Computational Storage Program Authentication via CA Key Exchange
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computational storage (CS) devices are vulnerable to attacks due to insecure offload programming, which compromises the security of downloadable programs.
Innovation Solution
A method is provided to generate and distribute a program encryption key using a certificate authority (CA) to encrypt downloadable programs, ensuring secure distribution and authentication through a secure download program image format, including encryption and digital signatures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If offload programming is used to transfer computation to storage devices, then processing efficiency is improved, but security vulnerability increases
Solution Approach 1:
The system performs preliminary actions by generating encryption keys, encrypting program images, and creating digital signatures before the program is downloaded to the computational storage device. This ensures that security measures are established in advance, allowing efficient offload processing while maintaining security through pre-configured encryption and authentication mechanisms.
Solution Approach 2:
The patent introduces cryptographic intermediaries including encryption keys, certificate authorities, and digital signatures that mediate between the host system and computational storage device. These intermediaries enable secure program transfer and execution without compromising the efficiency benefits of offload processing, as the security layer operates independently from the computation offloading mechanism.
2Adaptability or versatility
If program images are downloaded to computational storage devices, then computation offloading is enabled, but susceptibility to attacks increases
Solution Approach 1:
The system applies preliminary anti-action by encrypting program images with encryption keys and attaching digital signatures from certificate authorities before downloading them to the computational storage device. This preemptive security measure counteracts potential attacks by ensuring that only authenticated and encrypted programs can be executed, thereby enabling computation offloading while mitigating attack vulnerability.
Solution Approach 2:
The patent converts the potential harm of downloaded programs being vulnerable to attacks into a benefit by using the download process as an opportunity to apply encryption and digital signature authentication. The act of downloading, which initially creates vulnerability, becomes a controlled security checkpoint where program integrity is verified and encryption is enforced, thereby enabling safe computation offloading.
3Reliability
If encryption keys are distributed to enable program encryption, then security is enhanced, but key distribution complexity increases
Solution Approach 1:
The patent uses certificate authorities and digital signatures as intermediaries to simplify key distribution. Instead of directly managing complex key exchange between all parties, the system introduces a trusted intermediary (certificate authority) that issues signed certificates containing public keys. This intermediary mechanism enhances security while reducing the complexity of direct peer-to-peer key distribution, as the certificate authority centralizes the trust management function.
Data Source
AI summary
A method to exchange and manage a key is provided. The method includes receiving, at a computational storage device (CSD), a user certificate (CAuser) that is generated based on a public key of a user (PUuser); extracting, at the CSD, the PUuser using a public key of the certificate authority (PUca); generating, at the CSD, an encryption program key; encrypting, at the CSD, the encryption program key using the PUuser to generate an encrypted encryption program key; and storing, at the CSD, the encrypted encryption program key.