Storage Authentication for Secure Modification in Embedded Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing storage devices in embedded systems, such as those found in vehicles and IoT devices, lack robust security measures due to inflexibility and high costs associated with redesigning hardware, leading to vulnerabilities and compatibility issues.
Innovation Solution
Incorporating a cryptographic engine into storage devices to perform cryptographic operations through additional commands, allowing secure data transfers without modifying existing hardware, and implementing an authenticated modify command to ensure authorized writes to secure portions of the storage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If storage devices are connected to networks to enable remote access and cloud synchronization, then accessibility and functionality are improved, but security risks and data breach vulnerabilities increase
Solution Approach 1:
The patent introduces a trusted third-party authentication service as an intermediary between the storage device and the network. This mediator verifies device authenticity and manages secure communication protocols, allowing remote access while mitigating security risks through centralized authentication and credential validation.
Solution Approach 2:
The system implements continuous feedback mechanisms where authentication credentials are periodically verified, device status is monitored, and access rights are dynamically adjusted based on authentication results. This feedback loop ensures that only authenticated devices can access network resources, maintaining security while enabling connectivity.
2Reliability
If authentication protocols are implemented to verify device identity, then security is improved, but system complexity and processing overhead increase
Solution Approach 1:
The patent uses cryptographic hashes and digital certificates as copies of authentication data. Instead of transmitting sensitive authentication information directly, the system transmits and verifies cryptographic representations (hashes, certificates) that can be validated without exposing the original credentials, reducing complexity while maintaining security.
Solution Approach 2:
The authentication protocol transforms complex authentication verification into parameter comparison operations. The system changes the authentication parameter from complex cryptographic verification to simpler data structure comparison (comparing certificate hashes, validation timestamps), reducing processing complexity while maintaining security equivalence.
3Object-affected harmful factors
If data encryption and protection measures are implemented, then data security is improved, but storage requirements and processing overhead increase
Solution Approach 1:
The patent applies encryption and protection measures selectively at different levels (local file encryption, folder-level encryption, database-level encryption) rather than uniformly across all data. This localized approach protects sensitive data while minimizing the overall storage overhead by applying stronger encryption only where necessary.
Solution Approach 2:
The system introduces a data protection intermediary layer that handles encryption and decryption operations. This intermediary manages the cryptographic operations separately from the core storage and retrieval functions, allowing efficient data protection without increasing the fundamental storage requirements for unencrypted data.
Data Source
Figure 1
Figure 2~3
Figure 4
AI summary
Devices and techniques for authenticated modification of a storage device are described herein. A data transmission, received at an interface of the storage device, can be decoded to obtain a command, a set of input identifications, and a first signature corresponding to data identified by the input identifications. Members of the set of input identifications can be marshalled to produce an input set. A cryptographic engine of the storage device can be invoked on the input set to produce a second signature from the input set. The first signature is and the second signature are compared to determine a match. In response to the match, the input set can be written to a secure portion of the storage device.