Secure Memory Key Validation via Hash Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current secure memory devices lack mechanisms to prevent the writing of invalid cryptographic keys, leading to malfunctioning devices if errors occur during key delivery, resulting in data loss and loss of use, especially when physical access is not feasible.
Innovation Solution
A system that includes a memory device with a key storage area, a key management server (KMS) that generates and hashes cryptographic keys, and a manufacturer/computer device that verifies the keys by comparing local hashes to ensure validity before writing them to the memory device, with mechanisms to handle failure responses and re-attempt key writing if necessary.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic keys are stored in secure memory devices without validation mechanisms, then key storage is simple and fast, but the device may persist invalid keys causing malfunction
Solution Approach 1:
The patent applies preliminary action by computing and storing a hash of the cryptographic key before the key is written to the secure memory device. This pre-computed hash serves as a validation reference that enables future verification of key integrity without adding complexity to the key storage process itself.
Solution Approach 2:
The patent introduces a hash value as an intermediary element between the cryptographic key and the validation process. This hash acts as a mediator that can be stored separately and used to verify key integrity, thereby protecting the main key storage operation from requiring complex real-time validation mechanisms.
2Reliability
If hash validation is implemented for cryptographic keys, then invalid keys are prevented from being persisted, but the key management process becomes more complex
Solution Approach 1:
The patent implements self-service by enabling the secure memory device to autonomously validate cryptographic keys using pre-stored hash values. The device independently computes the hash of a received key and compares it with the stored reference hash, eliminating the need for external validation systems and reducing overall system complexity.
Solution Approach 2:
The patent applies feedback by creating a closed-loop validation process where the computed hash is immediately compared with the pre-stored reference hash. This feedback mechanism provides immediate verification of key validity, ensuring that only authenticated keys are accepted while maintaining a straightforward validation process.
3Productivity
If cryptographic keys are updated without verification, then key updates are fast and simple, but error propagation occurs leading to data loss
Solution Approach 1:
The patent applies preliminary action by pre-computing and storing the hash of the valid cryptographic key before key updates occur. This pre-prepared reference hash enables rapid validation during key updates without slowing down the update process, as the verification can be performed by simply comparing the new key's hash against the stored reference.
Solution Approach 2:
The patent replaces complex mechanical or procedural verification systems with a computational hash-based validation mechanism. This substitution allows for rapid automated verification of key integrity during updates, maintaining high productivity while preventing data loss through efficient error detection.
Data Source
AI summary
The disclosure relates to improvements in key delivery to secure memory devices. In some implementations, the techniques described herein relate to a system including: a memory device including a key storage area; a key management server (KMS) configured to receive a key request, generate a cryptographic key, compute a hash of the cryptographic key, and return the cryptographic key and the hash in response to the key request; and a manufacturer computing device configured to receive the cryptographic key and the hash as part of the response to the key request and issue a command including the cryptographic key and the hash to the memory device, wherein the memory device is configured to compute a local hash using the cryptographic key in the command, compare the local hash to the hash, and write the cryptographic key to the key storage area when the local hash matches the hash.