Disk Drive Shared Secret Decryption and Overwrite Mechanism
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems fail to effectively protect shared secrets stored in object code from unauthorized access, as clear-text storage makes them vulnerable to compromise during processor startup, potentially leading to unauthorized authentication.
Innovation Solution
A disk drive with a non-volatile memory storing encrypted object code, a processor for retrieval, and a decryption engine that decrypts the secret within the drive, writing it to memory for authentication before overwriting it to maintain security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the shared secret is stored in clear text in non-volatile memory, then the processor can easily retrieve it during startup, but the secret becomes vulnerable to compromise by unauthorized reading of the memory
Solution Approach 1:
The harmful aspect (clear-text secret) is extracted from the non-volatile memory by storing only encrypted form, while the decryption capability remains within the trusted boundary of the processor system. This separates the storage location from the decryption location, ensuring the secret never exists in clear text outside the processor's controlled environment
Solution Approach 2:
An encryption/decryption mechanism serves as an intermediary between the stored secret and its usage. The secret is transformed into an encrypted form for storage and only converted back to clear text within the secure processor environment when absolutely necessary for authentication operations
2Reliability
If the decrypted secret is stored in memory for authentication, then the authentication procedure can proceed, but the secret remains exposed to potential attacks during the authentication process
Solution Approach 1:
The system performs preliminary encryption of the secret before storage and preliminary establishment of secure communication channels before authentication. The decryption occurs only at the moment of authentication need, minimizing the time window for potential attacks
Solution Approach 2:
The decrypted secret is held in memory only for the minimal necessary duration to complete the authentication exchange, then immediately overwritten. The system rushes through the authentication process quickly once decryption occurs, reducing exposure time
3Object-affected harmful factors
If the secret is overwritten after use, then security is maintained, but the system must manage memory operations carefully to ensure the secret is available when needed
Solution Approach 1:
The processor itself performs the overwriting operation after authentication, using self-service to maintain security without requiring external intervention. The system automatically manages the secret's lifecycle from decryption to usage to destruction
Data Source
AI summary
In one embodiment, a disk drive is provided that is adapted for security authentication. The disk drive includes: a non-volatile memory storing object code; a processor for retrieving the stored object code; a decryption engine for decrypting a retrieved shared secret from the object code; and a first memory for storing the decrypted retrieved shared secret; wherein the processor is configured to overwrite the written decrypted retrieved shared secret after it has been used in an authentication procedure.