Criptografia em memória com always encrypted: uma análise forense

Abstract

With the cheapening of RAM memory and the evolution of the main database management systems on in-memory technologies, data is residing for a longer time in memory. However, solutions to protect data, while in memory, are scarce in the market. The Always Encrypted feature from Microsoft’s SQL Server 2016 promises to solve this problem. In this article, this solution is studied through the comprehension of roles that client and server exercise, the feature’s deployment analysis, understanding the way in which data is stored in SQL Server and server memory acquisition for evaluation of the content of in-row data pages. It is used a topology where the client machine has a SQL client and the server machine contains a SQL Server 2016 instance. Then, it is 18 generated a certificate to create the cryptographic keys. A control table and another with Always Encrypted are created and loaded with known data. At that time, the DBMS’ native command, DBCC PAGE, and the visual analysis of a memory dump using the hex editor HexEdit are used to capture and identify the records within the data pages. The main objective in this article is to analyze the Always Encrypted feature from SQL Server 2016 through evaluating data pages in cache with classified information to verify its vulnerability in memory. The results obtained confirm that the elements protected by this feature remain encrypted in memory.