Protected Memory Authentication With Signed Read Commands
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing memory systems lack robust security measures for protecting data in secure regions, particularly in the absence of asymmetric key usage and dynamic adjustment of protected region attributes, leaving them vulnerable to malicious access.
Innovation Solution
Implementing a system where a host system and memory system exchange symmetric or asymmetric keys to access protected regions, with periodic updates, and verify the authenticity of data transmission using cryptographic identities, allowing dynamic adjustment of protected region sizes and addresses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If memory systems use traditional read access methods without authentication, then data access is simple and fast, but security is compromised and malicious access becomes possible
Solution Approach 1:
The patent implements preliminary authentication actions before allowing data access. The host system must first authenticate itself using cryptographic keys and challenge-response mechanisms before the memory system permits reading from protected regions. This preliminary security check prevents unauthorized access while maintaining normal operation for authenticated hosts.
Solution Approach 2:
The patent introduces an intermediary authentication layer between the host system and memory data access. This intermediary mechanism uses cryptographic challenge-response protocols and key exchange as a mediator to verify host identity and authorization before allowing access to protected memory regions, thus resolving the contradiction between security and access simplicity.
2Adaptability or versatility
If memory systems use fixed protected region configurations, then implementation is simple, but adaptability to different security needs is limited
Solution Approach 1:
The patent implements dynamic protected region configuration that can adapt to different security needs. The protected regions are not fixed but can be dynamically created, modified, and deleted based on authentication results and security policies. This dynamic approach allows flexible adaptation while managing complexity through programmable region definitions.
Solution Approach 2:
The patent enables parameter changes in protected region attributes such as size, location, and access rights. These parameters can be modified based on the authenticated host's credentials and security requirements. By allowing parameter changes rather than fixed configurations, the system achieves adaptability while managing complexity through standardized parameter modification protocols.
3Reliability
If memory systems do not verify data authenticity, then data transmission is fast and simple, but security against malicious data is compromised
Solution Approach 1:
The patent performs preliminary authentication of the host system before allowing any data access. This preliminary action establishes trust and security context in advance, enabling subsequent data transmissions to be faster and simpler. The heavy authentication overhead is concentrated in the preliminary phase rather than being continuously applied to each data operation.
Solution Approach 2:
The patent implements a feedback mechanism where the memory system provides authentication challenges and verification results back to the host system. This feedback loop enables efficient challenge-response authentication that can verify data authenticity without requiring excessive time for each individual data operation, as the authentication state is maintained and reused.
4Reliability
If memory systems lack key exchange mechanisms, then the system is simple, but security against replay attacks and unauthorized access is insufficient
Solution Approach 1:
The patent implements preliminary key exchange and authentication mechanisms before allowing access to protected regions. The host system and memory system establish shared cryptographic keys and authentication tokens in advance through secure channels. This preliminary key establishment provides strong security against replay attacks while containing the complexity of key management within the authentication phase.
Solution Approach 2:
The patent introduces cryptographic key exchange protocols as an intermediary mechanism between the host system and memory system. This intermediary layer handles the complexity of secure key distribution and management, providing robust security against unauthorized access and replay attacks without requiring the entire system to be overly complex.
Data Source
AI summary
Methods, systems, and devices for authenticated reading of memory system data are described. In some examples, a host system and a memory system may exchange keys used to grant the host system access to one or more protected regions of the memory system. The keys may be symmetric or asymmetric. In some cases, the host system may transmit a read command to access data stored at a protected region of the memory system, along with a signature generated using the key associated with the protected region. The memory system may verify the signature to determine whether the host is authorized to access the protected region, and may transmit the requested data to the host system. In some examples, the memory system may sign the returned data, so that the host system may verify the source of the data.