External NVM Signature Control for Tamper-Resistant Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Microcontrollers with small process node sizes face security risks when interfacing with external storage devices due to potential data tampering and manipulation, which is costly to integrate on-chip storage and results in inefficient security protocols that delay data access.
Innovation Solution
A non-volatile memory system with a memory controller that generates and maintains cryptographic signatures, ensuring data integrity by always replacing the current signature upon write and allowing verification upon read, thus securely storing data without extensive security protocols.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If external storage devices are used to avoid integrating on-chip storage at small process node sizes, then manufacturing cost is reduced, but security risks increase due to potential data tampering and manipulation
Solution Approach 1:
The patent introduces a memory controller as an intermediary component between the processor and external non-volatile memory. This memory controller manages cryptographic signature generation and verification, acting as a mediator that enables secure data storage without requiring the processor itself to implement complex security functions. The memory controller handles the cryptographic operations, allowing the external storage system to maintain security while remaining cost-effective.
Solution Approach 2:
The patent implements preliminary cryptographic signature generation before data is written to external non-volatile memory. The memory controller generates a cryptographic signature for each data write operation, establishing a secure reference signature in advance. This preliminary action ensures that any subsequent reads can be verified against the expected signature, preventing data tampering while maintaining simple external storage architecture.
2Reliability
If extensive security protocols are implemented to protect external storage data, then data security is improved, but data access speed decreases due to additional verification steps
Solution Approach 1:
The patent performs cryptographic signature generation in advance during the write operation, creating a reference signature that is stored with the data. This preliminary action eliminates the need for complex real-time verification during reads, as the signature is already prepared and associated with the data. The verification process during reads becomes a simple comparison rather than a complex computation, maintaining high access speeds.
Solution Approach 2:
The patent uses cryptographic signatures as a form of data copy that verifies integrity without requiring the actual data to be reprocessed. Instead of verifying data contents through complex protocols, the system copies and compares cryptographic hashes (signatures) that represent the data's integrity state. This copying approach provides security verification with minimal computational overhead and no impact on read performance.
3Reliability
If cryptographic signatures are generated and verified for every data operation, then data integrity is improved, but processing complexity increases
Solution Approach 1:
The patent assigns the cryptographic operations to a dedicated memory controller that acts as an intermediary between the processor and external storage. This separation of concerns allows the memory controller to handle complex cryptographic functions while the processor maintains simple data access logic. The memory controller manages signature generation, storage, and verification, reducing the processing complexity at the processor level while maintaining strong data integrity protections.
Solution Approach 2:
The memory controller implements self-service by automatically generating and managing cryptographic signatures for all write operations without requiring processor intervention. The system handles its own security needs by autonomously creating reference signatures, storing them with the data, and performing verification during reads. This self-service approach reduces the overall system complexity by eliminating the need for complex processor-based security protocols.
Data Source
AI summary
A non-volatile memory (NVM) system external to a processor comprising an NVM and a memory controller may perform various aspects of the techniques. The NVM may store a first cryptographic signature and first data. The memory controller may, responsive to a first write request to write updated data to at least a portion of the NVM, to store the updated data in the NVM along with the first data to create second data. The memory controller may also generate, a second cryptographic signature that always differs from the first cryptographic signature, and store the second cryptographic signature as a current cryptographic signature. The memory controller may further output, to the processor, the current cryptographic signature as a reference signature, where the memory controller always replaces the current cryptographic signature, with cryptographic properties, whenever the NVM is written to and does not otherwise permit writing the current cryptographic signature.