Memory Device Security Token Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication methods for communication endpoints with secure memory devices in service networks lack robustness and efficiency, particularly in ensuring the integrity and ownership verification of memory devices within computing systems.
Innovation Solution
A memory device configured as a security token generates a certificate using a security manager, which includes a public key for authorization, a monotonic counter for freshness, and a challenge-response protocol for verification, ensuring secure operations and endpoint authentication in a network.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional authentication methods are used for communication endpoints, then the authentication process is simpler, but the security and robustness of the authentication is insufficient
Solution Approach 1:
The patent introduces a security token as an intermediary device between the communication endpoint and the authentication server. This token contains a secure memory device that stores cryptographic keys and generates authentication certificates, mediating the authentication process to enhance security without requiring complex changes to the endpoint or server infrastructure.
Solution Approach 2:
The patent replaces traditional mechanical/password-based authentication systems with a cryptographic system based on public-key infrastructure. The secure memory device generates and manages cryptographic key pairs, using mathematical problems (such as elliptic curve cryptography) to provide security, thereby substituting physical security mechanisms with computational security mechanisms.
2Reliability
If ownership verification of memory devices is implemented, then unauthorized access is prevented, but the authentication process becomes more complex
Solution Approach 1:
The patent implements preliminary binding between the secure memory device and the communication endpoint during device initialization or first authentication. The endpoint's identifier is cryptographically bound to the device's private key in advance, creating a permanent association that simplifies subsequent ownership verification without requiring complex real-time checks.
Solution Approach 2:
The patent employs a challenge-response authentication mechanism where the authentication server sends a challenge to the security token, which responds using its private key. The server verifies the response using the stored public key, providing immediate feedback on ownership verification. This feedback loop ensures secure authentication while maintaining a relatively simple process through cryptographic automation.
3Reliability
If certificate-based authentication is used with monotonic counters, then freshness and replay attack protection are improved, but the authentication protocol becomes more complex
Solution Approach 1:
The patent incorporates a monotonic counter in the authentication certificate that increases with each authentication attempt. This dynamic element ensures that each certificate is unique and time-sensitive, preventing replay attacks. The counter automatically updates, providing freshness without requiring manual intervention or complex time-synchronization protocols between devices.
Data Source
AI summary
Disclosed are methods for utilizing a memory device as a security token. In one embodiment, a method includes receiving a request to perform an operation; transmitting a nonce to a memory device; receiving a second nonce from the memory device, the second nonce encrypted using a private key of the memory device; verifying the second nonce using a public key of the device, held by the host system; and executing the operation upon successfully verifying the second nonce.