Secure Data Utilization via Section Signature Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data utilization systems lack secure mechanisms to authenticate and validate data integrity, particularly in scenarios where data is transferred between external and internal memories, making them vulnerable to tampering and unauthorized execution.
Innovation Solution
A system comprising an external memory, internal memory, and a processor arrangement with a transfer module, authentication module, and execution module that authenticates signatures, creates symmetric signatures, and ensures only valid data sections are executed, using asymmetric and symmetric cryptography to secure data transfer and execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If data is transferred from external memory to internal memory without authentication, then processing speed is improved, but data security and integrity are compromised
Solution Approach 1:
The system performs preliminary authentication of data sections before transferring them from external memory to internal memory. The authentication module verifies signatures of code sections, data sections, and intermediate code sections before they are loaded into internal memory, ensuring that only authenticated data is transferred. This preliminary action maintains data integrity while enabling efficient processing of verified data.
2Reliability
If comprehensive authentication of all data sections is performed, then data security is improved, but processing time and computational overhead increase
Solution Approach 1:
The data stored in external memory is divided into multiple sections including code sections, data sections, and intermediate code sections. Each section is independently authenticated with its own signature. This segmentation allows the system to authenticate only the necessary sections rather than the entire data set, reducing processing time while maintaining comprehensive security coverage.
Solution Approach 2:
The system performs authentication on a selective basis rather than uniformly on all data. Intermediate code sections are authenticated with symmetric signatures for faster verification, while other sections use asymmetric signatures. This partial authentication approach ensures security for critical sections while reducing overall processing overhead.
3Reliability
If asymmetric signatures are used for all data sections, then security is improved, but computational complexity and processing overhead increase
Solution Approach 1:
Different signature types are applied to different data sections based on their specific security requirements and characteristics. Code sections use asymmetric signatures for strong security, while intermediate code sections use symmetric signatures for faster processing. This local differentiation optimizes the balance between security and computational complexity for each section.
Solution Approach 2:
The system uses a composite authentication approach combining both asymmetric and symmetric signature mechanisms. Asymmetric signatures provide strong security for critical sections, while symmetric signatures provide efficient verification for less critical sections. This composite approach leverages the strengths of both cryptographic methods to achieve both security and efficiency.
4Productivity
If data is cached in internal memory for reuse, then processing efficiency is improved, but vulnerability to tampering increases
Solution Approach 1:
The system implements a feedback mechanism where the processor arrangement continuously monitors and verifies the integrity of cached data sections in internal memory. Before executing cached code sections or using cached data sections, the system re-authenticates them to detect any tampering that may have occurred during or after the initial authentication. This feedback loop maintains security while allowing efficient reuse of verified data.
Data Source
AI summary
A system, comprising an external memory operative to store data therein, the data including a plurality of sections, each of the sections being associated with a signature, and an internal memory operationally connected to the external memory, and a processor arrangement operationally connected to the internal memory, the processor arrangement including a transfer module to transfer one section from the external to the internal memory, an authentication module to authenticate the signature of the section transferred from the external memory, a validity status module to identify the section as valid if the signature is authentic, and an execution module to utilize the section of the data only if the section is valid, wherein the validity status module is operative to invalidate the section, if the content of the section is changed while stored in the internal memory. Related apparatus and methods are also described.