Secure Storage Device Host Configuration via Security Controller
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The configuration of multiple secure storage devices becomes exponentially time-consuming and burdensome for operators due to the need for individual entry of settings and identification information through physical keypads, especially as the number of devices increases, and there is a risk of PIN knowledge being shared among multiple operators before deployment to end users.
Innovation Solution
A host software application is enabled to launch a secure configuration of secure storage devices when they are in a configuration-ready mode, allowing concurrent configuration of multiple devices and preventing configuration when not in this mode, using a security controller to arbitrate access and ensure secure communication channels are established.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If configuration is performed through physical keypads on each secure storage device individually, then security is maintained, but configuration time increases exponentially as the number of devices increases
Solution Approach 1:
A host computer is introduced as an intermediary device to configure multiple secure storage devices simultaneously. The host receives configuration data from the operator and distributes it to multiple devices through communication interfaces (USB, Ethernet, etc.), eliminating the need for operators to physically configure each device individually through keypads while maintaining security through controlled access protocols
2Productivity
If multiple operators are allowed to configure devices, then configuration efficiency improves, but the risk of PIN knowledge being shared increases
Solution Approach 1:
The sensitive PIN entry function is extracted from the physical keypad interface and relocated to the host computer's software interface. Operators input PINs and configuration data through the host's display and keyboard, which are not physically attached to the secure storage devices. This separation prevents operators from seeing or memorizing PINs entered on the device's own keypad, thereby reducing the risk of PIN knowledge being shared among multiple operators
Data Source
Figure 1
Figure 2
Figure 3A
AI summary
A secure storage device includes a physical key input device, a secure memory and a controller. The controller arbitrates access by a host to securely configure the device based on the device's mode of operation. The controller determines whether the device is in a configuration-ready mode based on information within the device. Only when the device is in the configuration-ready mode, the device may be configured by the host. When a device is in a non-configuration-ready mode, the device is prevented from being configured by the host, but the device can be set to the configuration-ready mode, for example, by nullifying configuration data (e.g., PINs), by creating new encryption key(s), and by setting the mode to the configuration-ready mode. A null PIN is unusable to unlock the device after being locked. A new encryption key is unusable to decrypt data previously stored in the device, making such data unrecoverable.