Public Key Storage with Signed Remote Update Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing memory devices lack a secure mechanism for updating public keys, which are crucial for secure communication and authentication, and are vulnerable to unauthorized changes or compromises.
Innovation Solution
Implementing a secure mechanism for updating public keys in memory devices by using a write-protected region and a key table, where commands are validated with a server's private key, ensuring only authorized updates can occur, and utilizing a standardized location for public keys accessible by secure boot, operating systems, and applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If public keys are stored in a write-protected region, then security against unauthorized changes is improved, but the ability to update public keys remotely is worsened
Solution Approach 1:
A server acts as an intermediary between the host system and the write-protected memory region. The server receives update requests, validates them using a private key, and sends signed commands to the memory device. This intermediary mechanism enables remote updates while maintaining the write-protection barrier, as the signed commands serve as authenticated authorization to modify the protected region.
Solution Approach 2:
The system performs preliminary validation of update requests by the server before allowing any write operations to the protected region. The server validates requests using its private key and signs authorized update commands in advance, ensuring that only pre-validated and authenticated changes can modify the public keys in the write-protected region.
2Reliability
If physical access is required to update public keys, then security is improved, but ease of operation is worsened
Solution Approach 1:
The patent replaces the mechanical/physical access requirement with a cryptographic authentication system. Instead of requiring physical presence at the device to update public keys, the system uses digital signatures and private key validation to authenticate update requests. The server can remotely authorize updates through signed commands, eliminating the need for physical access while maintaining security through cryptographic verification.
3Ease of operation
If a standardized location for public keys is implemented, then accessibility by secure boot and applications is improved, but security against unauthorized modification is worsened
Solution Approach 1:
The patent implements different access characteristics for different regions of the memory system. The public key table is stored in a standardized, accessible location that allows read access by secure boot, operating systems, and applications. However, the underlying storage region maintains write-protection properties that prevent unauthorized modifications. This local quality differentiation allows simultaneous readability for all components and write-protection for security, with updates only possible through authenticated server commands.
Data Source
AI summary
The disclosed embodiments relate to a memory device. In one embodiment, a memory device is disclosed comprising a storage array, the storage array including a first region, the first region storing a server public key associated with a server, and a key table; and a controller configured to: receive a message from the server, the message including a command modifying the key table, validate the message using the server public key, and modify the key table based on the message.