Memory Block Write Protection Clearance Using Certificate Chains
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing non-volatile memory blocks in memory modules, such as DIMMs or DRAM, face challenges in securely managing write protection and clearing it in a normal operating system environment without requiring removal from service, as current methods lack secure authentication for modifying write protection during normal usage.
Innovation Solution
Implementing a memory slot with a certificate chain and a processing device that uses secure certificate authentication to enable authorized entities to clear or void write protection and perform firmware updates, ensuring only valid entities can modify protected memory blocks during normal operation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If write protection is enabled for memory blocks to secure data, then data security is improved, but the ability to modify or clear protection during normal operation deteriorates
Solution Approach 1:
The patent introduces a certificate chain as an intermediary authentication mechanism between the processing device and entities requesting write protection clearance. The certificate chain verifies the identity and authority of entities (memory module manufacturer, system environment manufacturer, etc.) without requiring physical removal of the memory module. This mediator enables secure authorization during normal operation while maintaining data protection.
Solution Approach 2:
The patent replaces the mechanical/physical system of removing memory modules for protection clearance with a digital authentication system. Instead of physically accessing test environment connections to clear write protection, the system uses cryptographic verification of certificate chains and signatures to authorize protection clearance through standard operational interfaces.
2Reliability
If secure authentication is implemented for modifying write protection, then security is improved, but system complexity deteriorates
Solution Approach 1:
The patent implements preliminary action by pre-installing certificate chains in the memory module during manufacturing. These certificate chains serve as pre-configured authentication credentials that enable future write protection clearance operations without requiring complex runtime authentication setup. The authentication infrastructure is prepared in advance, simplifying the operational complexity.
Solution Approach 2:
The patent uses certificate chains as digital copies of authentication credentials that can be verified without exposing the actual private keys or sensitive information. The processing device verifies signatures using public keys from the certificate chain, creating a copy-based authentication system that maintains security while enabling verification during normal operation.
3Stability of the object's composition
If write protection is set during manufacturing for reserved blocks, then data integrity is improved, but flexibility to manage protection during normal usage deteriorates
Solution Approach 1:
The certificate chain acts as an intermediary that bridges the manufacturing environment and normal operational environment. It allows entities authorized during manufacturing (memory module manufacturer, system environment manufacturer) to maintain their authorization credentials, enabling them to manage write protection flexibly during normal usage without compromising the integrity established during manufacturing.
Solution Approach 2:
The patent transforms the static write protection system into a dynamic one by enabling protection clearance and modification during normal operation through authenticated requests. The system adapts from a fixed manufacturing-state protection model to a flexible operational-state model where authorized entities can dynamically manage protection based on runtime conditions.
Data Source
AI summary
In an embodiment, an apparatus is disclosed that includes a memory slot including a certificate chain corresponding to an entity and a memory block. The memory block has protection enabled. The apparatus includes a processing device. The processing device is configured to receive a request message to clear protection for the memory block from a computing device of the entity. The request message includes a signature generated based at least in part on a private key of the entity. The processing device is configured to determine a public key corresponding to the entity based at least in part on the certificate chain, determine that the signature is valid based at least in part on the public key, determine that the protection for the memory block corresponds to the certificate chain and clear the protection for the memory block.