Challenge Response Authentication for Data Storage Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Password authentication in data storage devices provides no real protection against interface attacks, leaving data vulnerable to unauthorized access.
Innovation Solution
A data storage device encrypts data using a bulk encryption key, generates challenge and response pairs, and stores them securely in non-volatile memory, authenticating hosts by regenerating the secret key using the response received from the host, thus preventing unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If password authentication is used to provide access control, then access control is implemented, but protection against interface attacks is insufficient
Solution Approach 1:
The system performs preliminary actions by pre-computing and storing multiple challenge-response pairs in the storage device before any authentication occurs. This allows the device to immediately present challenges to hosts without needing to generate them in real-time, ensuring that authentication credentials are prepared in advance and cannot be easily intercepted or replicated during the authentication process.
Solution Approach 2:
The challenge-response mechanism acts as an intermediary between the storage device and the host, replacing direct password authentication. The device presents challenges and verifies responses without exposing the actual authentication credentials, creating a secure intermediary layer that prevents interface attacks while maintaining authentication functionality.
2Ease of operation
If the secret key is stored in non-volatile memory for authentication, then authentication capability is provided, but the device becomes vulnerable to tampering
Solution Approach 1:
The system pre-computes multiple challenge-response pairs and stores them in non-volatile memory before any tampering can occur. This preliminary preparation ensures that even if the device is tampered with later, the authentication credentials remain secure because they are distributed across multiple pre-prepared pairs rather than a single accessible secret key.
Solution Approach 2:
The system changes the parameter of key storage from storing a single static secret key to storing multiple dynamic challenge-response pairs. This parameter change ensures that the authentication credentials are not vulnerable to tampering because each challenge-response pair is mathematically linked and cannot be independently modified or extracted without detection.
3Reliability
If multiple challenge-response pairs are stored in non-volatile memory, then authentication security is improved, but device complexity increases
Solution Approach 1:
The system performs the complex operation of generating and storing multiple challenge-response pairs in advance during manufacturing or initialization. This preliminary action eliminates the need for complex real-time generation and management operations during normal operation, reducing the operational complexity while maintaining high authentication security through the pre-stored pairs.
Data Source
AI summary
Techniques for securing data stored on a data storage device are provided. The data storage device encrypts the data using a bulk encryption key and stores the bulk encryption key in non-volatile memory in an encrypted format. The data storage device generates a challenge and response pair, wraps a secret key with the response to generate a wrapped secret key, and stores the challenge and the wrapped secret key in the non-volatile memory. The data storage device authenticates a host by reading the challenge and the wrapped secret key from the non-volatile memory, erasing the challenge and the wrapped secret key from the non-volatile memory, sending the challenge to the host, receiving the response from the host, and unwrapping the wrapped secret key using the response from the host to regenerate the secret key.