Cross-Device Secure Memory Access via Server-Mediated Credential Binding
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure memory devices face challenges in securely accessing content across different devices while maintaining protection against unauthorized access, particularly when a secure memory device is operated on one device but accessed through another.
Innovation Solution
The solution involves binding a first storage unit on a first host device to a second storage unit on a second host device based on binding types, where an account identifier is calculated and sent to a server to generate a credential for accessing the content, ensuring secure and authorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption is used to protect content on secure memory devices, then unauthorized access is prevented, but access through another device becomes blocked
Solution Approach 1:
A server acts as an intermediary between the first host device and the second storage unit. The server receives the account identifier from the first host device, sends it to the second storage unit to generate a credential, and then provides this credential to the first host device. This intermediary mechanism enables cross-device access while maintaining security, as the server mediates the authentication process without requiring direct access to the encrypted content.
Solution Approach 2:
The authentication process is segmented into distinct components: the account identifier is generated at the first host device, transmitted to the server, then forwarded to the second storage unit for credential generation. This segmentation allows each component to perform its specific function independently, enabling secure cross-device access without compromising the encryption protection.
2Reliability
If binding types are implemented for content access, then authorized access is controlled, but system complexity increases
Solution Approach 1:
The second storage unit autonomously generates the credential based on the account identifier received from the server. This self-service mechanism simplifies the overall system complexity by allowing the storage unit to independently perform its authentication function without requiring complex external verification systems.
Solution Approach 2:
The server provides feedback by sending the account identifier to the second storage unit and receiving the generated credential back. This feedback loop ensures that the authentication process is controlled and verified, maintaining access control reliability while using a relatively simple credential generation mechanism.
Data Source
AI summary
A first storage unit is bound to a second storage unit based on a binding type associated with content on the first storage unit, the first storage unit being operated through a first host device, and the second storage unit being operated through a second host device. When content on the first storage unit is requested in the first host device, the first host device will calculate an account identifier based on the binding type associated with the requested content and send the account identifier to a server. The server will send the account identifier to the second host device, and the second storage unit will use the account identifier to calculate a credential. The credential will be sent to the first host device through the server. The credential can be used to access the requested content if the credential is valid.