Security Module Memory Management via Write Operation Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security modules, such as chip cards, are vulnerable to data manipulation and roll-back attacks, where unauthorized write operations can reverse changes, compromising security-critical data.
Innovation Solution
A security module with a detection unit to analyze write operations and a manipulation handling unit to prevent or reverse unauthorized write operations, ensuring only authorized write units access specific memory segments, employing existing hardware with minimal adjustments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If multiple write units are allowed to access the data memory for operational flexibility, then the ease of operation is improved, but the security against unauthorized write operations deteriorates
Solution Approach 1:
The detection unit acts as an intermediary between write units and the data memory. It monitors and detects which write unit is currently accessing the memory, providing this information to the manipulation handling unit which then decides whether to permit or block the write operation based on authorization rules.
Solution Approach 2:
The system implements feedback by continuously monitoring write operations through the detection unit and using the manipulation handling unit to enforce access control decisions. The system receives feedback about current write operations and responds by permitting or blocking them based on pre-defined authorization rules.
2Ease of operation
If read operations are permitted for backup creation, then the ease of operation is improved, but the vulnerability to roll-back attacks worsens
Solution Approach 1:
The system performs preliminary action by detecting and recording which write unit is performing the write operation before the operation is completed. This detection happens in advance, allowing the manipulation handling unit to verify authorization and prevent unauthorized operations before they can compromise security.
Solution Approach 2:
The manipulation handling unit applies preliminary anti-action by blocking unauthorized write operations before they can execute. By detecting the write unit identity in advance and comparing it against authorization rules, the system prevents roll-back attacks before they can occur.
3Reliability
If strict access control is implemented to prevent unauthorized writes, then data security is improved, but the device complexity increases
Solution Approach 1:
The detection unit provides self-service by automatically detecting which write unit is accessing the memory without requiring external intervention. The manipulation handling unit then uses this detected information to autonomously make authorization decisions, reducing the need for complex external control mechanisms.
Solution Approach 2:
The memory management functionality is segmented into distinct units: the detection unit for monitoring write operations and the manipulation handling unit for enforcing access control. This segmentation allows each unit to perform its specific function efficiently while maintaining overall system security.
Data Source
AI summary
The present invention relates to a security module and to a corresponding method for operating the security module for realizing a secure memory management. The subject matter according to the invention takes into account existing hardware components, for example a smart card, and can thus be integrated into existing smart cards with particularly little technical effort. The secure memory management prevents attacks against memory segments of the data memory.