Storage Controller Authentication for Secure Vendor Commands
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies lack a method for securely encoding and decoding vendor unique commands (VUC) to protect manufacturer-specific information from exposure, and existing memory devices do not adequately address the security of such commands.
Innovation Solution
A storage device and host device system that employs a VUC authentication system, utilizing a one-time password generated from runtime memory information to verify the legitimacy of vendor commands, thereby enhancing security against reverse engineering and brute force attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If vendor unique commands are made accessible for manufacturing and testing purposes, then ease of operation is improved, but security is worsened due to potential exposure of manufacturer technologies
Solution Approach 1:
The authentication process is segmented into distinct phases: initial authentication request, memory information exchange, one-time password generation, and vendor unique command execution. This segmentation allows security verification to occur before sensitive commands are executed, resolving the contradiction by separating accessibility from security verification.
Solution Approach 2:
The system performs preliminary authentication actions before executing vendor unique commands. The host device generates a one-time password based on memory information and transmits it to the storage device for verification. Only after successful authentication is the vendor unique command executed, ensuring security is established before operational accessibility is granted.
2Reliability
If authentication protocols are implemented for vendor unique commands, then security is improved, but device complexity is worsened
Solution Approach 1:
The authentication system is self-service in that the host device autonomously generates the one-time password using its own random number generator and cryptographic functions. The storage device autonomously verifies the password against its stored memory information. This eliminates the need for external authentication servers or complex mutual authentication protocols, reducing overall system complexity while maintaining security.
Solution Approach 2:
The system changes the parameter of password security from static to dynamic by implementing one-time passwords that are generated fresh for each authentication session based on runtime memory information. This parameter change enhances security without requiring complex key management infrastructure, as each password is ephemeral and session-specific.
3Reliability
If one-time passwords are generated using runtime memory information, then security against reverse engineering is improved, but use of energy is worsened due to additional processing
Solution Approach 1:
The system uses disposable one-time passwords that are generated and discarded after a single use. Each password is based on runtime memory information that changes with each authentication session, making previously captured passwords useless for future attacks. This disposable approach provides strong security against reverse engineering while keeping the generation process computationally efficient using standard cryptographic functions.
Data Source
Figure 1
Figure 2~3
Figure 4~5
AI summary
A storage device, comprising a memory, and a memory controller which includes a vendor unique command (VUC) authentication module and which is configured to control operations of the memory. The VUC authentication module is configured to transmit first memory information about the memory to a host device, receive from the host device a one-time password generated based upon the first memory information, verify the one-time password, and receive a vendor unique command from the host device when the one-time password is correct.