NVM Device Secure Communication via Host Bypass
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
IoT devices with non-volatile memory (NVM) face security risks due to the inability to authenticate the source of code and ensure data integrity, as plaintext data is unprotected and can be modified or read by attackers, especially in smaller IoT devices with limited memory controller capabilities.
Innovation Solution
Establishing a secure protocol communication session directly between a server and the NVM device using protocols like SSL or TLS, which allows mutual authentication and ensures data integrity, bypassing the host computing system's limitations by converting TCP packets into SPI packets for secure data transfer.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If plaintext data is written from the host computing system to the external NVM device, then the data transfer is simple and fast, but the data is unprotected and can be read out and/or modified by an attacker
Solution Approach 1:
The patent introduces an intermediary encryption/decryption process between the host computing system and the NVM device. Data is encrypted before being written to the NVM device and decrypted only when read, preventing attackers from accessing or modifying plaintext data during storage and transfer.
Solution Approach 2:
The patent changes the state of data from plaintext to encrypted text during the write operation. This parameter change ensures that data remains protected while stored in the NVM device, resolving the security issue without significantly impacting transfer efficiency.
2Object-affected harmful factors
If encrypted data is written to the NVM device, then data security is improved, but the data has to be decrypted in the host computing system, opening up the IoT device to replay attacks and increasing the attack surface
Solution Approach 1:
The patent extracts the decryption function from the host computing system and places it directly in the NVM device. This allows encrypted data to be decrypted at the storage device level rather than requiring the host to decrypt data, reducing the attack surface and preventing replay attacks.
Solution Approach 2:
The NVM device performs decryption operations independently without requiring the host computing system to intervene. This self-service capability reduces the exposure of cryptographic operations to potential attacks on the host system.
3Volume of moving object
If the memory controller units of smaller sized IoT devices are used, then device size is reduced, but they cannot protect keys and thus compromise the secure protocol transaction
Solution Approach 1:
The patent merges the key protection and cryptographic functions directly into the NVM device's memory controller unit. This integration allows smaller IoT devices to maintain secure key protection capabilities without requiring separate dedicated security hardware, thus reducing overall device size while maintaining reliability.
Data Source
AI summary
An apparatus includes a non-volatile memory (NVM) device coupled to a host, the NVM device including a processing device to: receive a communication packet from a server via the host computing system that is coupled to the NVM device and communicatively coupled to the server, the communication packet comprising clear text data that requests to initiate secure communications; perform a secure handshake with the server, via communication through the host computing system, using a secure protocol that generates a session key; receive data, via the host computing system, from the server within a secure protocol packet, wherein the data is inaccessible to the host computing system; authenticate the data using secure protocol metadata of the secure protocol packet; optionally decrypt, using the session key, the data to generate plaintext data; and store the plaintext data in NVM storage elements of the NVM device.