Memory System Firmware Key Generation for Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Memory systems using the same firmware version are vulnerable to security breaches if a shared encryption key is leaked, as all systems become compromised, lacking robust security measures for firmware encryption and decryption.
Innovation Solution
A memory system and operating method that utilize a memory controller to decrypt firmware using a symmetric-key encryption algorithm, generating a second key based on decrypted firmware, first data stored in the memory controller, and second data stored in the memory device, with the second key being hash data from merging the firmware, controller data, and device data, ensuring the first and second keys match for secure operation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a shared symmetric-key encryption algorithm is used for firmware encryption across multiple memory systems, then firmware can be consistently encrypted and decrypted, but security is compromised if the key is leaked since all systems using the same firmware version become vulnerable
Solution Approach 1:
The patent segments the key generation process into two distinct keys: a first key stored in the memory device and a second key generated by the memory controller. This segmentation allows each component to have its own key, preventing a single point of failure. The first key is used to decrypt firmware from the memory device, while the second key is generated by hashing the decrypted firmware combined with first data from the memory controller and second data from the memory device, creating a distributed security model where compromise of one key does not compromise the entire system.
Solution Approach 2:
The patent applies local quality by making each memory system's security characteristics unique through device-specific data. The first data stored in the memory controller and second data stored in the memory device are specific to each individual system, causing each system to generate a unique second key even when using the same firmware version. This local differentiation ensures that a key leak in one system does not compromise other systems, as each system's security is localized to its own unique data combinations.
2Device complexity
If firmware is encrypted with a key stored in the memory device, then decryption is simplified, but the system lacks additional verification mechanisms to ensure firmware integrity and authenticity
Solution Approach 1:
The patent implements feedback by generating a second key through hashing the decrypted firmware combined with device-specific data, then comparing this second key with the first key stored in the memory device. This feedback loop provides verification: if the keys match, the firmware is authenticated and can be executed; if they don't match, the firmware is rejected. This adds a verification layer that confirms firmware integrity and authenticity without significantly complicating the overall encryption process.
Solution Approach 2:
The patent applies preliminary action by pre-storing the first key in the memory device and pre-storing device-specific first data in the memory controller and second data in the memory device before firmware execution. These preliminary preparations enable the subsequent key generation and comparison process to proceed efficiently, ensuring that all necessary components are in place before the actual firmware authentication and execution occur.
Data Source
AI summary
Embodiments of the disclosure relate to a memory system and an operating method thereof. The memory system may decrypt first firmware which is stored in the memory device and is encrypted using a symmetric-key encryption algorithm, with a first key stored in the memory device, may generate a second key based on second firmware, which is obtained by decrypting the first firmware, first data stored in a first area in the memory controller, and second data stored in a second area in the memory device, and may drive the second firmware when the first key and the second key are the same.