Memory Device Message Authentication Zone Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing memory devices lack effective security measures to ensure the authenticity and integrity of data operations, particularly in diverse and widespread communication technologies like IoT devices, where secure data storage is crucial.
Innovation Solution
A memory device is designed with a message authentication protocol that divides its memory space into secured zones, using a message authentication code (MAC) to authenticate and verify command sequences, ensuring only authorized operations are executed by computing a value matching the received MAC using stored parameters, and preventing operation completion if the values do not match.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If message authentication protocol is implemented to secure memory zones, then data security and integrity are improved, but device complexity increases
Solution Approach 1:
The memory space is divided into multiple secured zones, each with its own message authentication parameter. This segmentation allows the security protocol to be applied selectively to different memory regions, improving data security for critical zones while maintaining simpler access for non-critical zones, thus balancing security requirements with device complexity.
Solution Approach 2:
Message authentication parameters are pre-stored in the memory device before operations occur. The authentication process uses these pre-stored parameters to verify command sequences, which eliminates the need for complex real-time key generation or exchange mechanisms, thereby improving security while limiting the increase in device complexity.
2Reliability
If message authentication code verification is performed for each command sequence, then operation authenticity is improved, but processing time increases
Solution Approach 1:
The message authentication parameters are pre-computed and stored in the memory device before actual operations. When a command sequence is received, the device retrieves these pre-stored parameters for verification rather than computing them in real-time, which ensures operation authenticity while minimizing the time penalty for authentication.
Solution Approach 2:
The system uses a simplified verification process where the received message authentication code is compared against a computed value derived from pre-stored parameters. This copying and comparison approach is computationally lighter than full cryptographic verification, thus maintaining authenticity while reducing processing time overhead.
3Reliability
If multiple secured memory zones are implemented with zone-specific parameters, then data integrity is improved, but manufacturing complexity increases
Solution Approach 1:
The memory is divided into multiple zones with zone-specific message authentication parameters. Each zone can be independently configured and secured during manufacturing, allowing for modular production processes. This segmentation enables manufacturers to apply security measures to only the zones requiring protection, simplifying the overall manufacturing process while maintaining data integrity for critical zones.
Solution Approach 2:
The system uses configurable message authentication parameters that can be set during manufacturing or initialization. By allowing these parameters to be changed or configured after basic device fabrication, the manufacturing process itself remains relatively simple, while the security parameters can be customized for different zones to achieve the required data integrity levels.
Data Source
AI summary
A memory device can include a memory, and an interface to receive a memory command sequence. A message authentication code MAC is provided with the command sequence. Control circuits on the device include a command decoder to decode a received command sequence and to execute an identified memory operation. A message authentication engine includes logic to compute a value of a message authentication code to be matched with the received message authentication code based on the received command sequence and a stored key. The device can store a plurality of keys associated with one or more memory zones in the memory. Logic on the device prevents completion of the memory operation identified by the command sequence if the value computed does not match the received message authentication code.