Device and method with reduced information leakage

Abstract

The invention is directed to a data-processing system comprising a processor and first encrypted information in a first persistent memory whose level of information leakage is higher than that of a second persistent memory. In the second persistent memory is stored a first cryptographic key for decrypting the first encrypted information, thereby generating therefrom first unencrypted information that is usable by the processor for executing an operation. The same cryptographic key may also be used for encrypting the first unencrypted information, thereby generating the first encrypted information. It is also directed to a method of processing such a data-processing system with an operating system, comprising a writing step for writing first unencrypted information into the first persistent memory, an encryption step for encrypting the first unencrypted information under use of the first cryptographic key, creating therefrom first encrypted information in the first persistent memory, and an access-limitation step for setting the data-processing system to a state in which writing into the first persistent memory is controlled by the operating system. It also relates to a method of executing an operation on such a data-processing system comprising a decryption step for decrypting the first encrypted information under use of the first cryptographic key, thereby generating therefrom first unencrypted information and an execution step for executing an operation by the processor, using the first unencrypted information.

1 . A data-processing system comprising:
 a processor,   a first persistent memory with a first level of information leakage,   a second persistent memory with a second level of information leakage that is lower than said first level of information leakage,   first encrypted information stored in said first persistent memory,   stored in said second persistent memory, a first cryptographic key usable for decrypting said first encrypted information, thereby generating therefrom first unencrypted information that is usable by said processor for executing an operation.   
   
   
       2 . A data-processing system comprising:
 a processor,   a first persistent memory with a first level of information   leakage,   a second persistent memory with a second level of information leakage that is lower than said first level of information leakage,   stored in said second persistent memory, a first cryptographic key usable for encrypting first unencrypted information, to generate therefrom first encrypted information, storable in said first persistent memory and usable by said processor for executing an operation.   
   
   
       3 . A data-processing system according to  claim 1 , wherein the first unencrypted information comprises a second cryptographic key usable for decrypting second encrypted information for the operation. 
   
   
       4 . A data-processing system according to  claim 1 , further comprising stored code for executing a personalization step that comprises:
 an encryption step for encrypting the first unencrypted information under use of the first cryptographic key, creating therefrom the first encrypted information in the first persistent memory,   an access-limitation step for setting the data-processing system to a state in which writing into said first persistent memory is controlled by an operating system.   
   
   
       5 . A data-processing system according to  claim 1 , further comprising stored code for executing an operation execution step that comprises:
 a decryption step for decrypting the first encrypted information under use of the first cryptographic key, thereby generating therefrom first unencrypted information,   an execution step for executing an operation by said processor, using said first unencrypted information.   
   
   
       6 . Method of processing a data-processing system comprising a processor, a first persistent memory with a first level of information leakage, a second persistent memory with a second level of information leakage that is lower than said first level of information leakage, an operating system, and a first cryptographic key stored in said second persistent memory, the method comprising:
 a writing step for writing first unencrypted information into said first persistent memory,   an encryption step for encrypting said first unencrypted information under use of said first cryptographic key, creating therefrom first encrypted information in said first persistent memory,   an access-limitation step for setting the data-processing system to a state in which writing into said first persistent memory is controlled by the operating system.   
   
   
       7 . Method of executing an operation on a data-processing system comprising a processor, a first persistent memory with a first level of information leakage, a second persistent memory with a second level of information leakage that is lower than said first level of information leakage, first encrypted information stored in said first persistent memory, and a first cryptographic key stored in said second persistent memory, said method comprising the steps of:
 a decryption step for decrypting said first encrypted information under use of said first cryptographic key, thereby generating therefrom first unencrypted information,   an execution step for executing an operation by said processor, using said first unencrypted information.   
   
   
       8 . Method according to  claim 6 , wherein the first unencrypted information is selected to comprise a second cryptographic key usable for decrypting second encrypted information for the operation. 
   
   
       9 . Computer program product comprising
 program code means for performing a method according to  claim 6 .   
   
   
       10 . Computer program product according to  claim 9 , comprising the program code means stored on a data-processing system. 
   
   
       11 . A data-processing system according to  claim 2 , wherein the first unencrypted information comprises a second cryptographic key usable for decrypting second encrypted information for the operation. 
   
   
       12 . A data-processing system according to  claim 2 , further comprising stored code for executing a personalization step that comprises:
 an encryption step for encrypting the first unencrypted information under use of the first cryptographic key, creating therefrom the first encrypted information in the first persistent memory,   an access-limitation step for setting the data-processing system to a state in which writing into said first persistent memory is controlled by an operating system.   
   
   
       13 . A data-processing system according to  claim 2 , further comprising stored code for executing an operation execution step that comprises:
 a decryption step for decrypting the first encrypted information under use of the first cryptographic key, thereby generating therefrom first unencrypted information,   an execution step for executing an operation by said processor, using said first unencrypted information.   
   
   
       14 . An article of manufacture comprising a computer usable medium having computer readable program code means embodied therein for causing processing of a data-processing system, the computer readable program code means in said article of manufacture comprising computer readable program code means for causing a computer to effect:
 a writing step for writing first unencrypted information into said first persistent memory,   an encryption step for encrypting said first unencrypted information under use of said first cryptographic key, creating therefrom first encrypted information in said first persistent memory,   an access-limitation step for setting the data-processing system to a state in which writing into said first persistent memory is controlled by the operating system.   
   
   
       15 . An article of manufacture comprising a computer usable medium having computer readable program code means embodied therein for causing executing of an operation on a data-processing system, the computer readable program code means in said article of manufacture comprising computer readable program code means for causing a computer to effect:
 a decryption step for decrypting said first encrypted information under use of said first cryptographic key, thereby generating therefrom first unencrypted information,   an execution step for executing an operation by said processor, using said first unencrypted information.   
   
   
       16 . A computer program product comprising a computer usable medium having computer readable program code means embodied therein for causing functions of a data-processing system, the computer readable program code means in said computer program product comprising computer readable program code means for causing a computer to effect:
 a processor,   a first persistent memory with a first level of information leakage,   a second persistent memory with a second level of information leakage that is lower than said first level of information leakage,   first encrypted information stored in said first persistent memory,   stored in said second persistent memory, a first cryptographic key usable for decrypting said first encrypted information, thereby generating therefrom first unencrypted information that is usable by said processor for executing an operation.   
   
   
       17 . A computer program product comprising a computer usable medium having computer readable program code means embodied therein for causing functions of a data-processing system, the computer readable program code means in said computer program product comprising computer readable program code means for causing a computer to effect:
 a processor,   a first persistent memory with a first level of information leakage,   a second persistent memory with a second level of information leakage that is lower than said first level of information leakage,   stored in said second persistent memory, a first cryptographic key usable for encrypting first unencrypted information, to generate therefrom first encrypted information, storable in said first persistent memory and usable by said processor for executing an operation.   
   
   
       18 . A computer program product as recited in  claim 16 , the computer readable program code means in said computer program product further comprising computer readable program code means for causing a computer to effect stored code for executing a personalization step that comprises:
 an encryption step for encrypting the first unencrypted information under use of the first cryptographic key, creating therefrom the first encrypted information in the first persistent memory,   an access-limitation step for setting the data-processing system to a state in which writing into said first persistent memory is controlled by an operating system.   
   
   
       19 . A computer program product as recited in  claim 16 , the computer readable program code means in said computer program product further comprising computer readable program code means for causing a computer to effect stored code for executing an operation execution step that comprises:
 a decryption step for decrypting the first encrypted information under use of the first cryptographic key, thereby generating therefrom first unencrypted information,   an execution step for executing an operation by said processor, using said first unencrypted information.   
   
   
       20 . A computer program product as recited in  claim 17 , the computer readable program code means in said computer program product further comprising computer readable program code means for causing a computer to effect stored code for executing a personalization step that comprises:
 an encryption step for encrypting the first unencrypted information under use of the first cryptographic key, creating therefrom the first encrypted information in the first persistent memory,   an access-limitation step for setting the data-processing system to a state in which writing into said first persistent memory is controlled by an operating system.   
   
   
       21 . A computer program product as recited in  claim 17 , the computer readable program code means in said computer program product further comprising computer readable program code means for causing a computer to effect stored code for executing an operation execution step that comprises:
 a decryption step for decrypting the first encrypted information under use of the first cryptographic key, thereby generating therefrom first unencrypted information,   an execution step for executing an operation by said processor, using said first unencrypted information.