Present but Unreachable: Reducing Persistentlatent Secrets in HotSpot JVM

Simple item page
dc.contributor.authorPridgen, Adam
dc.contributor.authorGarfinkel, Simson
dc.contributor.authorWallach, Dan
dc.date.accessioned2016-12-29T02:12:48Z
dc.date.available2016-12-29T02:12:48Z
dc.date.issued2017-01-04
dc.description.abstractApplications that manage \ sensitive secrets, including cryptographic keys, are typically \ engineered to overwrite the secrets in memory once they're no longer \ necessary, offering an important defense against forensic attacks \ against the computer. In a modern garbage-collected memory system, \ however, live objects will be copied and compacted into new memory \ pages, with the user program being unable to reach and zero out \ obsolete copies in old memory pages that have not yet \ been reused. This paper considers this problem in the HotSpot JVM, \ the default JVM used by the Oracle and OpenJDK Java platforms. \ We analyze the SerialGC and Garbage First Garbage Collector (G1GC) \ implementations, showing that sensitive data such as TLS keys are \ easily extracted from the garbage. To mitigate this issue, we \ implemented techniques to sanitize older heap pages and we measure \ the performance impact--sometimes good, sometimes unacceptable. We \ also discuss how future garbage collectors might be designed from \ scratch with efficient heap sanitation in mind. \
dc.format.extent10 pages
dc.identifier.doi10.24251/HICSS.2017.727
dc.identifier.isbn978-0-9981331-0-2
dc.identifier.urihttp://hdl.handle.net/10125/41887
dc.language.isoeng
dc.relation.ispartofProceedings of the 50th Hawaii International Conference on System Sciences
dc.rightsAttribution-NonCommercial-NoDerivatives 4.0 International
dc.rights.urihttps://creativecommons.org/licenses/by-nc-nd/4.0/
dc.subjectBlackbox analysis
dc.subjectJava HotSpot JVM
dc.subjectTLS
dc.subjectSecure Memory Management
dc.subjectGarbage Collection
dc.titlePresent but Unreachable: Reducing Persistentlatent Secrets in HotSpot JVM
dc.typeConference Paper
dc.type.dcmiText

Files

Original bundle
Now showing 1 - 1 of 1
Thumbnail Image
Name:
paper0738.pdf
Size:
1.26 MB
Format:
Adobe Portable Document Format
Download

Collections

Cybersecurity and Software Assurance Minitrack