Nonvolatile Memory Access Blocking for Attack Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Nonvolatile memory devices, such as flash memory, are vulnerable to unauthorized access due to their persistent nature, and existing zeroization processes are slow, allowing attackers to access data during the erasure process, potentially leading to false alarms and irreversible data loss.
Innovation Solution
A system that rapidly blocks access to nonvolatile memory by issuing a command block indication, allowing time to confirm the likelihood of an attack before triggering zeroization, using a multi-tier attack mitigation technique to prevent unauthorized access during the erasure process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a zeroization process is triggered to erase sensitive data in response to detecting an attack, then data security is improved, but the slow erase operation allows attackers to access data during the erasure process
Solution Approach 1:
The patent segments the protection mechanism into two distinct layers: a fast command-block layer that immediately prevents new access attempts, and a slow zeroization layer that permanently erases data. This segmentation allows the system to provide immediate protection while the lengthy erasure process occurs in the background, resolving the contradiction between fast protection and complete data erasure.
Solution Approach 2:
The patent applies preliminary action by first blocking commands at the controller level before initiating the zeroization process. This preliminary command-blocking action occurs in nanoseconds, immediately preventing attacker access while the slower data erasure proceeds asynchronously, thus resolving the speed-security contradiction.
2Ease of operation
If data in nonvolatile memory is erased in response to a false alarm, then false alarm handling is simplified, but recovery of the erased data becomes difficult or impossible
Solution Approach 1:
The patent implements a dynamic, multi-stage response system that adapts based on attack confirmation. The system starts with reversible command-blocking and progresses to irreversible zeroization only after attack verification. This dynamic approach allows easy handling of false alarms (simple unblocking) while protecting against real attacks through progressive escalation, resolving the contradiction between operational simplicity and data recovery capability.
3Loss of time
If command blocking is implemented to rapidly prevent access, then response time is improved, but system complexity increases due to multi-tier mitigation techniques
Solution Approach 1:
The patent introduces a command-filter intermediary layer between the attacker and the nonvolatile memory that operates independently and autonomously. This intermediary block filter rapidly evaluates and blocks malicious commands without requiring complex system-wide responses, achieving fast response time while maintaining relatively simple system architecture through localized intervention.
Data Source
AI summary
In some examples, a security processor detects a potential attack in a system. In response to detecting the potential attack in the system, the security processor issues a command block indication to block processing of commands to access a nonvolatile memory. The security processor determines, based on monitored information, a likelihood of the potential attack being a real attack, and in response to the determined likelihood, triggers an erase of the nonvolatile memory.