Data Security System Using Monotonic Counter Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data security systems face challenges in simultaneously protecting against data replay attacks and modifications caused by sudden service interruptions, as conventional methods for preventing replay and handling data alterations are often incompatible.
Innovation Solution
A data security system that incorporates a monotonic counter, a computing entity, and a physical data medium with secure data blocks and authentication codes to ensure data authenticity and integrity, including a first master block with the last monotonic counter value, an identifier, and authentication codes, along with a replica master block, to prevent unauthorized access and data corruption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data recovery is implemented using backup systems and RAID arrays to protect against sudden service interruptions, then data reliability is improved, but the ability to prevent replay attacks deteriorates because recovered data may use previous monotonic counter values
Solution Approach 1:
The master block is segmented into multiple components: monotonic counter value, authentication code, and data block identifier. This segmentation allows the system to verify each component independently, enabling recovery of data blocks while maintaining replay protection through the authenticated monotonic counter sequence.
Solution Approach 2:
An authentication code acts as an intermediary between the monotonic counter and the data blocks. This authentication code verifies the legitimacy of each data block in the sequence, allowing the system to accept recovered blocks only if they maintain the correct monotonic counter sequence, thus preventing replay attacks while enabling recovery.
2Object-affected harmful factors
If monotonic counters and authentication codes are used to prevent replay attacks, then security against unauthorized access is improved, but the ability to recover from service interruptions deteriorates because any data alteration is rejected
Solution Approach 1:
The system dynamically adjusts its response to data verification based on the context. When a data block is recovered and the monotonic counter sequence is valid, the system accepts the recovered data. When the sequence is invalid or authentication fails, the system rejects the data as a replay attack. This dynamic behavior enables both recovery and protection.
Solution Approach 2:
The system changes the verification parameters based on the operational state. During normal operation, strict authentication is applied to prevent replay. During recovery operations, the system allows reconstruction of data blocks as long as the monotonic counter sequence maintains its integrity, thus adapting the security parameters to the current needs.
3Reliability
If traditional backup systems are implemented to protect against data corruption, then data integrity is improved, but system complexity increases due to additional disks and RAID configuration
Solution Approach 1:
The patent merges the backup functionality with the existing data storage structure by integrating authentication codes and monotonic counters directly into the data blocks and master blocks. This eliminates the need for separate backup systems and RAID configurations, as the authentication mechanism itself enables recovery without requiring additional storage infrastructure.
Data Source
Figure 1A~1B
Figure 2
Figure 3
AI summary
The invention relates to a system and method for securing data. According to the invention, the system is characterised in that it consists of: a monotonic counter; a computing entity; a physical data medium including one or more data blocks (DBk1, DBk2, DBk3, DBk4), a first master block (MBk1) comprising the last value (Vlast) retrieved from the monotonic counter, an identifier (IDlast) of the last data block (DBk) written on the medium, a first authentication code (Auth_A) guaranteeing the authenticity of the written data block(s), a second authentication code (Auth_B) calculated from the last written data block, said data being fixed to a neutral value, and a third authentication code (Auth_C) guaranteeing the authenticity of the first master block (MBk1), and a second master block (MBk2) forming a replica of the first master block (MBk1); and an authentication key (15). The invention is particularly suitable for securing data against playback and sudden interruptions in service in embedded systems.