External Memory Data Protection via Cryptographic Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems-on-a-chip cannot effectively protect program code stored in external memories from unauthorized access or copying, as the locking mechanisms used for built-in memories do not apply to external memories, leading to data security vulnerabilities.
Innovation Solution
A memory data protection apparatus comprising a storage device, a cipher, and a validator is embedded in a chip, which stores an offset value, signature, and key, and includes an encrypter and decrypter to encrypt and decrypt data, and a validator to determine access limits based on validated certified data, ensuring secure access to external memory.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If external memory is used to store program code, then the size of executable program code can be increased, but data security is compromised as the memory is independent from the system-on-a-chip and can be easily accessed or unlocked
Solution Approach 1:
The protection mechanism is divided into multiple independent components: a storage device for securing cryptographic keys, a cipher module for encryption/decryption operations, and a validator for access control. This segmentation allows the external memory to maintain its large capacity while the chip contains the security-critical functions that protect the data.
Solution Approach 2:
The cipher module acts as an intermediary between the external memory and the processor. It encrypts data before storage in external memory and decrypts it during execution, mediating all access to protect against unauthorized reading or copying while allowing legitimate program execution.
2Reliability
If built-in memory locking mechanism is applied, then data security is improved, but the mechanism cannot be applied to external memory
Solution Approach 1:
The protection apparatus provides a universal solution that works with external memory while maintaining security principles similar to built-in memory protection. The validator checks cryptographic signatures and controls access based on validated conditions, adapting the locking concept to external memory's independent nature.
Solution Approach 2:
The system changes the protection parameters from physical locking (built-in memory) to cryptographic validation (external memory). Instead of preventing access at the hardware level, the system uses digital signatures, offset values, and cryptographic keys to control and validate access permissions dynamically.
3Reliability
If encryption is implemented on external memory, then data confidentiality is improved, but access control and validation complexity increases
Solution Approach 1:
The system performs preliminary validation of cryptographic signatures and offset values before allowing decryption and access to the program code. The validator checks the digital signature and verifies the offset value in advance, ensuring that only authorized access attempts proceed to decryption, thereby simplifying the overall access control flow.
Solution Approach 2:
The validator provides feedback by verifying cryptographic parameters and controlling the cipher module's operation. The system uses feedback loops where the validator checks signatures and offset values, then enables or disables decryption based on validation results, creating a controlled access mechanism that balances security with manageable complexity.
Data Source
AI summary
A memory data protection apparatus including a storage device, a cipher, and a validator is provided. The storage device is embedded in a chip electrically coupled to an external memory for storing an offset value, a signature and a key. The cipher electrically coupled to the storage device and the external memory to receive the key includes an encrypter and a decrypter. The encrypter is capable of executing an encryption to output an encrypted data and an encrypted certified data. The decrypter is capable of executing a decryption to output a decrypted data. The validator electrically coupled to the storage device receives the signature, the offset value and the certified data and determines an access limit of the external memory by validating the certified data with the signature and the offset value. The memory data protection apparatus accesses an original data in the external memory according to the access limit.