Non-Volatile Memory Data Log Security via Forensic Key Locking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Non-volatile memory devices, such as FRAM and MRAM, used for data logging in automotive, industrial, and financial applications are susceptible to unauthorized access and data tampering, particularly through the on-board diagnostics port, which can compromise the integrity of critical data logs.
Innovation Solution
Implementing a secure locking mechanism within the NVM device that restricts access to memory regions upon trigger events like accidents or power loss, using a forensic key for authentication to allow authorized access, and employing cryptographic authentication between the host computing system and the NVM device to ensure secure data storage and retrieval.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the NVM device allows unrestricted access to memory regions for data logging, then ease of operation is improved, but security and data integrity deteriorate due to susceptibility to unauthorized access and tampering
Solution Approach 1:
The memory device is divided into multiple memory regions, with at least one region designated as a protected log memory region. This segmentation allows the device to maintain both accessible areas for normal operations and secured areas for critical data logging, resolving the contradiction between ease of access and data integrity.
Solution Approach 2:
Different security characteristics are applied to different parts of the memory device. The protected log memory region has restricted access controls and requires authentication, while other memory regions maintain standard access permissions. This local differentiation enables simultaneous ease of operation in non-protected areas and enhanced security in critical areas.
2Reliability
If a locking mechanism is implemented to restrict access to protected memory regions, then security is improved, but device complexity increases due to additional authentication requirements
Solution Approach 1:
Authentication credentials (passwords, cryptographic keys, or biometric data) are pre-configured in the memory device during manufacturing or initial setup. This preliminary action eliminates the need for complex real-time authentication logic, as the device simply compares incoming credentials against pre-stored values, thereby enhancing security while minimizing added complexity.
Solution Approach 2:
A memory control unit acts as an intermediary between the host system and the protected memory regions. This intermediary handles all authentication requests, manages credential verification, and controls access to the protected log memory region. By centralizing security functions in this intermediary component, the overall device complexity is managed while maintaining robust security.
3Reliability
If cryptographic authentication is employed between host system and NVM device, then data security is improved, but ease of operation deteriorates due to restricted access requirements
Solution Approach 1:
The access control mechanism is made dynamic rather than static. The memory device can transition between locked and unlocked states based on successful authentication. During normal operation, authorized users can access protected regions without continuous authentication overhead. The system adapts its security level based on the authentication state, balancing security requirements with operational ease.
Data Source
AI summary
An apparatus including non-volatile memory to store a forensic key and data, the data received from a host computing system. A processing device is coupled to the non-volatile memory and is to: allow writing the data, by the host computing system, to a region of the non-volatile memory; in response to a lock signal received from the host computing system, assert a lock on the region of the non-volatile memory, the lock to cause a restriction on access to the region of the non-volatile memory by an external device; and provide unrestricted access, by the external device, to the region of the non-volatile memory in response to verification of the forensic key received from the external device.