Storage Controller Token Authentication for Secure Data Sharing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing storage devices face security concerns due to hacking risks, particularly when using Embedded Certificate Authorities (ECAs) as Roots of Trust, necessitating improved data access control and secure data sharing methods.
Innovation Solution
A storage device equipped with a certification module that generates and manages tokens using an ECA to control access, verifying user certificates and ensuring secure data sharing between users through a token-based system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If an Embedded Certificate Authority (ECA) is used as a Root of Trust to enable data sharing between users, then data sharing capability is improved, but security vulnerability to hacking increases
Solution Approach 1:
The patent segments the authentication process into multiple stages: user certificate verification, access request validation, and token generation. Instead of relying solely on a single Root of Trust (ECA), the system divides security verification into discrete steps with multiple validation points, reducing the risk associated with any single authentication mechanism.
Solution Approach 2:
The patent introduces an intermediary authentication mechanism that mediates between the ECA-based trust system and data access operations. The authentication module acts as a mediator that verifies user certificates issued by the ECA and generates access tokens, creating a buffer layer that enhances security while maintaining the data sharing functionality enabled by the ECA.
2Reliability
If traditional access control methods are used without token-based authentication, then system complexity is reduced, but data security and access control effectiveness deteriorate
Solution Approach 1:
The patent implements preliminary authentication actions by verifying user certificates and generating access tokens before actual data access operations. The system performs certificate validation and token generation in advance, so that when data access is requested, the authentication is already completed, enhancing security without significantly increasing operational complexity.
Solution Approach 2:
The patent creates digital copies of authentication credentials in the form of access tokens. Instead of repeatedly verifying user certificates for each data access operation, the system generates token copies that encapsulate authentication information, allowing efficient verification while maintaining security. This copying mechanism reduces the computational burden of repeated certificate validations.
3Measurement precision
If user certificates are verified for every access request, then access control precision is improved, but processing time increases
Solution Approach 1:
The patent performs certificate verification as a preliminary action during the authentication phase, before data access operations. By completing the time-consuming certificate validation in advance and generating access tokens, the system ensures that subsequent data access requests can be processed quickly using the pre-validated tokens, maintaining high access control precision while reducing processing time for actual data operations.
Solution Approach 2:
The patent implements partial verification by validating only the necessary portions of user certificates and access tokens. Instead of performing complete and redundant verification of all certificate attributes for every access request, the system verifies only the critical security elements that are sufficient for access control, reducing processing time while maintaining adequate precision.
Data Source
AI summary
A storage device includes: a nonvolatile memory storing data of a first user; and a storage controller configured to receive an access request from a second user to access the data of the first user, obtain access approval for accessing the data from the first user in response to the access request, generate a token granting access authority to the second user for accessing the data using an Embedded Certificate Authority (ECA) upon obtaining the access approval, and send the token to the second user.