Memory System Secure Binding via Pre-Programmed Initialization Key
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for securely binding a host and a memory chip over an unsecured communication link are vulnerable to security attacks, as they rely on generating a secret key locally by the host and sending it to the memory chip, which can compromise the secrecy of the memory system.
Innovation Solution
A memory system with a pre-programmed device identifier and initialization key, stored in a securely accessible database, generates a binding key by combining received binding information with the initialization key, ensuring secure communication only if the memory signature is authenticated successfully, using a controller to manage the binding process and encryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a secret key is generated locally by the host and sent to the memory chip over an unsecured communication link, then binding between host and memory chip can be established, but the secrecy of the memory system is compromised due to vulnerability to security attacks
Solution Approach 1:
The initialization key is pre-programmed into the memory chip during manufacturing, before deployment. This preliminary action ensures that the secret material never needs to be transmitted over communication links, eliminating the vulnerability to interception attacks while enabling secure binding.
Solution Approach 2:
The secret initialization key is extracted from the host system and embedded directly into the memory chip during production. This separation removes the key from the host's control domain, preventing host-based attacks and ensuring that even if the host is compromised, the memory chip retains its secret independently.
2Object-affected harmful factors
If pre-programmed initialization key is used in memory chip, then security against communication attacks is improved, but device complexity increases due to database integration and authentication mechanisms
Solution Approach 1:
A database serves as an intermediary between the host and memory chip, storing the initialization key and device identifier. The host queries the database to retrieve the corresponding key, eliminating the need for complex key management protocols over the communication link while maintaining security.
Solution Approach 2:
The memory chip performs self-authentication by verifying the retrieved initialization key against its pre-programmed key locally. This self-service mechanism eliminates the need for complex mutual authentication protocols, reducing communication overhead and system complexity while maintaining security.
Data Source
Figure 1
Figure 2
AI summary
A memory system includes an interface, a non-volatile memory and a controller. The interface is configured to communicate over an unsecured communication link with an external host. The non-volatile memory is pre-programmed with a device identifier and a corresponding initialization key that are additionally stored in a database that resides externally to the memory system, and is securely accessible by the host. The controller is configured to send the device identifier to the host, to receive from the host, via the interface, binding information that was generated in the host, to generate, using at least the received binding information and the pre-programmed initialization key, a first binding key that matches a second binding key that is generated in the host based on an initialization key securely obtained by the host from the database, and to securely communicate with the host over the communication link using the first binding key.