Data Verification via Message Authentication Codes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing electronic devices face security breaches due to flaws in communication buses when using external non-volatile memories, particularly vulnerable to replay attacks, which existing encryption methods are insufficient to prevent.
Innovation Solution
A method involving the creation of a secured channel between an electronic device and a server using message authentication codes, where data is encrypted and verified using unique keys stored in one-time programmable memory, and a new authentication key is generated regularly to prevent unauthorized data reuse.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If encryption is used to secure data on the communication bus, then data confidentiality is improved, but vulnerability to replay attacks and spoofing attacks increases
Solution Approach 1:
The patent applies preliminary action by generating a message authentication code (MAC) in advance along with the data before storage. The MAC is computed using a secret key and the data itself, creating a cryptographic signature that binds the data to its authenticity. When data is retrieved, the MAC is recomputed and verified against the stored value, preventing replay attacks because the verification process ensures data integrity and origin authentication before use.
2Adaptability or versatility
If external rewritable non-volatile memory is used, then storage flexibility is improved, but security vulnerability increases due to bus exposure
Solution Approach 1:
The patent introduces an intermediary mechanism - the message authentication code (MAC) - that mediates between the data stored in external memory and the verification process. The MAC acts as a cryptographic intermediary that proves the data's authenticity without exposing the secret key or the memory contents. This intermediary verification layer protects against bus vulnerabilities by ensuring that even if data is intercepted or modified on the bus, the MAC verification will detect the tampering.
3Productivity
If data is stored in shared external memory, then resource utilization is improved, but attack surface increases for spoofing and relocation attacks
Solution Approach 1:
The patent applies local quality by associating a unique message authentication code with each specific data item stored in the shared memory. Instead of relying on general memory protection mechanisms, each data-MAC pair has its own cryptographic identity that verifies its authenticity independently. This local verification approach allows multiple data items to coexist in shared memory with different security credentials, enabling resource sharing while maintaining individual security against spoofing and relocation attacks.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Method for verifying data generated by an electronic device included in equipment, the electronic device comprising a computing unit, a single-programmable memory and volatile memory, the equipment comprising rewritable non-volatile memory and a communication bus enabling the electronic device to store data in rewritable non-volatile memory.The method includes: creating (21) an encrypted secure channel between the equipment and a server; obtaining (22,23) an authentication key from the server; loading (24) data and a message authentication code from rewritable non-volatile memory into volatile memory, the message authentication code having been obtained by the electronic device from the authentication key and said data prior to storing said data and the message authentication code in rewritable non-volatile memory, the electronic device not having retained the authentication key following the obtaining of the message authentication code; verifying (26) said data using the secret key and the message authentication code.