Memory Device PKI Authentication for Custom Function Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for managing custom memory functions in SSDs and other memory devices face challenges in secure deployment, as they often result in high overhead and risk of unintended access, particularly when trying to restrict custom releases to targeted customers, leading to cumbersome and insecure processes.
Innovation Solution
The implementation of a public key infrastructure (PKI) using asymmetric cryptography allows for secure management of custom memory functions by authenticating host signatures and public keys, ensuring that only authorized devices can execute custom memory functions, thereby preventing unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If program codes of a custom memory function are released broadly among customers with a list of serial numbers, then more customers can access the custom function, but the deployment process becomes cumbersome and takes extended turnaround time
Solution Approach 1:
The patent extracts the security verification mechanism from the deployment process by implementing a signature validation system. The host device signs a challenge-response pair, and the memory device verifies the signature using the host's public key. This extraction allows rapid deployment without manual distribution of serial number lists, resolving the contradiction between broad accessibility and deployment time.
Solution Approach 2:
The patent implements preliminary action by having the host device generate and provide its public key to the memory device in advance. The memory device stores this public key and uses it for future signature verifications. This preliminary setup eliminates the need for time-consuming serial number distribution and verification during each deployment, enabling both broad access and rapid deployment.
2Reliability
If program codes of a custom memory function are released to targeted customers only, then security is improved, but the overhead of managing targeted release is large and the process is cumbersome
Solution Approach 1:
The patent implements a universal signature-based authentication mechanism that works across all host-device pairs. Instead of managing separate access lists for different customer groups, the system uses a single public key infrastructure that any host can utilize. This universal approach maintains security while eliminating the complexity of targeted release management.
Solution Approach 2:
The patent enables self-service authentication where the host device independently generates signatures using its private key, and the memory device autonomously verifies these signatures using the stored public key. This self-service mechanism eliminates the need for vendor-mediated authentication and complex management overhead, while maintaining strong security through cryptographic verification.
3Ease of operation
If program codes are released without targeted customer restriction, then deployment is simplified, but there is high probability of sending codes to unintended customers
Solution Approach 1:
The patent introduces cryptographic signatures as an intermediary verification mechanism between the host device and memory device. The host device's signature acts as a mediator that proves its identity without requiring the vendor to explicitly approve or blacklist specific devices. This intermediary mechanism maintains deployment simplicity while ensuring accurate customer targeting through cryptographic proof.
Data Source
AI summary
This application is directed to managing custom memory functions in a memory device coupled to a host device in an electronic system. The memory device obtains an information item (e.g., program, data, metadata) used to implement a custom memory function. The memory device receives a host signature and a public key from the host device and authenticates the host signature using the public key. In accordance with an authentication of at least the host signature, the memory device executes the custom memory function based on the information item. In some embodiments, the host device selects a set of memory devices based on a first-come-first-serve order, and the custom memory function is executed at each of the set of memory devices in accordance with an authentication of at least a respective host signature issued by the host device.