Security Processor Integrity Tree Replay Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computing devices face challenges in detecting replay attacks on secure data, particularly due to limited on-die real estate for security processors, which restricts the storage of secure information and makes them vulnerable to eavesdropping and malicious modifications.
Innovation Solution
A system-on-a-chip (SOC) with a dedicated security processor uses an integrity tree data structure to store and verify secure data, employing nonces and tags to detect replay attacks, with the root and higher-level nonces stored in on-chip memory for enhanced security and reduced storage requirements.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If security information is stored in off-chip memory to overcome limited on-chip memory capacity, then storage capacity is improved, but security level deteriorates due to vulnerability to eavesdropping and replay attacks
Solution Approach 1:
The system divides security information into two segments: critical security parameters (nonces, tags) are stored in on-chip memory while bulk data is stored in off-chip memory. This segmentation allows the system to maintain high security for critical parameters while utilizing off-chip memory for capacity requirements.
Solution Approach 2:
The patent introduces an integrity tree data structure as an intermediary mechanism between the security processor and off-chip memory. This intermediary provides authentication and replay attack detection without requiring all data to be stored in secure on-chip memory, thus enabling off-chip storage while maintaining security.
2Reliability
If an integrity tree with multiple levels is implemented to detect replay attacks, then security level is improved, but device complexity increases
Solution Approach 1:
The integrity tree implements a nested structure where each node contains child nodes and authentication information. This nested organization allows the system to achieve multi-level security verification while maintaining manageable complexity through hierarchical organization of data and security parameters.
Solution Approach 2:
The system performs preliminary authentication actions by storing nonces and tags in on-chip memory before data is written to off-chip memory. This preliminary action enables replay attack detection without requiring complex real-time verification algorithms, thus reducing operational complexity while maintaining high security.
3Reliability
If nonces and tags are stored in on-chip memory to enhance security, then security level is improved, but storage requirements for security information increase
Solution Approach 1:
The patent applies local quality by storing only the essential security parameters (nonces and tags) in on-chip memory rather than all data. This selective storage approach minimizes the storage burden on secure on-chip memory while maintaining adequate security levels for replay attack detection.
Data Source
AI summary
A system and method for detecting replay attacks on secure data are disclosed. A system on a chip (SOC) includes a security processor. Blocks of data corresponding to sensitive information are stored in off-chip memory. The security processor uses an integrity data structure, such as an integrity tree, for the blocks. The intermediate nodes of the integrity tree use nonces which have been generated independent of any value within a corresponding block. By using only the nonces to generate tags in the root at the top layer stored in on-chip memory and the nodes of the intermediate layers stored in off-chip memory, an amount of storage used is reduced for supporting the integrity tree. When the security processor detects events which create access requests for one or more blocks, the security processor uses the integrity tree to verify a replay attack has not occurred and corrupted data.