Storage Device Key Exchange for Secure Authority Transfer
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing semiconductor devices, such as solid state drives (SSDs), lack robust security measures for managing access and encryption keys among multiple user identities, leading to potential vulnerabilities and unauthorized access.
Innovation Solution
A method involving a trusted third party (TTP) generates certificates based on user IDs and public keys, performing verifications to derive ciphering keys, ensuring secure key exchange and authority transfer within the storage device, using cryptographic techniques like Diffie-Hellman and elliptic curve Diffie-Hellman schemes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If hardware-based full-disk encryption is implemented in storage devices, then security performance is improved, but key management complexity increases
Solution Approach 1:
The patent introduces a trusted third party (TTP) as an intermediary that generates and manages cryptographic keys and certificates. The TTP acts as a mediator between multiple users and the storage device, handling key generation, certificate issuance, and verification. This external intermediary resolves the key management complexity by centralizing security operations outside the storage device while maintaining strong security through cryptographic protocols.
2Adaptability or versatility
If multiple user identities are allowed to access the storage device, then adaptability is improved, but security vulnerabilities increase
Solution Approach 1:
The patent segments access authority by creating individual cryptographic key pairs and certificates for each user identity. Each user has their own private key for authentication and their own certificate for verification. This segmentation isolates security credentials so that compromise of one user's credentials does not affect other users, enabling multi-user access while maintaining security through independent authentication mechanisms.
Solution Approach 2:
The trusted third party serves as an intermediary that issues and verifies certificates for multiple users. The TTP manages the certificate authority functions, signing user certificates and verifying them during authentication. This intermediary approach enables scalable multi-user access with centralized security management, allowing the system to accommodate multiple identities without proportionally increasing security complexity.
3Ease of operation
If authority transfer between users is enabled, then ease of operation is improved, but risk of unauthorized access increases
Solution Approach 1:
The trusted third party acts as an intermediary that secures the authority transfer process. When authority needs to be transferred between users, the TTP verifies the requesting user's identity and credentials, then facilitates the secure transfer of access rights through cryptographic key exchange and certificate validation. This intermediary presence ensures that authority transfer occurs only through authenticated channels, preventing unauthorized access while enabling operational flexibility.
Solution Approach 2:
The system performs preliminary verification of user credentials and authority rights before allowing any transfer operation. The TTP checks the requesting user's certificate and private key authenticity before initiating the transfer process. This preliminary action ensures that only authorized users can initiate transfers and that the transfer process itself is secured, reducing the risk of unauthorized access while maintaining ease of legitimate authority transfer.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method for performing key exchange for a security operation in a storage device includes generating, by a trusted third party (TTP), a first certificate based on a first user ID and first public key and generating a second certificate based on a second user ID and second public key. While the storage device is accessed by the first user ID, a first verification is performed on the second certificate based on a third certificate. When the first verification is successfully completed, a ciphering key is derived based on a first private key and the second public key. While the storage device is accessed by the second user ID, a second verification is performed on the first certificate based on the third certificate. When the second verification is successfully completed, the ciphering key is derived based on a second private key and the first public key.