Cluster Computing

, Volume 20, Issue 3, pp 2393–2402 | Cite as

Cryptographic key protection against FROST for mobile devices

  • Xiaosong Zhang
  • Yu-an Tan
  • Yuan Xue
  • Quanxin Zhang
  • Yuanzhang Li
  • Can Zhang
  • Jun ZhengEmail author


With the flourish of applications based on the internet of things and cloud computing, privacy issues have been attracting a lot of attentions. Although the increasing use of full disk encryption (FDE) significantly hamper privacy leakage and digital forensics, cold boot attacks have thwarted FDE since forensic recovery of scrambled telephones (FROST), a forensic tool, is proposed. The cryptographic keys which are stored in the mobile devices are inclined to be obtained by FROST. Recent research results have shown CPU-bound encryption methods to resist FROST. However, these methods performs AES encryption solely on CPU registers, whose advantage comes at the cost of encryption speed. This paper, therefore, presents a cryptographic key protection scheme for android devices which prevents FROST from acquiring the key of AES by changing storage location of the key in memory. The storage location of the key is switched to the fixed position where command line parameters will be stored when android boots. Therefore, the key will be covered by command line parameters while the system reboots, which negates FROST from obtaining the key. Compared with the popular CPU-bound encryption methods, our method has less impact on encryption efficiency and employs no additional storage resources.


Key protection Anti-forensics Android Cold boot attacks AES FDE 



This research was supported by the National Natural Science Foundation of China (No. 61370063) and Special Program for Applied Research on Super Computation of the NSFC-Guangdong Joint Fund (the second phase).


  1. 1.
    Gupta, B.B., Agrawal, D.P., Yamaguchi, S.: Handbook of Research on Modern Cryptographic Solutions for Computer and Cyber Security. IGI Global, Hershey (2016)CrossRefGoogle Scholar
  2. 2.
    Xu, M., Song, C., Ji, Y., Shih, M.-W., Lu, K., Zheng, C., Duan, R., Jang, Y., Lee, B., Qian, C., et al.: Toward engineering a secure android ecosystem: a survey of existing techniques. ACM Comput. Surv. (CSUR) 49(2), 38 (2016)CrossRefGoogle Scholar
  3. 3.
    Sufatrio, Darell, J.J., Chua, T.-W., Thing, V.L.L.: Securing android: a survey, taxonomy, and challenges. ACM Comput. Surv. 47(4), 1–45 (2015)CrossRefGoogle Scholar
  4. 4.
    Rastogi, S., Bhushan, K., Gupta, B.B.: Android applications repackaging detection techniques for smartphone devices. Proced. Comput. Sci. 78, 26–32 (2016)CrossRefGoogle Scholar
  5. 5.
    Sharma, K., Gupta, B.B.: Multi-layer defense against malware attacks on smartphone wi-fi access channel. Proced. Comput. Sci. 78, 19–25 (2016)Google Scholar
  6. 6.
    Zhu, R., Tan, Y., Zhang, Q., Wu, F., Zheng, J., Xue, Y.: Determining image base of firmware files for arm devices. IEICE Trans. Inf. Syst. 99(2), 351–359 (2016)CrossRefGoogle Scholar
  7. 7.
    Zhu, R., Tan, Y., Zhang, Q., Li, Y., Zheng, Jun: Determining image base of firmware for arm devices by matching literal pools. Digit. Invest. 16, 19–28 (2016)CrossRefGoogle Scholar
  8. 8.
    Müller, T., Spreitzenbarth, M.: Frost. In: International Conference on Applied Cryptography and Network Security, pp. 373–388. Springer, New York (2013)Google Scholar
  9. 9.
    Carbone, R., Bean, C., Salois, M.: An in-depth analysis of the cold boot attack. DRDC Valcartier, Defence Research and Development, Canada, Tech. Rep. (2011)Google Scholar
  10. 10.
    Gruhn, M., Müller, T.: On the practicability of cold boot attacks. In: Eighth International Conference on Availability, Reliability and Security (ARES), 2013, pp. 390–397. IEEE (2013)Google Scholar
  11. 11.
    Zidlicky, R.: Re: the cold-boot attack—a paper tiger? (2008). Accessed 30 Oct 2016
  12. 12.
    Müller, T., Dewald, A., Freiling, F.C.: Aesse: a cold-boot resistant implementation of aes. In: Proceedings of the Third European Workshop on System Security, pp. 42–47. ACM (2010)Google Scholar
  13. 13.
    Simmons, P.: Security through amnesia: a software-based solution to the cold boot attack on disk encryption. In: Proceedings of the 27th Annual Computer Security Applications Conference, pp. 73–82. ACM (2011)Google Scholar
  14. 14.
    Müller, T., Freiling, F.C., Dewald, A.: Tresor runs encryption securely outside ram. In: USENIX Security Symposium, vol. 17 (2011)Google Scholar
  15. 15.
    Müller, T., Taubmann, B., Freiling, F.C.: Trevisor. In: International Conference on Applied Cryptography and Network Security, pp. 66–83. Springer (2012)Google Scholar
  16. 16.
    Götzfried, J., Müller, T.: Armored: Cpu-bound encryption for android-driven arm devices. In: Eighth International Conference on Availability, Reliability and Security (ARES) 2013, pp. 161–168. IEEE (2013)Google Scholar
  17. 17.
    Nilsson, A., Andersson, M., Axelsson, S.: Key-hiding on the arm platform. Digit. Invest. 11, S63–S67 (2014)CrossRefGoogle Scholar
  18. 18.
    Henson, M., Taylor, S.: Memory encryption: a survey of existing techniques. ACM Comput. Surv. (CSUR) 46(4), 53 (2014)CrossRefzbMATHGoogle Scholar
  19. 19.
    McGregor, P., Hollebeek, T., Volynkin, A., White, M.: Braving the cold: new methods for preventing cold boot attacks on encryption keys. In: Black Hat Security Conference, Las Vegas (2008)Google Scholar
  20. 20.
    TCG.: Tcg platform reset attack mitigation specification. (2008). Accessed 30 Oct 2016
  21. 21.
    Gutmann, P.: Data remanence in semiconductor devices. In: Proceedings of the 10th conference on USENIX Security Symposium, vol. 10. USENIX Association (2001)Google Scholar
  22. 22.
    Halderman, J.A., Schoen, S.D., Heninger, N., Clarkson, W., Paul, W., Calandrino, J.A., Feldman, A.J., Appelbaum, J., Felten, E.W.: Lest we remember: cold-boot attacks on encryption keys. Commun. ACM 52(5), 91–98 (2009)CrossRefGoogle Scholar
  23. 23.
    Saout, C.: dm-crypt: a device-mapper crypto target. (2011). Accessed 30 Oct 2016
  24. 24.
    Google.: Encryption. (2016). Accessed 30 Oct 2016
  25. 25.
    Beniamini, G.: Extracting qualcomm’s keymaster keys—breaking android full disk encryption. (2016). Accessed 30 Oct 2016

Copyright information

© Springer Science+Business Media New York 2017

Authors and Affiliations

  • Xiaosong Zhang
    • 1
    • 2
  • Yu-an Tan
    • 1
    • 3
  • Yuan Xue
    • 1
  • Quanxin Zhang
    • 1
  • Yuanzhang Li
    • 1
  • Can Zhang
    • 1
  • Jun Zheng
    • 1
    • 3
    Email author
  1. 1.School of Computer Science and TechnologyBeijing Institute of TechnologyBeijingChina
  2. 2.Department of Computer Science and TechnologyTangshan UniversityTangshanChina
  3. 3.Research Center of Massive Language Information Processing and Cloud Computing ApplicationBeijingChina

Personalised recommendations