RPMB Storage Access With Authenticated Command PIUs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing storage devices lack effective security measures to prevent unauthorized access and replay attacks, particularly on nonvolatile memory blocks, compromising data integrity and security.
Innovation Solution
Incorporation of a replay protected memory block (RPMB) with a memory controller that processes command protocol information units (PIUs) including authentication mechanisms, such as host MAC calculation and generation of PIUs with extra header segments, to ensure secure access and data integrity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If traditional memory blocks are used without authentication mechanisms, then ease of operation is improved, but security is compromised
Solution Approach 1:
The memory device is segmented into traditional memory blocks and a dedicated RPMB with authentication capabilities. The RPMB operates as a separate secured unit that can authenticate hosts before allowing access to specific memory regions, thus providing security without compromising the ease of operation for traditional memory access.
Solution Approach 2:
The RPMB acts as an intermediary authentication layer between the host and the memory device. It verifies host credentials and grants or denies access to memory operations, thereby enhancing security while maintaining operational simplicity for authorized users.
2Reliability
If authentication mechanisms are implemented in memory blocks, then data security is improved, but device complexity increases
Solution Approach 1:
Authentication functionality is segmented into a dedicated RPMB unit rather than being distributed across all memory blocks. This concentrates complexity in a single module while keeping the rest of the memory system simple and unchanged.
Solution Approach 2:
The RPMB serves multiple functions: it acts as both a secure storage location for authentication credentials and an access control gateway for the memory device. This multi-functionality reduces the need for additional separate authentication components.
3Reliability
If RPMB with authentication is implemented, then security against replay attacks is improved, but processing time increases
Solution Approach 1:
Authentication credentials are pre-configured in the RPMB during manufacturing or initialization. This preliminary setup eliminates the need for complex real-time credential verification, reducing authentication processing time while maintaining strong replay attack protection.
Solution Approach 2:
The RPMB uses cryptographic message authentication codes (MACs) that can be quickly computed and verified. These MACs serve as compact representations of authentication credentials, enabling fast verification without time-consuming complex authentication protocols.
Data Source
AI summary
Storage devices, host devices and electronic devices are disclosed. In an embodiment of the disclosed technology, an electronic device providing an improved security function may include a storage device including a replay protected memory block (RPMB), and a host device configured to provide a command protocol information unit (PIU) instructing the storage device to access the RPMB. The command PIU may include a basic header segment including a total extra header segment length field having a value other than 0 and an extra header segment including a host RPMB message.