Use a method similar to virtual memory to ensure minimal leakage of memory data from confidential processes

[Proposer233]

If possible, I think we can try to divide the programs in the security enclave into "secret" and "top secret". For processes of type Top Secret, the following rules apply:
Dump all the contents of its data memory region into the hard disk in encrypted form, and set the area in its physical memory to empty. Driver captures missing page interrupts (or similar).When a program tries to access a data region, it decrypts the memory data in that area and chunks it into physical memory. After a certain period of time, the dump operation is automatically re-executed.

[Proposer233]

Or we could try also encrypting non-data region like it.

[DavidXanatos]

No that would be beyond reasonable, also we can not do anything we want in the kernel windows is quite strict here what is permissible and what is not.
Just enable page file encryption, or disable page file all together and its safe enough.

One could add a mechanism to block suspend to disk while high security labeled processes are running though.

[Proposer233]

Is there some way to increase the difficulties of DMA(Direct Memory Access)?

[DavidXanatos]

I don't think so, I'm not aware of a kernel API that would allow a driver to mess with that.

[Proposer233]

I think we could inject to protected processes in user mode.Frequently dump data memory region and empty them.Then insert SEH structure to catch memory-releated exceptions.If a exception is caused,call PrivacyAgent and ask for the needed memory data.