep the computer operational by a combination of cryptographic and operating systems techniques.