Secure Memory Key Replacement Using UDS Hash Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current secure memory devices lack mechanisms to prevent the writing of invalid cryptographic keys, leading to malfunctioning or unusable devices if corrupted keys are provided.
Innovation Solution
Implementing key exchange protocols like Diffie-Hellman or Elliptic Curve Diffie-Hellman and unique device secrets to ensure that only valid public keys are written to the memory device by comparing hashes generated from the device's private key and the key management server's public key.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If current secure memory devices store cryptographic keys without validation mechanisms, then key writing is simple and fast, but the device reliability deteriorates when corrupted keys are provided
Solution Approach 1:
The patent applies preliminary action by computing and storing a hash of the unique device secret (UDS) during manufacturing, before any key operations occur. This pre-computed hash serves as a reference for later validation of public keys, allowing the device to reject invalid keys without complex real-time verification mechanisms.
Solution Approach 2:
The patent uses a hash value as an intermediary element between the unique device secret and public key validation. Instead of directly comparing complex cryptographic parameters, the system validates public keys by checking whether they produce the expected hash when combined with the UDS, simplifying the validation process while maintaining security.
2Manufacturing precision
If secure memory devices implement hash comparison validation for public keys, then key validity is ensured, but the manufacturing process becomes more complex
Solution Approach 1:
The validation mechanism is established during manufacturing by pre-computing and storing the hash of the unique device secret in secure storage. This preliminary setup enables automated validation during key writing operations without requiring complex manual verification procedures, thereby improving manufacturing precision while keeping the process manageable.
Solution Approach 2:
The system performs self-validation by automatically comparing the computed hash from public key operations against the pre-stored reference hash. This self-service mechanism eliminates the need for external validation authorities or manual checking, improving both manufacturing precision and ease of manufacture through automation.
3Productivity
If no key validation is implemented, then device complexity is low, but error rates increase during manufacturing and customer key updates
Solution Approach 1:
The hash value serves as an intermediary that enables automated error detection during key operations. By comparing the computed hash against the pre-stored reference, the system can automatically identify invalid keys without requiring complex error-checking algorithms or external validation, thereby improving productivity through error reduction while maintaining manageable device complexity.
Solution Approach 2:
The system implements feedback by continuously validating public keys against the pre-stored hash reference during manufacturing and customer key updates. This feedback mechanism automatically detects and rejects invalid keys, reducing error rates without requiring complex manual intervention or overly sophisticated validation systems.
Data Source
AI summary
The disclosure relates to improvements in the delivery of cryptographic data to secure memory devices. In some aspects, the techniques described herein relate to a method including: receiving, by a memory device, a command, the command including a public key and a hash of a unique device secret (UDS); generating, by the memory device, a local UDS using the public key and a locally stored private key; generating, by the memory device, a local UDS hash by inputting the local UDS into a hashing algorithm; determining, by the memory device, whether the local UDS hash matches the hash included in the command; writing, by the memory device, the public key to a key storage area if the local UDS hash matches the hash included in the command; and returning, by the memory device, a failure response if the local UDS hash does not match the hash included in the command.