RamCrypt: Kernel-based Address Space Encryption for User-mode Processes

Johannes Götzfried; Tilo Müller; Gabor Drescher; Stefan Nürnberger; Michael Backes

In: Proceedings of the 11th ACM Symposium on Information, Computer and Communications Security. ACM Symposium on Information, Computer and Communications Security (ASIACCS-2016), May 30 - June 3, Xi'an, China, Sheridan Printing, 2016.


We present RamCrypt, a solution that allows unmodified Linux processes to transparently work on encrypted data. RamCrypt can be deployed and enabled on a per-process basis without recompiling user-mode applications. In every enabled process, data is only stored in cleartext for the moment it is processed, and otherwise stays encrypted in RAM. In particular, the required encryption keys do not reside in RAM, but are stored in CPU registers only. Hence, RamCrypt effectively thwarts memory disclosure attacks, which grant unauthorized access to process memory, as well as physical attacks such as cold boot and DMA attacks. In its default configuration, RamCrypt exposes only up to 4 memory pages in cleartext at the same time. For the nginx web server serving encrypted HTTPS pages under heavy load, the necessary TLS secret key is hidden for 97% of its time.

German Research Center for Artificial Intelligence
Deutsches Forschungszentrum für Künstliche Intelligenz