Non-volatile Memory Secure Read Digest Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Ensuring the integrity and authenticity of data stored in non-volatile memory devices, particularly in scenarios where data needs to be trusted for secure boot processes, is challenging due to the risk of alteration or tampering, especially in environments where software applications can be loaded on hosts.
Innovation Solution
A non-volatile memory device verifies data integrity and authenticity by computing digests for accessed data and comparing them with expected digests stored on the device, only providing data on the host interface if the computed digests match, thus ensuring trusted data is transmitted.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is stored in non-volatile memory device for host access, then data availability is improved, but data integrity and authenticity cannot be guaranteed against tampering
Solution Approach 1:
The patent applies preliminary action by pre-computing and storing digests of authorized data in a secure area of the memory device before host access. When data is requested, the system retrieves the pre-stored digest and compares it with a re-computed digest of the accessed data, enabling verification without requiring complex external validation infrastructure.
Solution Approach 2:
The patent introduces digests as an intermediary element that mediates between the stored data and the host verification process. Instead of the host directly verifying data authenticity through complex mechanisms, the digest serves as a simplified intermediary that encapsulates the integrity verification, reducing the complexity burden on the host system.
2Reliability
If host system verifies data authenticity, then security is improved, but host system becomes target for attacks and compromises
Solution Approach 1:
The patent inverts the traditional verification model by having the memory device (rather than the host) perform the primary verification function. The host simply requests data and receives it with integrity guarantees, while the memory device internally verifies authenticity using secure stored digests. This inversion protects the host from becoming a target for verification-related attacks.
Solution Approach 2:
The memory device provides self-service security by autonomously verifying data authenticity using pre-stored digests in its secure area. The device independently determines whether accessed data matches authorized versions without requiring the host to perform verification operations, thereby eliminating the host's exposure to verification-related security risks.
3Reliability
If data access is restricted for security, then security is improved, but data accessibility and usability deteriorate
Solution Approach 1:
The patent uses copying by creating and storing digest copies of the authorized data in a secure area of the memory device. These digest copies enable rapid verification of data integrity without requiring access to the original data sources or complex verification protocols, thus maintaining ease of operation while enforcing security restrictions.
Solution Approach 2:
By pre-computing and storing digests before host access operations, the system prepares verification credentials in advance. This preliminary action ensures that when data access is restricted for security, the verification process remains simple and fast, as the digests are already prepared and readily available for comparison.
Data Source
AI summary
Technology that provides security for a requestor of data stored in a non-volatile memory device is disclosed. In one aspect, the non-volatile memory device provides data on a host interface only if a digest for the data matches an expected digest for the data. The non-volatile memory device may store expected digests for data for various logical addresses. Upon receiving a request on the host interface to read data for a logical address, the non-volatile memory device may access the data for the logical address, compute a digest for the accessed data, and compare the computed digest with the expected digest. The non-volatile memory device provides the accessed data on the host interface only if the computed digest matches the expected digest, in one aspect. The non-volatile memory device may be used to provide a secure boot of a host.