Secure SPI Flash With Separate Counters for Replay Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing semiconductor devices face hardware attacks that compromise their integrity, particularly through physical access and manipulation of memory contents, and existing replay-protected monotonic counters (RPMCs) provide insufficient security.
Innovation Solution
Implementing additional security measures, including a separate monotonic counter (A-MTC0) for secure commands and a device root key, with session keys generated via HMAC operations, to enhance security while maintaining compatibility with RPMCs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If replay-protected monotonic counters (RPMCs) are used to prevent command replay, then command replay attacks are thwarted, but security against hardware attacks and content extraction remains insufficient
Solution Approach 1:
The patent segments the security architecture by introducing a separate authenticated command counter (A-MTC0) specifically for secure commands, distinct from the RPMC used for general command replay protection. This segmentation allows different security mechanisms to operate independently, with A-MTC0 providing specialized protection against hardware attacks and content extraction while RPMC handles standard replay attacks.
Solution Approach 2:
The patent implements preliminary action by generating a device root key and session keys before authenticated commands are executed. The A-MTC0 counter is initialized and synchronized between host and device prior to secure operations, establishing a secure foundation that prevents hardware attacks and content extraction before they can occur.
2Object-affected harmful factors
If additional security measures like A-MTC0 and device root key are implemented, then security against hardware attacks is enhanced, but device complexity increases
Solution Approach 1:
The A-MTC0 counter serves multiple security functions simultaneously: it prevents replay attacks on authenticated commands, protects against hardware attacks, enables content extraction protection, and provides a foundation for secure key management. This multi-functionality reduces the need for separate dedicated mechanisms for each security concern, thereby limiting the increase in device complexity.
Solution Approach 2:
The device root key acts as an intermediary that bridges the host and memory device, enabling secure communication and authenticated commands without requiring complex point-to-point security mechanisms between all components. This intermediary key simplifies the overall security architecture by providing a centralized trust anchor.
3Reliability
If session keys are generated via HMAC operations for each power cycle, then unique secure keys are ensured, but computational overhead increases
Solution Approach 1:
Session keys are generated periodically at each power cycle using HMAC operations with the device root key and A-MTC0 counter. This periodic key generation ensures uniqueness for each session while allowing the system to return to a lower-power state between power cycles, managing computational energy consumption through regular rather than continuous operation.
4Object-affected harmful factors
If authenticated commands with A-MTC0 are implemented, then memory device contents are protected, but backward compatibility with legacy devices requires maintenance
Solution Approach 1:
The patent implements local quality by making security features optional and location-specific. Authenticated commands using A-MTC0 and device root keys can be enabled for specific memory devices or specific command types, while legacy devices or commands continue to use traditional RPMC-based protection. This allows memory content protection to be applied where needed without forcing compatibility issues on all systems.
Data Source
AI summary
The application relates to a secure memory device. The secure memory device includes a controller configured to decode and execute commands issued by a host device; a cryptographic engine, the cryptographic engine configured to authenticate a subset of the commands, the subset of the commands each including a digital signature; and a first monotonic counter, the first monotonic counter being incremented after executing at least some of the subset of the commands, wherein a value of the first monotonic counter is used to generate the digital signature.