Generally the solutions to this problem are:
Don't store sensitive data in memory (could be dificult to achieve in some cases);
Encrypt data stored in memory (raises the problem of managing/securing encryption keys);
Minimise the time sensitive data is stored in memory (i.e. scrub [overwrite] it as soon as it is used, then find a method to obtain it again ...
It's pretty straightforward.
Let's say, this transaction is happening between Alice (an entity wishing to be verified) and Bob (an entity verifying Alice's identity). They both are in possession of a common secret key and are aware of the algorithm to use for authentication.
Step 1: Bob sends Alice a random string, the challenge. The challenge should be ...