Storage Controller Key Generation with Salt Value Mediation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Storage devices that generate keys for encryption or decryption processing based on asymmetric-key algorithms face security risks when firmware is hacked, leading to potential key leakage.
Innovation Solution
A storage device with a non-volatile memory and a storage controller that generates a key material, receives a key ID from firmware, determines if a matching salt value is stored, and either uses the stored salt value or receives a new salt value from firmware to generate a private key, enhancing security and speed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If the storage device generates the key itself, then the key generation speed is improved, but the security reliability deteriorates due to potential firmware hacking
Solution Approach 1:
The patent introduces a salt value as an intermediary element that mediates between the firmware and the key material. The salt value is stored in non-volatile memory and used to derive the private key, preventing direct firmware access to the key material while enabling fast key generation through pre-stored salt values.
Solution Approach 2:
The key generation process is segmented into separate components: key material generation (performed once and stored), salt value storage (in non-volatile memory), and private key derivation (performed using both). This segmentation allows the security-critical key material to be isolated from the potentially compromised firmware while maintaining operational speed.
2Speed
If the salt value is stored in non-volatile memory, then the key generation speed is improved, but the device complexity increases
Solution Approach 1:
The non-volatile memory serves multiple functions: storing user data, storing the salt value, and potentially storing the key material. By making the existing non-volatile memory multi-functional, the patent avoids adding separate dedicated storage components, thereby limiting the increase in device complexity while achieving fast key generation.
3Reliability
If the key material is generated and stored separately, then the security reliability is improved, but the manufacturing complexity increases
Solution Approach 1:
The key material is generated and stored in non-volatile memory during the manufacturing process as a preliminary action. This allows the security-critical key material to be securely provisioned before the device reaches the user, simplifying the manufacturing process compared to implementing secure key generation hardware while maintaining high security reliability.
Data Source
AI summary
A storage device having improved security reliability includes a non-volatile memory, and a storage controller configured to control an operation of the non-volatile memory, generate a key material, receive a key identification (ID) from a firmware, determine whether a salt value matching the key ID is stored in the non-volatile memory, generate a private key using the salt value stored in the non-volatile memory and the key material in response to determining that the salt value matching the key ID is stored in the non-volatile memory, and, in response to determining that the sale value matching the key ID is not stored in the non-volatile memory, receive a salt value from the firmware and generate the private key using the salt value from the firmware and the key material, and store the salt value used for generating the private key in the non-volatile memory.