Defending Against Attacks on Main Memory Persistence

Enck, William; Butler, Kevin; Richardson, T.; McDaniel, Patrick; Smith, Adam

doi:10.1109/acsac.2008.45

Cited by 30 publications

(14 citation statements)

References 18 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Researchers have had quite a bit of success in retrieving encryption keys from active system memory. In order for this attack vector to be successful the adversary must have physical privileged access to the machine on which the software is running as was the case in the research presented here [7]. Several recent research projects have reported great success in retrieving plaintext passwords using the same attack vector [8].…”

Section: Figure 1 Typical Database Connection Scenariomentioning

confidence: 91%

Securely handling application-to-application connection credentials

Lieberman

Mitropoulos

2013

2013 Proceedings of IEEE Southeastcon

View full text Add to dashboard Cite

The utilization of application-to-application credentials within interpretive language scripts and application code has long been a security risk. The quandaries being how to protect and secure the credentials embedded in source code and avoid exploitation from rogue programmers, sys admins and other users with authorized high levels of privilege. To date the pervasive method for addressing this has been to live with the risk and concentrate on mitigating the impact of expected and eventual exploitation. Recently published research efforts support the pervasive acceptance of this risk by such stayed auditing bodies such as the Institute of Internal Auditing (IIA) and the Information Systems Audit and Control Association (ISCAA). Numerous research efforts have taken place were built on the premise that nothing can be done to avoid the risk so it is best to concentrate the research on reducing the impact of exploitation.The research presented in this paper develops a method by which interpretive language scripts can request credentials from a commercial password vault and have those credentials returned to the script in such a manner as to reduce the risk of exploit significantly over generally accepted methods for credential handling.

show abstract

Section: Figure 1 Typical Database Connection Scenariomentioning

confidence: 91%

Securely handling application-to-application connection credentials

Lieberman

Mitropoulos

2013

2013 Proceedings of IEEE Southeastcon

View full text Add to dashboard Cite

show abstract

“…The concept of attacking persistence in main memory [33] is to read memory containing passwords or other secret data that is not consciously erased between users.…”

Section: Softwarementioning

confidence: 99%

“…A particularly extreme example is attacking main memory persistence. A solution to this problem has been addressed for the traditional and Internet cases [33]. Specifically research on cryptographic methods for authenticating data stored in servers [15].…”

Section: Secure Storage and Computationmentioning

confidence: 99%

A Cross Section of the Issues and Research Activities Related to Both Information Security and Cloud Computing

Sehgal¹,

Sohoni²,

Xiong³

et al. 2011

IETE Tech Rev

View full text Add to dashboard Cite

Cloud computing amplifies computer security issues that have proliferated with the growth of the Internet. A broad range of security research is being applied to cloud computing. This paper gives a description of cloud computing followed by a general description of information security issues and solutions, and a brief description of issues linking cloud computing with information security. Security solutions must make a trade-off between the amount of security and its performance cost and impact on the end-user experiences. This is accentuated in a cloud computing environment where users desiring different levels of security share the same resources. An essential issue for cloud computing is the perception of security, which is beyond the simple technical details of security solutions. This paper includes a list of a few key information security challenges that also present significant research opportunities. Solving these key problems will encourage the widespread adoption of cloud computing.

show abstract

“…Due to a large separation between the lowest and the highest resistance state, both PCM and RRAM NVMs support multi-level/triple-level cell (MLC/TLC) operation, which is the ability to store 2/3 logical bits per physical cell. Whereas PCM/RRAM NVMs have emerged as promising DRAM replacements, data persistence in PCM/RRAM NVMs poses many security vulnerabilities that must be addressed prior to commercialization of these advanced NVM technologies [5][6][7][8].…”

Section: Introductionmentioning

confidence: 99%

Secret

Swami

Rakshit

Mohanram

2016

Proceedings of the 53rd Annual Design Automation Conference

View full text Add to dashboard Cite

Data persistence in emerging non-volatile memories (NVMs) poses a multitude of security vulnerabilities, motivating main memory encryption for data security. However, practical encryption algorithms demonstrate strong diffusion characteristics that increase cell flips, resulting in increased write energy/latency and reduced lifetime of NVMs. State-of-the-art security solutions have focused on reducing the encryption penalty (increased write energy/latency and reduced memory lifetime) in single-level cell (SLC) NVMs; however, the realization of low encryption penalty solutions for multi-/triple-level cell (MLC/TLC) secure NVMs remains an open area of research. This work synergistically integrates zero-based partial writes with XOR-based energy masking to realize Smartly EnCRypted Energy efficienT, i.e., SECRET MLC/TLC NVMs, without compromising the security of the underlying encryption technique. Our simulations on an MLC (TLC) resistive RAM (RRAM) architecture across SPEC CPU2006 workloads demonstrate that for 6.25% (7.84%) memory overhead, SECRET reduces write energy by 80% (63%), latency by 37% (49%), and improves memory lifetime by 63% (56%) over conventional advanced encryption standard-based (AES-based) counter mode encryption.

show abstract

Defending Against Attacks on Main Memory Persistence

Cited by 30 publications

References 18 publications

Securely handling application-to-application connection credentials

Securely handling application-to-application connection credentials

A Cross Section of the Issues and Research Activities Related to Both Information Security and Cloud Computing

Secret

Contact Info

Product

Resources

About